Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
lock.exe

Overview

General Information

Sample name:lock.exe
Analysis ID:1587970
MD5:298dcbbe53e340a4a430c430ec9e3b5d
SHA1:0231acec8068d615edf6b6eb1abc3d4afb828028
SHA256:b58b7853318f6c9f0d66d1f2a8d7ff5ad42be424fdf8e04615d8c38980b3811b
Tags:cryptcryptlockerexelockerpythontrojanuser-gesgov
Infos:

Detection

Score:52
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Found pyInstaller with non standard icon
Binary contains a suspicious time stamp
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query CPU information (cpuid)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Extensive use of GetProcAddress (often used to hide API calls)
Found dropped PE file which has not been started or loaded
Found evasive API chain checking for process token information
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info

Classification

Process Tree

  • System is w10x64
  • lock.exe (PID: 3268 cmdline: "C:\Users\user\Desktop\lock.exe" MD5: 298DCBBE53E340A4A430C430EC9E3B5D)
    • conhost.exe (PID: 6064 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • lock.exe (PID: 1816 cmdline: "C:\Users\user\Desktop\lock.exe" MD5: 298DCBBE53E340A4A430C430EC9E3B5D)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for submitted file
Source: lock.exeVirustotal: Detection: 11%Perma Link
Source: lock.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: Binary string: D:\a\1\b\bin\amd64\select.pdb source: lock.exe, 00000000.00000003.2292023892.000002662C1EF000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: lock.exe, 00000000.00000003.2292314570.000002662C1EF000.00000004.00000020.00020000.00000000.sdmp, unicodedata.pyd.0.dr
Source: Binary string: D:\a\1\b\libcrypto-3.pdb| source: libcrypto-3.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: lock.exe, 00000000.00000003.2283181654.000002662C1EF000.00000004.00000020.00020000.00000000.sdmp, _hashlib.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_decimal.pdb$$ source: _decimal.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: lock.exe, 00000000.00000003.2283335367.000002662C1EF000.00000004.00000020.00020000.00000000.sdmp, _lzma.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_decimal.pdb source: _decimal.pyd.0.dr
Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.15 3 Sep 20243.0.15built on: Wed Sep 4 15:52:04 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"userSDIR: "C:\Program Files\OpenSSL\lib\users-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL || WITHIN_ARENA(temp->next)assertion failed: (char **)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) || WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/*0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_p
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: lock.exe, 00000000.00000003.2283335367.000002662C1EF000.00000004.00000020.00020000.00000000.sdmp, _lzma.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: lock.exe, 00000000.00000003.2282583595.000002662C1EF000.00000004.00000020.00020000.00000000.sdmp, _bz2.pyd.0.dr
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: lock.exe, 00000000.00000003.2282304967.000002662C1EF000.00000004.00000020.00020000.00000000.sdmp, lock.exe, 00000003.00000002.3538393900.00007FFDA4344000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: libcrypto-3.dll.0.dr
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: lock.exe, 00000000.00000003.2282304967.000002662C1EF000.00000004.00000020.00020000.00000000.sdmp, lock.exe, 00000003.00000002.3538393900.00007FFDA4344000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source: Binary string: D:\a\1\b\libcrypto-3.pdb source: libcrypto-3.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: lock.exe, 00000000.00000003.2283520613.000002662C1EF000.00000004.00000020.00020000.00000000.sdmp, _socket.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\python313.pdb source: lock.exe, 00000003.00000002.3537378063.00007FFD93E79000.00000002.00000001.01000000.00000004.sdmp, python313.dll.0.dr
Source: C:\Users\user\Desktop\lock.exeCode function: 0_2_00007FF693148840 FindFirstFileExW,FindClose,0_2_00007FF693148840
Source: C:\Users\user\Desktop\lock.exeCode function: 0_2_00007FF693162AE4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,0_2_00007FF693162AE4
Source: C:\Users\user\Desktop\lock.exeCode function: 0_2_00007FF693147800 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,0_2_00007FF693147800
Source: C:\Users\user\Desktop\lock.exeCode function: 3_2_00007FF693148840 FindFirstFileExW,FindClose,3_2_00007FF693148840
Source: C:\Users\user\Desktop\lock.exeCode function: 3_2_00007FF693162AE4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,3_2_00007FF693162AE4
Source: C:\Users\user\Desktop\lock.exeCode function: 3_2_00007FF693147800 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,3_2_00007FF693147800
Source: lock.exe, 00000000.00000003.2285471098.000002662C1EF000.00000004.00000020.00020000.00000000.sdmp, lock.exe, 00000000.00000003.2285471098.000002662C1F6000.00000004.00000020.00020000.00000000.sdmp, libcrypto-3.dll.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: lock.exe, 00000000.00000003.2285471098.000002662C1F6000.00000004.00000020.00020000.00000000.sdmp, libcrypto-3.dll.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: lock.exe, 00000000.00000003.2285471098.000002662C1EF000.00000004.00000020.00020000.00000000.sdmp, libcrypto-3.dll.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: lock.exe, 00000000.00000003.2285471098.000002662C1EF000.00000004.00000020.00020000.00000000.sdmp, lock.exe, 00000000.00000003.2285471098.000002662C1F6000.00000004.00000020.00020000.00000000.sdmp, libcrypto-3.dll.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: lock.exe, 00000000.00000003.2285471098.000002662C1EF000.00000004.00000020.00020000.00000000.sdmp, lock.exe, 00000000.00000003.2285471098.000002662C1F6000.00000004.00000020.00020000.00000000.sdmp, libcrypto-3.dll.0.drString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: lock.exe, 00000000.00000003.2285471098.000002662C1F6000.00000004.00000020.00020000.00000000.sdmp, libcrypto-3.dll.0.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: lock.exe, 00000000.00000003.2285471098.000002662C1EF000.00000004.00000020.00020000.00000000.sdmp, libcrypto-3.dll.0.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: libcrypto-3.dll.0.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: lock.exe, 00000000.00000003.2285471098.000002662C1F6000.00000004.00000020.00020000.00000000.sdmp, libcrypto-3.dll.0.drString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: lock.exe, 00000000.00000003.2285471098.000002662C1F6000.00000004.00000020.00020000.00000000.sdmp, libcrypto-3.dll.0.drString found in binary or memory: http://ocsp.digicert.com0
Source: lock.exe, 00000000.00000003.2285471098.000002662C1EF000.00000004.00000020.00020000.00000000.sdmp, lock.exe, 00000000.00000003.2285471098.000002662C1F6000.00000004.00000020.00020000.00000000.sdmp, libcrypto-3.dll.0.drString found in binary or memory: http://ocsp.digicert.com0A
Source: lock.exe, 00000000.00000003.2285471098.000002662C1EF000.00000004.00000020.00020000.00000000.sdmp, lock.exe, 00000000.00000003.2285471098.000002662C1F6000.00000004.00000020.00020000.00000000.sdmp, libcrypto-3.dll.0.drString found in binary or memory: http://ocsp.digicert.com0C
Source: lock.exe, 00000000.00000003.2285471098.000002662C1EF000.00000004.00000020.00020000.00000000.sdmp, libcrypto-3.dll.0.drString found in binary or memory: http://ocsp.digicert.com0X
Source: lock.exe, 00000000.00000003.2285471098.000002662C1F6000.00000004.00000020.00020000.00000000.sdmp, libcrypto-3.dll.0.drString found in binary or memory: http://www.digicert.com/CPS0
Source: lock.exe, 00000000.00000003.2282979589.000002662C1EF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.microsoft.c
Source: lock.exe, 00000003.00000002.3535797091.0000019F269D0000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.drString found in binary or memory: https://docs.python.org/3/howto/mro.html.
Source: lock.exe, 00000003.00000002.3535387799.0000019F26798000.00000004.00000020.00020000.00000000.sdmp, lock.exe, 00000003.00000003.2301495069.0000019F267C3000.00000004.00000020.00020000.00000000.sdmp, lock.exe, 00000003.00000002.3534926592.0000019F264D0000.00000004.00001000.00020000.00000000.sdmp, lock.exe, 00000003.00000003.2301929536.0000019F267AB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename
Source: lock.exe, 00000003.00000002.3534926592.0000019F264D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code
Source: lock.exe, 00000003.00000002.3534926592.0000019F26554000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source
Source: lock.exe, 00000003.00000002.3534926592.0000019F264D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.is_package
Source: lock.exe, 00000003.00000002.3534926592.0000019F26554000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.create_module
Source: lock.exe, 00000003.00000002.3534926592.0000019F264D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module
Source: lock.exe, 00000003.00000002.3534926592.0000019F264D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches
Source: lock.exe, 00000003.00000002.3534926592.0000019F264D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec
Source: lock.exe, 00000003.00000002.3535387799.0000019F26798000.00000004.00000020.00020000.00000000.sdmp, lock.exe, 00000003.00000003.2301495069.0000019F267C3000.00000004.00000020.00020000.00000000.sdmp, lock.exe, 00000003.00000003.2301929536.0000019F267AB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data
Source: lock.exe, 00000003.00000002.3535387799.0000019F26798000.00000004.00000020.00020000.00000000.sdmp, lock.exe, 00000003.00000003.2301495069.0000019F267C3000.00000004.00000020.00020000.00000000.sdmp, lock.exe, 00000003.00000003.2301929536.0000019F267AB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: lock.exe, 00000003.00000002.3534926592.0000019F26554000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: lock.exe, 00000003.00000003.2301929536.0000019F267AB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: lock.exe, 00000003.00000002.3535387799.0000019F26798000.00000004.00000020.00020000.00000000.sdmp, lock.exe, 00000003.00000003.2301495069.0000019F267C3000.00000004.00000020.00020000.00000000.sdmp, lock.exe, 00000003.00000003.2301929536.0000019F267AB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: lock.exe, 00000003.00000002.3535387799.0000019F26798000.00000004.00000020.00020000.00000000.sdmp, lock.exe, 00000003.00000003.2301495069.0000019F267C3000.00000004.00000020.00020000.00000000.sdmp, lock.exe, 00000003.00000003.2301929536.0000019F267AB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: lock.exe, 00000003.00000002.3536544144.0000019F26CEC000.00000004.00001000.00020000.00000000.sdmp, lock.exe, 00000003.00000003.2297142604.0000019F26791000.00000004.00000020.00020000.00000000.sdmp, base_library.zip.0.drString found in binary or memory: https://peps.python.org/pep-0205/
Source: lock.exe, 00000003.00000002.3537378063.00007FFD93E79000.00000002.00000001.01000000.00000004.sdmp, python313.dll.0.drString found in binary or memory: https://peps.python.org/pep-0263/
Source: libcrypto-3.dll.0.drString found in binary or memory: https://www.openssl.org/H
Source: lock.exe, 00000003.00000002.3537378063.00007FFD93E79000.00000002.00000001.01000000.00000004.sdmp, python313.dll.0.drString found in binary or memory: https://www.python.org/psf/license/)
Source: C:\Users\user\Desktop\lock.exeCode function: 0_2_00007FF693161B380_2_00007FF693161B38
Source: C:\Users\user\Desktop\lock.exeCode function: 0_2_00007FF693167BD40_2_00007FF693167BD4
Source: C:\Users\user\Desktop\lock.exeCode function: 0_2_00007FF6931480200_2_00007FF693148020
Source: C:\Users\user\Desktop\lock.exeCode function: 0_2_00007FF6931544500_2_00007FF693154450
Source: C:\Users\user\Desktop\lock.exeCode function: 0_2_00007FF693156CF00_2_00007FF693156CF0
Source: C:\Users\user\Desktop\lock.exeCode function: 0_2_00007FF693150D180_2_00007FF693150D18
Source: C:\Users\user\Desktop\lock.exeCode function: 0_2_00007FF693153B880_2_00007FF693153B88
Source: C:\Users\user\Desktop\lock.exeCode function: 0_2_00007FF6931524200_2_00007FF693152420
Source: C:\Users\user\Desktop\lock.exeCode function: 0_2_00007FF69314A26D0_2_00007FF69314A26D
Source: C:\Users\user\Desktop\lock.exeCode function: 0_2_00007FF693162AE40_2_00007FF693162AE4
Source: C:\Users\user\Desktop\lock.exeCode function: 0_2_00007FF69316531C0_2_00007FF69316531C
Source: C:\Users\user\Desktop\lock.exeCode function: 0_2_00007FF69315EB240_2_00007FF69315EB24
Source: C:\Users\user\Desktop\lock.exeCode function: 0_2_00007FF69315132C0_2_00007FF69315132C
Source: C:\Users\user\Desktop\lock.exeCode function: 0_2_00007FF69316A9980_2_00007FF69316A998
Source: C:\Users\user\Desktop\lock.exeCode function: 0_2_00007FF693149A340_2_00007FF693149A34
Source: C:\Users\user\Desktop\lock.exeCode function: 0_2_00007FF69314989B0_2_00007FF69314989B
Source: C:\Users\user\Desktop\lock.exeCode function: 0_2_00007FF6931670EC0_2_00007FF6931670EC
Source: C:\Users\user\Desktop\lock.exeCode function: 0_2_00007FF6931511280_2_00007FF693151128
Source: C:\Users\user\Desktop\lock.exeCode function: 0_2_00007FF69315173C0_2_00007FF69315173C
Source: C:\Users\user\Desktop\lock.exeCode function: 0_2_00007FF6931537500_2_00007FF693153750
Source: C:\Users\user\Desktop\lock.exeCode function: 0_2_00007FF693153F8C0_2_00007FF693153F8C
Source: C:\Users\user\Desktop\lock.exeCode function: 0_2_00007FF6931527B80_2_00007FF6931527B8
Source: C:\Users\user\Desktop\lock.exeCode function: 0_2_00007FF69315EFB80_2_00007FF69315EFB8
Source: C:\Users\user\Desktop\lock.exeCode function: 0_2_00007FF6931590200_2_00007FF693159020
Source: C:\Users\user\Desktop\lock.exeCode function: 0_2_00007FF693166E700_2_00007FF693166E70
Source: C:\Users\user\Desktop\lock.exeCode function: 0_2_00007FF69315F6380_2_00007FF69315F638
Source: C:\Users\user\Desktop\lock.exeCode function: 0_2_00007FF693164E800_2_00007FF693164E80
Source: C:\Users\user\Desktop\lock.exeCode function: 0_2_00007FF6931676880_2_00007FF693167688
Source: C:\Users\user\Desktop\lock.exeCode function: 0_2_00007FF693161B380_2_00007FF693161B38
Source: C:\Users\user\Desktop\lock.exeCode function: 0_2_00007FF6931596D00_2_00007FF6931596D0
Source: C:\Users\user\Desktop\lock.exeCode function: 0_2_00007FF693150F1C0_2_00007FF693150F1C
Source: C:\Users\user\Desktop\lock.exeCode function: 0_2_00007FF6931515380_2_00007FF693151538
Source: C:\Users\user\Desktop\lock.exeCode function: 0_2_00007FF693148DC00_2_00007FF693148DC0
Source: C:\Users\user\Desktop\lock.exeCode function: 0_2_00007FF69315AE200_2_00007FF69315AE20
Source: C:\Users\user\Desktop\lock.exeCode function: 3_2_00007FF693167BD43_2_00007FF693167BD4
Source: C:\Users\user\Desktop\lock.exeCode function: 3_2_00007FF6931544503_2_00007FF693154450
Source: C:\Users\user\Desktop\lock.exeCode function: 3_2_00007FF693156CF03_2_00007FF693156CF0
Source: C:\Users\user\Desktop\lock.exeCode function: 3_2_00007FF693150D183_2_00007FF693150D18
Source: C:\Users\user\Desktop\lock.exeCode function: 3_2_00007FF693161B383_2_00007FF693161B38
Source: C:\Users\user\Desktop\lock.exeCode function: 3_2_00007FF693153B883_2_00007FF693153B88
Source: C:\Users\user\Desktop\lock.exeCode function: 3_2_00007FF6931524203_2_00007FF693152420
Source: C:\Users\user\Desktop\lock.exeCode function: 3_2_00007FF69314A26D3_2_00007FF69314A26D
Source: C:\Users\user\Desktop\lock.exeCode function: 3_2_00007FF693162AE43_2_00007FF693162AE4
Source: C:\Users\user\Desktop\lock.exeCode function: 3_2_00007FF69316531C3_2_00007FF69316531C
Source: C:\Users\user\Desktop\lock.exeCode function: 3_2_00007FF69315EB243_2_00007FF69315EB24
Source: C:\Users\user\Desktop\lock.exeCode function: 3_2_00007FF69315132C3_2_00007FF69315132C
Source: C:\Users\user\Desktop\lock.exeCode function: 3_2_00007FF69316A9983_2_00007FF69316A998
Source: C:\Users\user\Desktop\lock.exeCode function: 3_2_00007FF693149A343_2_00007FF693149A34
Source: C:\Users\user\Desktop\lock.exeCode function: 3_2_00007FF69314989B3_2_00007FF69314989B
Source: C:\Users\user\Desktop\lock.exeCode function: 3_2_00007FF6931670EC3_2_00007FF6931670EC
Source: C:\Users\user\Desktop\lock.exeCode function: 3_2_00007FF6931511283_2_00007FF693151128
Source: C:\Users\user\Desktop\lock.exeCode function: 3_2_00007FF69315173C3_2_00007FF69315173C
Source: C:\Users\user\Desktop\lock.exeCode function: 3_2_00007FF6931537503_2_00007FF693153750
Source: C:\Users\user\Desktop\lock.exeCode function: 3_2_00007FF693153F8C3_2_00007FF693153F8C
Source: C:\Users\user\Desktop\lock.exeCode function: 3_2_00007FF6931527B83_2_00007FF6931527B8
Source: C:\Users\user\Desktop\lock.exeCode function: 3_2_00007FF69315EFB83_2_00007FF69315EFB8
Source: C:\Users\user\Desktop\lock.exeCode function: 3_2_00007FF6931480203_2_00007FF693148020
Source: C:\Users\user\Desktop\lock.exeCode function: 3_2_00007FF6931590203_2_00007FF693159020
Source: C:\Users\user\Desktop\lock.exeCode function: 3_2_00007FF693166E703_2_00007FF693166E70
Source: C:\Users\user\Desktop\lock.exeCode function: 3_2_00007FF69315F6383_2_00007FF69315F638
Source: C:\Users\user\Desktop\lock.exeCode function: 3_2_00007FF693164E803_2_00007FF693164E80
Source: C:\Users\user\Desktop\lock.exeCode function: 3_2_00007FF6931676883_2_00007FF693167688
Source: C:\Users\user\Desktop\lock.exeCode function: 3_2_00007FF693161B383_2_00007FF693161B38
Source: C:\Users\user\Desktop\lock.exeCode function: 3_2_00007FF6931596D03_2_00007FF6931596D0
Source: C:\Users\user\Desktop\lock.exeCode function: 3_2_00007FF693150F1C3_2_00007FF693150F1C
Source: C:\Users\user\Desktop\lock.exeCode function: 3_2_00007FF6931515383_2_00007FF693151538
Source: C:\Users\user\Desktop\lock.exeCode function: 3_2_00007FF693148DC03_2_00007FF693148DC0
Source: C:\Users\user\Desktop\lock.exeCode function: 3_2_00007FF69315AE203_2_00007FF69315AE20
Source: C:\Users\user\Desktop\lock.exeCode function: 3_2_00007FFDA43383003_2_00007FFDA4338300
Source: C:\Users\user\Desktop\lock.exeCode function: 3_2_00007FFDA43363A03_2_00007FFDA43363A0
Source: C:\Users\user\Desktop\lock.exeCode function: String function: 00007FF693141E50 appears 106 times
Source: C:\Users\user\Desktop\lock.exeCode function: String function: 00007FF693142020 appears 34 times
Source: unicodedata.pyd.0.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: lock.exe, 00000000.00000003.2283335367.000002662C1EF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_lzma.pyd. vs lock.exe
Source: lock.exe, 00000000.00000003.2292314570.000002662C1EF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameunicodedata.pyd. vs lock.exe
Source: lock.exe, 00000000.00000003.2282583595.000002662C1EF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_bz2.pyd. vs lock.exe
Source: lock.exe, 00000000.00000003.2283181654.000002662C1EF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_hashlib.pyd. vs lock.exe
Source: lock.exe, 00000000.00000003.2282979589.000002662C1EF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_decimal.pyd. vs lock.exe
Source: lock.exe, 00000000.00000003.2292023892.000002662C1EF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameselect.pyd. vs lock.exe
Source: lock.exe, 00000000.00000003.2282304967.000002662C1EF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevcruntime140.dllT vs lock.exe
Source: lock.exe, 00000000.00000003.2283520613.000002662C1EF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_socket.pyd. vs lock.exe
Source: lock.exeBinary or memory string: OriginalFilename vs lock.exe
Source: lock.exe, 00000003.00000002.3538438392.00007FFDA434A000.00000002.00000001.01000000.00000005.sdmpBinary or memory string: OriginalFilenamevcruntime140.dllT vs lock.exe
Source: lock.exe, 00000003.00000002.3538317396.00007FFD940B2000.00000002.00000001.01000000.00000004.sdmpBinary or memory string: OriginalFilenamepython313.dll. vs lock.exe
Source: classification engineClassification label: mal52.winEXE@4/11@0/0
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6064:120:WilError_03
Source: C:\Users\user\Desktop\lock.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI32682Jump to behavior
Source: lock.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\lock.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: lock.exeVirustotal: Detection: 11%
Source: C:\Users\user\Desktop\lock.exeFile read: C:\Users\user\Desktop\lock.exeJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\lock.exe "C:\Users\user\Desktop\lock.exe"
Source: C:\Users\user\Desktop\lock.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\lock.exeProcess created: C:\Users\user\Desktop\lock.exe "C:\Users\user\Desktop\lock.exe"
Source: C:\Users\user\Desktop\lock.exeProcess created: C:\Users\user\Desktop\lock.exe "C:\Users\user\Desktop\lock.exe"Jump to behavior
Source: C:\Users\user\Desktop\lock.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\lock.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\lock.exeSection loaded: vcruntime140.dllJump to behavior
Source: lock.exeStatic PE information: Image base 0x140000000 > 0x60000000
Source: lock.exeStatic file information: File size 7211056 > 1048576
Source: lock.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: lock.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: lock.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: lock.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: lock.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: lock.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: lock.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: lock.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: D:\a\1\b\bin\amd64\select.pdb source: lock.exe, 00000000.00000003.2292023892.000002662C1EF000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: lock.exe, 00000000.00000003.2292314570.000002662C1EF000.00000004.00000020.00020000.00000000.sdmp, unicodedata.pyd.0.dr
Source: Binary string: D:\a\1\b\libcrypto-3.pdb| source: libcrypto-3.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: lock.exe, 00000000.00000003.2283181654.000002662C1EF000.00000004.00000020.00020000.00000000.sdmp, _hashlib.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_decimal.pdb$$ source: _decimal.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: lock.exe, 00000000.00000003.2283335367.000002662C1EF000.00000004.00000020.00020000.00000000.sdmp, _lzma.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_decimal.pdb source: _decimal.pyd.0.dr
Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.15 3 Sep 20243.0.15built on: Wed Sep 4 15:52:04 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"userSDIR: "C:\Program Files\OpenSSL\lib\users-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL || WITHIN_ARENA(temp->next)assertion failed: (char **)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) || WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/*0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_p
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: lock.exe, 00000000.00000003.2283335367.000002662C1EF000.00000004.00000020.00020000.00000000.sdmp, _lzma.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: lock.exe, 00000000.00000003.2282583595.000002662C1EF000.00000004.00000020.00020000.00000000.sdmp, _bz2.pyd.0.dr
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: lock.exe, 00000000.00000003.2282304967.000002662C1EF000.00000004.00000020.00020000.00000000.sdmp, lock.exe, 00000003.00000002.3538393900.00007FFDA4344000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: libcrypto-3.dll.0.dr
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: lock.exe, 00000000.00000003.2282304967.000002662C1EF000.00000004.00000020.00020000.00000000.sdmp, lock.exe, 00000003.00000002.3538393900.00007FFDA4344000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source: Binary string: D:\a\1\b\libcrypto-3.pdb source: libcrypto-3.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: lock.exe, 00000000.00000003.2283520613.000002662C1EF000.00000004.00000020.00020000.00000000.sdmp, _socket.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\python313.pdb source: lock.exe, 00000003.00000002.3537378063.00007FFD93E79000.00000002.00000001.01000000.00000004.sdmp, python313.dll.0.dr
Source: lock.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: lock.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: lock.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: lock.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: lock.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Source: VCRUNTIME140.dll.0.drStatic PE information: 0x78BDDED1 [Sat Mar 11 17:01:05 2034 UTC]
Source: VCRUNTIME140.dll.0.drStatic PE information: section name: fothk
Source: VCRUNTIME140.dll.0.drStatic PE information: section name: _RDATA
Source: libcrypto-3.dll.0.drStatic PE information: section name: .00cfg
Source: python313.dll.0.drStatic PE information: section name: PyRuntim

Persistence and Installation Behavior

barindex
Found pyInstaller with non standard icon
Source: C:\Users\user\Desktop\lock.exeProcess created: "C:\Users\user\Desktop\lock.exe"
Source: C:\Users\user\Desktop\lock.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI32682\_socket.pydJump to dropped file
Source: C:\Users\user\Desktop\lock.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI32682\select.pydJump to dropped file
Source: C:\Users\user\Desktop\lock.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI32682\_decimal.pydJump to dropped file
Source: C:\Users\user\Desktop\lock.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI32682\_hashlib.pydJump to dropped file
Source: C:\Users\user\Desktop\lock.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI32682\_bz2.pydJump to dropped file
Source: C:\Users\user\Desktop\lock.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI32682\VCRUNTIME140.dllJump to dropped file
Source: C:\Users\user\Desktop\lock.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI32682\unicodedata.pydJump to dropped file
Source: C:\Users\user\Desktop\lock.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI32682\libcrypto-3.dllJump to dropped file
Source: C:\Users\user\Desktop\lock.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI32682\python313.dllJump to dropped file
Source: C:\Users\user\Desktop\lock.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI32682\_lzma.pydJump to dropped file
Source: C:\Users\user\Desktop\lock.exeCode function: 0_2_00007FF693144C40 GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,0_2_00007FF693144C40
Source: C:\Users\user\Desktop\lock.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI32682\_socket.pydJump to dropped file
Source: C:\Users\user\Desktop\lock.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI32682\select.pydJump to dropped file
Source: C:\Users\user\Desktop\lock.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI32682\_decimal.pydJump to dropped file
Source: C:\Users\user\Desktop\lock.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI32682\_hashlib.pydJump to dropped file
Source: C:\Users\user\Desktop\lock.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI32682\_bz2.pydJump to dropped file
Source: C:\Users\user\Desktop\lock.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI32682\unicodedata.pydJump to dropped file
Source: C:\Users\user\Desktop\lock.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI32682\libcrypto-3.dllJump to dropped file
Source: C:\Users\user\Desktop\lock.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI32682\python313.dllJump to dropped file
Source: C:\Users\user\Desktop\lock.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI32682\_lzma.pydJump to dropped file
Source: C:\Users\user\Desktop\lock.exeCheck user administrative privileges: GetTokenInformation,DecisionNodesgraph_0-18408
Source: C:\Users\user\Desktop\lock.exeAPI coverage: 4.3 %
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Users\user\Desktop\lock.exeCode function: 0_2_00007FF693148840 FindFirstFileExW,FindClose,0_2_00007FF693148840
Source: C:\Users\user\Desktop\lock.exeCode function: 0_2_00007FF693162AE4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,0_2_00007FF693162AE4
Source: C:\Users\user\Desktop\lock.exeCode function: 0_2_00007FF693147800 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,0_2_00007FF693147800
Source: C:\Users\user\Desktop\lock.exeCode function: 3_2_00007FF693148840 FindFirstFileExW,FindClose,3_2_00007FF693148840
Source: C:\Users\user\Desktop\lock.exeCode function: 3_2_00007FF693162AE4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,3_2_00007FF693162AE4
Source: C:\Users\user\Desktop\lock.exeCode function: 3_2_00007FF693147800 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,3_2_00007FF693147800
Source: C:\Users\user\Desktop\lock.exeCode function: 0_2_00007FF69314C6FC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF69314C6FC
Source: C:\Users\user\Desktop\lock.exeCode function: 0_2_00007FF6931646F0 GetProcessHeap,0_2_00007FF6931646F0
Source: C:\Users\user\Desktop\lock.exeCode function: 0_2_00007FF69314C8A0 SetUnhandledExceptionFilter,0_2_00007FF69314C8A0
Source: C:\Users\user\Desktop\lock.exeCode function: 0_2_00007FF69314BE60 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00007FF69314BE60
Source: C:\Users\user\Desktop\lock.exeCode function: 0_2_00007FF69314C6FC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF69314C6FC
Source: C:\Users\user\Desktop\lock.exeCode function: 0_2_00007FF69315B558 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF69315B558
Source: C:\Users\user\Desktop\lock.exeCode function: 3_2_00007FF69314C8A0 SetUnhandledExceptionFilter,3_2_00007FF69314C8A0
Source: C:\Users\user\Desktop\lock.exeCode function: 3_2_00007FF69314BE60 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,3_2_00007FF69314BE60
Source: C:\Users\user\Desktop\lock.exeCode function: 3_2_00007FF69314C6FC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,3_2_00007FF69314C6FC
Source: C:\Users\user\Desktop\lock.exeCode function: 3_2_00007FF69315B558 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,3_2_00007FF69315B558
Source: C:\Users\user\Desktop\lock.exeCode function: 3_2_00007FFDA4340E08 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,3_2_00007FFDA4340E08
Source: C:\Users\user\Desktop\lock.exeProcess created: C:\Users\user\Desktop\lock.exe "C:\Users\user\Desktop\lock.exe"Jump to behavior
Source: C:\Users\user\Desktop\lock.exeCode function: 0_2_00007FF69316A7E0 cpuid 0_2_00007FF69316A7E0
Source: C:\Users\user\Desktop\lock.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI32682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\lock.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI32682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\lock.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI32682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\lock.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI32682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\lock.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI32682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\lock.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI32682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\lock.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI32682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\lock.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI32682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\lock.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI32682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\lock.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI32682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\lock.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI32682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\lock.exeQueries volume information: C:\Users\user\Desktop\lock.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\lock.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI32682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\lock.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI32682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\lock.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI32682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\lock.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI32682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\lock.exeQueries volume information: C:\Users\user\Desktop\lock.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\lock.exeQueries volume information: C:\Users\user\Desktop\lock.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\lock.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI32682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\lock.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI32682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\lock.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI32682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\lock.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI32682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\lock.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI32682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\lock.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI32682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\lock.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI32682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\lock.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI32682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\lock.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI32682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\lock.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI32682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\lock.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI32682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\lock.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI32682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\lock.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI32682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\lock.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI32682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\lock.exeQueries volume information: C:\Users\user\Desktop\lock.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\lock.exeQueries volume information: C:\Users\user\Desktop\lock.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\lock.exeQueries volume information: C:\Users\user\Desktop\lock.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\lock.exeQueries volume information: C:\Users\user\Desktop\lock.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\lock.exeQueries volume information: C:\Users\user\Desktop\lock.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\lock.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI32682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\lock.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI32682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\lock.exeQueries volume information: C:\Users\user\Desktop\lock.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\lock.exeQueries volume information: C:\Users\user\Desktop\lock.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\lock.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI32682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\lock.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI32682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\lock.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI32682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\lock.exeCode function: 0_2_00007FF69314C5E0 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,0_2_00007FF69314C5E0
Source: C:\Users\user\Desktop\lock.exeCode function: 0_2_00007FF6931670EC _get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,0_2_00007FF6931670EC

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts1
Native API		1
DLL Side-Loading		11
Process Injection		11
Process Injection		OS Credential Dumping2
System Time Discovery		Remote Services1
Archive Collected Data		1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
DLL Side-Loading		1
Deobfuscate/Decode Files or Information		LSASS Memory2
Security Software Discovery		Remote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
Timestomp		Security Account Manager1
File and Directory Discovery		SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
DLL Side-Loading		NTDS22
System Information Discovery		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
Obfuscated Files or Information		LSA SecretsInternet Connection DiscoverySSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1587970 Sample: lock.exe Startdate: 10/01/2025 Architecture: WINDOWS Score: 52 22 Multi AV Scanner detection for submitted file 2->22 6 lock.exe 13 2->6         started        process3 file4 14 C:\Users\user\AppData\...\unicodedata.pyd, PE32+ 6->14 dropped 16 C:\Users\user\AppData\Local\...\select.pyd, PE32+ 6->16 dropped 18 C:\Users\user\AppData\Local\...\python313.dll, PE32+ 6->18 dropped 20 7 other files (none is malicious) 6->20 dropped 24 Found pyInstaller with non standard icon 6->24 10 lock.exe 1 6->10         started        12 conhost.exe 6->12         started        signatures5 process6

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
lock.exe11%VirustotalBrowse
lock.exe8%ReversingLabs

Dropped Files

SourceDetectionScannerLabelLink
C:\Users\user\AppData\Local\Temp\_MEI32682\VCRUNTIME140.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI32682\_bz2.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI32682\_decimal.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI32682\_hashlib.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI32682\_lzma.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI32682\_socket.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI32682\libcrypto-3.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI32682\python313.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI32682\select.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI32682\unicodedata.pyd0%ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
ax-0001.ax-msedge.net
150.171.27.10
truefalse
    		high

    URLs from Memory and Binaries

    NameSourceMaliciousAntivirus DetectionReputation
    https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688lock.exe, 00000003.00000002.3534926592.0000019F26554000.00000004.00001000.00020000.00000000.sdmpfalse
      		high
      https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_codelock.exe, 00000003.00000002.3534926592.0000019F264D0000.00000004.00001000.00020000.00000000.sdmpfalse
        		high
        https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/readerlock.exe, 00000003.00000002.3535387799.0000019F26798000.00000004.00000020.00020000.00000000.sdmp, lock.exe, 00000003.00000003.2301495069.0000019F267C3000.00000004.00000020.00020000.00000000.sdmp, lock.exe, 00000003.00000003.2301929536.0000019F267AB000.00000004.00000020.00020000.00000000.sdmpfalse
          		high
          https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_sourcelock.exe, 00000003.00000002.3534926592.0000019F26554000.00000004.00001000.00020000.00000000.sdmpfalse
            		high
            https://www.openssl.org/Hlibcrypto-3.dll.0.drfalse
              		high
              https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_modulelock.exe, 00000003.00000002.3534926592.0000019F264D0000.00000004.00001000.00020000.00000000.sdmpfalse
                		high
                https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_speclock.exe, 00000003.00000002.3534926592.0000019F264D0000.00000004.00001000.00020000.00000000.sdmpfalse
                  		high
                  https://peps.python.org/pep-0205/lock.exe, 00000003.00000002.3536544144.0000019F26CEC000.00000004.00001000.00020000.00000000.sdmp, lock.exe, 00000003.00000003.2297142604.0000019F26791000.00000004.00000020.00020000.00000000.sdmp, base_library.zip.0.drfalse
                    		high
                    http://www.microsoft.clock.exe, 00000000.00000003.2282979589.000002662C1EF000.00000004.00000020.00020000.00000000.sdmpfalse
                      		high
                      https://docs.python.org/3/howto/mro.html.lock.exe, 00000003.00000002.3535797091.0000019F269D0000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.drfalse
                        		high
                        https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.is_packagelock.exe, 00000003.00000002.3534926592.0000019F264D0000.00000004.00001000.00020000.00000000.sdmpfalse
                          		high
                          https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_cacheslock.exe, 00000003.00000002.3534926592.0000019F264D0000.00000004.00001000.00020000.00000000.sdmpfalse
                            		high
                            https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#lock.exe, 00000003.00000002.3535387799.0000019F26798000.00000004.00000020.00020000.00000000.sdmp, lock.exe, 00000003.00000003.2301495069.0000019F267C3000.00000004.00000020.00020000.00000000.sdmp, lock.exe, 00000003.00000003.2301929536.0000019F267AB000.00000004.00000020.00020000.00000000.sdmpfalse
                              		high
                              https://www.python.org/psf/license/)lock.exe, 00000003.00000002.3537378063.00007FFD93E79000.00000002.00000001.01000000.00000004.sdmp, python313.dll.0.drfalse
                                		high
                                https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.pylock.exe, 00000003.00000003.2301929536.0000019F267AB000.00000004.00000020.00020000.00000000.sdmpfalse
                                  		high
                                  https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_datalock.exe, 00000003.00000002.3535387799.0000019F26798000.00000004.00000020.00020000.00000000.sdmp, lock.exe, 00000003.00000003.2301495069.0000019F267C3000.00000004.00000020.00020000.00000000.sdmp, lock.exe, 00000003.00000003.2301929536.0000019F267AB000.00000004.00000020.00020000.00000000.sdmpfalse
                                    		high
                                    https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.create_modulelock.exe, 00000003.00000002.3534926592.0000019F26554000.00000004.00001000.00020000.00000000.sdmpfalse
                                      		high
                                      https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sylock.exe, 00000003.00000002.3535387799.0000019F26798000.00000004.00000020.00020000.00000000.sdmp, lock.exe, 00000003.00000003.2301495069.0000019F267C3000.00000004.00000020.00020000.00000000.sdmp, lock.exe, 00000003.00000003.2301929536.0000019F267AB000.00000004.00000020.00020000.00000000.sdmpfalse
                                        		high
                                        https://peps.python.org/pep-0263/lock.exe, 00000003.00000002.3537378063.00007FFD93E79000.00000002.00000001.01000000.00000004.sdmp, python313.dll.0.drfalse
                                          		high
                                          https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filenamelock.exe, 00000003.00000002.3535387799.0000019F26798000.00000004.00000020.00020000.00000000.sdmp, lock.exe, 00000003.00000003.2301495069.0000019F267C3000.00000004.00000020.00020000.00000000.sdmp, lock.exe, 00000003.00000002.3534926592.0000019F264D0000.00000004.00001000.00020000.00000000.sdmp, lock.exe, 00000003.00000003.2301929536.0000019F267AB000.00000004.00000020.00020000.00000000.sdmpfalse
                                            		high

                                            World Map of Contacted IPs

                                            ⊘No contacted IP infos

                                            General Information

                                            Joe Sandbox version:42.0.0 Malachite
                                            Analysis ID:1587970
                                            Start date and time:2025-01-10 20:01:42 +01:00
                                            Joe Sandbox product:CloudBasic
                                            Overall analysis duration:0h 6m 14s
                                            Hypervisor based Inspection enabled:false
                                            Report type:full
                                            Cookbook file name:default.jbs
                                            Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                            Number of analysed new started processes analysed:19
                                            Number of new started drivers analysed:0
                                            Number of existing processes analysed:0
                                            Number of existing drivers analysed:0
                                            Number of injected processes analysed:0
                                            Technologies:
                                            • HCA enabled
                                            • EGA enabled
                                            • AMSI enabled
                                            Analysis Mode:default
                                            Analysis stop reason:Timeout
                                            Sample name:lock.exe
                                            Detection:MAL
                                            Classification:mal52.winEXE@4/11@0/0
                                            EGA Information:
                                            • Successful, ratio: 100%
                                            HCA Information:Failed
                                            Cookbook Comments:
                                            • Found application associated with file extension: .exe

                                            Warnings

                                            • Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
                                            • Excluded IPs from analysis (whitelisted): 2.23.242.162, 2.23.227.208, 13.107.253.45, 4.245.163.56, 20.223.36.55, 20.31.169.57, 150.171.27.10, 20.223.35.26
                                            • Excluded domains from analysis (whitelisted): www.bing.com, fs.microsoft.com, slscr.update.microsoft.com, otelrules.azureedge.net, tile-service.weather.microsoft.com, tse1.mm.bing.net, ctldl.windowsupdate.com, g.bing.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, fe3cr.delivery.mp.microsoft.com, e16604.g.akamaiedge.net, prod.fs.microsoft.com.akadns.net
                                            • Not all processes where analyzed, report is missing behavior information

                                            Simulations

                                            Behavior and APIs

                                            ⊘No simulations

                                            Joe Sandbox View / Context

                                            IPs

                                            ⊘No context

                                            Domains

                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                            ax-0001.ax-msedge.netnested-Please Review%3A].emlGet hashmaliciousUnknownBrowse
                                            • 150.171.27.10
                                            http://atozpdfbooks.comGet hashmaliciousUnknownBrowse
                                            • 150.171.27.10
                                            http://infarmbureau.comGet hashmaliciousUnknownBrowse
                                            • 150.171.27.10
                                            https://app.planable.io/review/0OPaw36t6M_kGet hashmaliciousHTMLPhisherBrowse
                                            • 150.171.28.10
                                            https://we.tl/t-fnebgmrnYQGet hashmaliciousUnknownBrowse
                                            • 150.171.28.10
                                            https://email.analystratings.net/ls/click?upn=u001.WeKo-2BCuHku2kJmVIsYmGxteRO-2BqdkFdZns7E8OZ0trgZRhaAY0f4dRd5bGXo8w1-2B5SPZj6mt6bkINmYNA1f4blf-2F2qp6pSrdQgqdtKPVZlFfsGiBd9L9S-2BVNmfUTaZ-2Bp0zWbjdQ23pm6OHkVsvPYDi1myQ0pU4BHbfSebmhjQAIDDVMgAvG7Znw7Pr8RLFA8HEKUDF6j4JiiZ3slfATgGRu3-2BdlWbffHNdZW8UBc7QW6Nxd08b90zhz6-2FhInZrSp1J-2Fh9yU6gsolKI10c6pp1uA-2FrYRI2h9aMn65O5NvFrP-2Fc-2BjlCyvznYBIXNfkBGEguSmRbREbgogGbx0CjJc9kfZpcF-2F4T3W7floa7RxJ5-2BKjbFDYD7FnGxTCmOAt-2BDLn5J0y5KvJMT3qFWKyQo5DJ5ru0B7ksJyMiI6L18xz5XP2GRtxbC7dwfszL4xopys7uMk6wzOFXTrTU9jYi2ZvQxqCtOzUddy1WGVe8msfQF8x3k3Ejw4p6mGzrKR8wOZXnO3uVw5n8j0tNkc31-2F1y7FsWAGygTmAHNV4DJiUXG3-2Foq61jCXRLG1PMMCZ97ToDeMjE9XjfX-2Bb4NXrzqR3tgw-3D-3DwyWG_tUVFAbhJxF44ufbifaYzyYApcQooCC4WsuZoiwe419Oh5WFVYobMs1ROnIPWGGcLQ6-2Bsxhj60Ehn0XDEyVD6MCEZ1gioYU2lwgwkCuP2dHRX-2FYdZnQ31dEdwKW37GtXYj9HmZ1F0YrZWwSELmaO5K7noqwYAhu2QGcGqOtQYdjShoJMVTWOe6BTzZXQxib8Y6rd4SX-2BUwZMt-2BbgPIpal6PcS8i4PCSiFy8RF-2Ftt22Wpj713n23BIU6an4375YDP3Get hashmaliciousUnknownBrowse
                                            • 150.171.28.10
                                            http://api.myuhchvision.com/Get hashmaliciousUnknownBrowse
                                            • 150.171.27.10
                                            http://www.oneroguereporter.com/gksGet hashmaliciousUnknownBrowse
                                            • 150.171.27.10
                                            colleague[1].htmGet hashmaliciousUnknownBrowse
                                            • 150.171.27.10
                                            https://email.analystratings.net/ls/click?upn=u001.WeKo-2BCuHku2kJmVIsYmGxsYmJ5tlN1JIFNOQtoSEGkLgECYxMchW4UXMllXUALJmesTsjgTR1H-2FvUTVSSAEe4R1GQy-2Bvbd8Zmmy4leDYmh9UNV6oDPX-2BT4wzcyKrfAdXvv6hKSBoru3q77depPs43qOB1DgUqmMdQP-2BNz7H62jYGp-2BH9nmpPKVjXmtKn9w5STVYGL4aqMBL65ruXSYeXZw-3D-3Didct_tUVFAbhJxF44ufbifaYzyYApcQooCC4WsuZoiwe419OCcA-2Bhorh4noX10R0htjc0oQD2shNvY2qd7sBvACS4ZxcOvRGqgf-2FzJzWjtjVb7R-2Fc1EPJdReLV-2BtujCvON-2Bc7V1MBDoLDS-2FjF655eEyLK512HQYbp-2FAbQ3P7q3sD01OmQtuWrJdDi7i9EqNYnB7vGsmi9YvC3tf2fi-2F59j5CgE2Yo8KxAbs4pwwxMvCRmFfOK49lsAVAfn3guJ7HTuaWXGet hashmaliciousUnknownBrowse
                                            • 150.171.28.10

                                            ASNs

                                            ⊘No context

                                            JA3 Fingerprints

                                            ⊘No context

                                            Dropped Files

                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                            C:\Users\user\AppData\Local\Temp\_MEI32682\VCRUNTIME140.dllsetup.exeGet hashmaliciousUnknownBrowse
                                              driver.exeGet hashmaliciousBlank GrabberBrowse
                                                SAP_Automation.exeGet hashmaliciousUnknownBrowse
                                                  file.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, PureLog Stealer, StealcBrowse
                                                    user.exeGet hashmaliciousUnknownBrowse
                                                      UpdaterTool.exeGet hashmaliciousUnknownBrowse
                                                        paint.exeGet hashmaliciousBlank GrabberBrowse
                                                          3LcZO15oTC.exeGet hashmaliciousUnknownBrowse
                                                            X9g8L63QGs.exeGet hashmaliciousBlank GrabberBrowse
                                                              riFSkYVMKB.exeGet hashmaliciousBlank GrabberBrowse

                                                                Created / dropped Files

                                                                C:\Users\user\AppData\Local\Temp\_MEI32682\VCRUNTIME140.dll

                                                                Download File
                                                                Process:C:\Users\user\Desktop\lock.exe
                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                Category:dropped
                                                                Size (bytes):120400
                                                                Entropy (8bit):6.6017475353076716
                                                                Encrypted:false
                                                                SSDEEP:1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
                                                                MD5:862F820C3251E4CA6FC0AC00E4092239
                                                                SHA1:EF96D84B253041B090C243594F90938E9A487A9A
                                                                SHA-256:36585912E5EAF83BA9FEA0631534F690CCDC2D7BA91537166FE53E56C221E153
                                                                SHA-512:2F8A0F11BCCC3A8CB99637DEEDA0158240DF0885A230F38BB7F21257C659F05646C6B61E993F87E0877F6BA06B347DDD1FC45D5C44BC4E309EF75ED882B82E4E
                                                                Malicious:false
                                                                Antivirus:
                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                Joe Sandbox View:
                                                                • Filename: setup.exe, Detection: malicious, Browse
                                                                • Filename: driver.exe, Detection: malicious, Browse
                                                                • Filename: SAP_Automation.exe, Detection: malicious, Browse
                                                                • Filename: file.exe, Detection: malicious, Browse
                                                                • Filename: user.exe, Detection: malicious, Browse
                                                                • Filename: UpdaterTool.exe, Detection: malicious, Browse
                                                                • Filename: paint.exe, Detection: malicious, Browse
                                                                • Filename: 3LcZO15oTC.exe, Detection: malicious, Browse
                                                                • Filename: X9g8L63QGs.exe, Detection: malicious, Browse
                                                                • Filename: riFSkYVMKB.exe, Detection: malicious, Browse
                                                                Reputation:moderate, very likely benign file
                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\=..\...\...\..S$...\...$...\...\..5\...\...\.....\.....\.....\.....\......\.....\..Rich.\..........PE..d.....x.........." ...).$...d............................................................`A........................................0u..4...d}..........................PP...........^..p............................\..@............@...............................text............................... ..`fothk........0...................... ..`.rdata...C...@...D...(..............@..@.data................l..............@....pdata...............p..............@..@_RDATA...............|..............@..@.rsrc................~..............@..@.reloc..............................@..B................................................................................................................................................................................

                                                                C:\Users\user\AppData\Local\Temp\_MEI32682\_bz2.pyd

                                                                Download File
                                                                Process:C:\Users\user\Desktop\lock.exe
                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                Category:dropped
                                                                Size (bytes):85496
                                                                Entropy (8bit):6.614481743039511
                                                                Encrypted:false
                                                                SSDEEP:1536:XEfz7lgmVLsSIX0qku0Spf72hbktIj865spLFImLV7yUzR9AfIIoT:0fz1IX8FS12itIA66pLFImLV5X
                                                                MD5:C17DCB7FC227601471A641EC90E6237F
                                                                SHA1:C93A8C2430E844F40F1D9C880AA74612409FFBB9
                                                                SHA-256:55894B2B98D01F37B9A8CF4DAF926D0161FF23C2FB31C56F9DBBAC3A61932712
                                                                SHA-512:38851CBD234A51394673A7514110EB43037B4E19D2A6FB79471CC7D01DBCF2695E70DF4BA2727C69F1FED56FC7980E3CA37FDDFF73CC3294A2EA44FACDEB0FA9
                                                                Malicious:false
                                                                Antivirus:
                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                Reputation:low
                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........U...4@..4@..4@..L...4@..A..4@....4@..C..4@..D..4@..E..4@.v.A..4@..A..4@..4A.4@.v.M..4@.v.@..4@.v....4@.v.B..4@.Rich.4@.................PE..d....WOg.........." ...*.....\..............................................P......Og....`.............................................H...(........0....... .. ........3...@..........T...........................`...@...............x............................text...?........................... ..`.rdata...=.......>..................@..@.data...............................@....pdata.. .... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................

                                                                C:\Users\user\AppData\Local\Temp\_MEI32682\_decimal.pyd

                                                                Download File
                                                                Process:C:\Users\user\Desktop\lock.exe
                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                Category:dropped
                                                                Size (bytes):280808
                                                                Entropy (8bit):6.594541687872342
                                                                Encrypted:false
                                                                SSDEEP:6144:ZtC0Z5JA0/8cyMn9qWM53pLW1Acr8sJMIsgVFe:DbJAy86a9diFe
                                                                MD5:AD4324E5CC794D626FFCCDA544A5A833
                                                                SHA1:EF925E000383B6CAD9361430FC38264540D434A5
                                                                SHA-256:040F361F63204B55C17A100C260C7DDFADD00866CC055FBD641B83A6747547D5
                                                                SHA-512:0A002B79418242112600B9246DA66A5C04651AECB2E245F0220B2544D7B7DF67A20139F45DDF2D4E7759CE8CC3D6B4BE7F98B0A221C756449EB1B6D7AF602325
                                                                Malicious:false
                                                                Antivirus:
                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                Reputation:low
                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\lUT..;...;...;..u....;...:...;...8...;...?...;...>...;...:...;.j.:...;...:...;...8...;...6...;...;...;.......;...9...;.Rich..;.........................PE..d....WOg.........." ...*.....\...............................................P......\V....`.................................................\........0...........+.......6...@..........T...............................@............... ............................text............................... ..`.rdata..l...........................@..@.data...8'......."..................@....pdata...+.......,..................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................

                                                                C:\Users\user\AppData\Local\Temp\_MEI32682\_hashlib.pyd

                                                                Download File
                                                                Process:C:\Users\user\Desktop\lock.exe
                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                Category:dropped
                                                                Size (bytes):65528
                                                                Entropy (8bit):6.228447315858868
                                                                Encrypted:false
                                                                SSDEEP:1536:2LDxflFwY9XDhnuVNv1dImvIqyUzR9yRfIPF:2J92ATMVNv1dImvI5qd
                                                                MD5:422E214CA76421E794B99F99A374B077
                                                                SHA1:58B24448AB889948303CDEFE28A7C697687B7EBC
                                                                SHA-256:78223AEF72777EFC93C739F5308A3FC5DE28B7D10E6975B8947552A62592772B
                                                                SHA-512:03FCCCC5A300CC029BEF06C601915FA38604D955995B127B5B121CB55FB81752A8A1EEC4B1B263BA12C51538080335DABAEF9E2B8259B4BF02AF84A680552FA0
                                                                Malicious:false
                                                                Antivirus:
                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                Reputation:low
                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N.A..............K.............................................x.........................................'.............Rich............PE..d....WOg.........." ...*.P...~.......=....................................................`.........................................p...P................................3......X....l..T............................k..@............`...............................text....N.......P.................. ..`.rdata...M...`...N...T..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..X...........................@..B........................................................................................................................................................................................................................................

                                                                C:\Users\user\AppData\Local\Temp\_MEI32682\_lzma.pyd

                                                                Download File
                                                                Process:C:\Users\user\Desktop\lock.exe
                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                Category:dropped
                                                                Size (bytes):159224
                                                                Entropy (8bit):6.86011233030861
                                                                Encrypted:false
                                                                SSDEEP:3072:kn18fe1+/ol6s/7NjQWzjUZ1/oPEznfB9mNo7r0J0q4BcFIm01zwWO:k0s0Ef0gS5YO7ICq4BcYw
                                                                MD5:66A9028EFD1BB12047DAFCE391FD6198
                                                                SHA1:E0B61CE28EA940F1F0D5247D40ABE61AE2B91293
                                                                SHA-256:E44DEA262A24DF69FD9B50B08D09AE6F8B051137CE0834640C977091A6F9FCA8
                                                                SHA-512:3C2A4E2539933CBEB1D0B3C8EF14F0563675FD53B6EF487C7A5371DFE2EE1932255F91DB598A61AAADACD8DC2FE2486A91F586542C52DFC054B22AD843831D1E
                                                                Malicious:false
                                                                Antivirus:
                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:..C~...~...~...w.?.z...o3..|...o3..}...o3..v...o3..r....3..}....4..|...~........3..D....3.......3S......3......Rich~...........PE..d....WOg.........." ...*.`...........1.......................................p............`.............................................L.......x....P.......0.......:...3...`..4....|..T...........................P{..@............p...............................text...N^.......`.................. ..`.rdata.......p.......d..............@..@.data........ ......................@....pdata.......0......................@..@.rsrc........P......................@..@.reloc..4....`.......8..............@..B................................................................................................................................................................................................................................................

                                                                C:\Users\user\AppData\Local\Temp\_MEI32682\_socket.pyd

                                                                Download File
                                                                Process:C:\Users\user\Desktop\lock.exe
                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                Category:dropped
                                                                Size (bytes):84984
                                                                Entropy (8bit):6.333897580970998
                                                                Encrypted:false
                                                                SSDEEP:1536:auV3gvWHQdMq3ORC/OypTNQlyJ+9+nzLYwsSI6tzOCu5ImywwyUzR9EtfI5gn:auVQvcQTSypTNQlyJs+nzLYaI6Qt5ImX
                                                                MD5:ABF998769F3CBA685E90FA06E0EC8326
                                                                SHA1:DAA66047CF22B6BE608127F8824E59B30C9026BF
                                                                SHA-256:62D0493CED6CA33E2FD8141649DD9889C23B2E9AFC5FDF56EDB4F888C88FB823
                                                                SHA-512:08C6B3573C596A15ACCF4936533567415198A0DAAB5B6E9824B820FD1F078233BBC3791FDE6971489E70155F7C33C1242B0B0A3A17FE2EC95B9FADAE555ED483
                                                                Malicious:false
                                                                Antivirus:
                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........c..\..}\..}\..}UzR}Z..}M..|^..}M..|_..}M..|T..}M..|Q..}..|^..}\..}...}...|U..}..|]..}..|]..}.>}]..}..|]..}Rich\..}........PE..d....WOg.........." ...*.x.......... -.......................................`............`.........................................@...P............@.......0...........3...P..........T...........................@...@............................................text....w.......x.................. ..`.rdata.. y.......z...|..............@..@.data...............................@....pdata.......0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................

                                                                C:\Users\user\AppData\Local\Temp\_MEI32682\base_library.zip

                                                                Download File
                                                                Process:C:\Users\user\Desktop\lock.exe
                                                                File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                Category:dropped
                                                                Size (bytes):1396821
                                                                Entropy (8bit):5.531015514770172
                                                                Encrypted:false
                                                                SSDEEP:12288:0W7WpzO6etYzGNcT1pz3YQfiBgDPtLwjFx278SAZQYF93BGfL+DuWFnjVpdxhYVd:l7WpzZSeT1xTYF9f5pdxhYVP05WdZ7
                                                                MD5:18C3F8BF07B4764D340DF1D612D28FAD
                                                                SHA1:FC0E09078527C13597C37DBEA39551F72BBE9AE8
                                                                SHA-256:6E30043DFA5FAF9C31BD8FB71778E8E0701275B620696D29AD274846676B7175
                                                                SHA-512:135B97CD0284424A269C964ED95B06D338814E5E7B2271B065E5EABF56A8AF4A213D863DD2A1E93C1425FADB1B20E6C63FFA6E8984156928BE4A9A2FBBFD5E93
                                                                Malicious:false
                                                                Preview:PK..........!.+.P............._collections_abc.pyc......................................\.....S.r.S.S.K.J.r.J.r. .S.S.K.r.\.".\.\.....5.......r.\.".S.5.......r.S...r.\.".\.5.......r.C./.S.Q.r.S.r.\.".\.".S.5.......5.......r.\.".\.".\.".5.......5.......5.......r.\.".\.".0.R%..................5.......5.......5.......r.\.".\.".0.R)..................5.......5.......5.......r.\.".\.".0.R-..................5.......5.......5.......r.\.".\."./.5.......5.......r.\.".\.".\."./.5.......5.......5.......r.\.".\.".\.".S.5.......5.......5.......r.\.".\.".\.".S.S.-...5.......5.......5.......r.\.".\.".\.".5.......5.......5.......r.\.".\.".S.5.......5.......r \.".\.".S.5.......5.......r!\.".\.".\"".5.......5.......5.......r#\.".0.R%..................5.......5.......r$\.".0.R)..................5.......5.......r%\.".0.R-..................5.......5.......r&\.".\.RN..................5.......r(S...r)\)".5.......r*C)\.".S...".5.......5.......r+S...r,\,".5.......r,\.".\,5.......r-\,R]..................5.......

                                                                C:\Users\user\AppData\Local\Temp\_MEI32682\libcrypto-3.dll

                                                                Download File
                                                                Process:C:\Users\user\Desktop\lock.exe
                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                Category:dropped
                                                                Size (bytes):5232408
                                                                Entropy (8bit):5.940072183736028
                                                                Encrypted:false
                                                                SSDEEP:98304:/V+Qs2NuR5YV0L8PQ1CPwDvt3uFlDC4SC9c:9rs2NuDYV0L841CPwDvt3uFlDC4SCa
                                                                MD5:123AD0908C76CCBA4789C084F7A6B8D0
                                                                SHA1:86DE58289C8200ED8C1FC51D5F00E38E32C1AAD5
                                                                SHA-256:4E5D5D20D6D31E72AB341C81E97B89E514326C4C861B48638243BDF0918CFA43
                                                                SHA-512:80FAE0533BA9A2F5FA7806E86F0DB8B6AAB32620DDE33B70A3596938B529F3822856DE75BDDB1B06721F8556EC139D784BC0BB9C8DA0D391DF2C20A80D33CB04
                                                                Malicious:false
                                                                Antivirus:
                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........._~.._~.._~..V.S.M~.....]~.....[~.....W~.....S~.._~...~......T~..J....~..J...7}..J...^~..J.?.^~..J...^~..Rich_~..........................PE..d......f.........." ...(..7..<......v........................................0P.......O...`...........................................H.0.....O.@....@O.|.... L. .....O../...PO.$...`{D.8............................yD.@.............O..............................text.....7.......7................. ..`.rdata........7.......7.............@..@.data...Ao....K..<....K.............@....pdata....... L.......K.............@..@.idata...%....O..&....N.............@..@.00cfg..u....0O.......N.............@..@.rsrc...|....@O.......N.............@..@.reloc..~....PO.......N.............@..B................................................................................................................................................

                                                                C:\Users\user\AppData\Local\Temp\_MEI32682\python313.dll

                                                                Download File
                                                                Process:C:\Users\user\Desktop\lock.exe
                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                Category:dropped
                                                                Size (bytes):6093816
                                                                Entropy (8bit):6.129208926967787
                                                                Encrypted:false
                                                                SSDEEP:98304:IDcLwZ+b7nYp4zwSL3TvGnYSBvxHDMiEZ10i:IDgt7nYpvu3TvJik0i
                                                                MD5:3AAD23292404A7038EB07CE5A6348256
                                                                SHA1:35CAC5479699B28549EBE36C1D064BFB703F0857
                                                                SHA-256:78B1DD211C0E66A0603DF48DA2C9B67A915AB3258701B9285D3FAA255ED8DC25
                                                                SHA-512:F5B6EF04E744D2C98C1EF9402D7A8CE5CDA3B008837CF2C37A8B6D0CD1B188CA46585A40B2DB7ACF019F67E6CED59EFF5BC86E1AAF48D3C3B62FECF37F3AEC6B
                                                                Malicious:false
                                                                Antivirus:
                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F.r.'.!.'.!.'.!.. .'.!.z!.'.!.. .'.!.. .'.!.. .'.!._.!.'.!... .'.!.'.!N&.!F.. -'.!F.. .'.!F.x!.'.!F.. .'.!Rich.'.!........PE..d....WOg.........." ...*.L+..f9.....`W........................................d.......]...`...........................................P.......P...... d......P].......\..3...0d.D....Q3.T.....................I.(....P3.@............`+..............................text....K+......L+................. ..`.rdata....%..`+...%..P+.............@..@.data...$:....Q..N....P.............@....pdata.......P]......@U.............@..@PyRuntim.N...._..P....W.............@....rsrc........ d.......\.............@..@.reloc..D....0d.......\.............@..B........................................................................................................................................................................................................

                                                                C:\Users\user\AppData\Local\Temp\_MEI32682\select.pyd

                                                                Download File
                                                                Process:C:\Users\user\Desktop\lock.exe
                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                Category:dropped
                                                                Size (bytes):32248
                                                                Entropy (8bit):6.547651395731859
                                                                Encrypted:false
                                                                SSDEEP:768:QCy9Hf68Z5Im9G9JyUFRYT2Ip4HCxf1mlzzTz:QCy9/68Z5Im9G3yUzR9YfIPv
                                                                MD5:62FE3761D24B53D98CC9B0CBBD0FEB7C
                                                                SHA1:317344C9EDF2FCFA2B9BC248A18F6E6ACEDAFFFB
                                                                SHA-256:81F124B01A85882E362A42E94A13C0EFF2F4CCD72D461821DC5457A789554413
                                                                SHA-512:A1D3DA17937087AF4E5980D908ED645D4EA1B5F3EBFAB5C572417DF064707CAE1372B331C7096CC8E2E041DB9315172806D3BC4BB425C6BB4D2FA55E00524881
                                                                Malicious:false
                                                                Antivirus:
                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Ks{.*.(.*.(.*.(.R.(.*.(..).*.(..).*.(..).*.(..).*.(w..).*.(.*.(.*.(...).*.(w..).*.(w..).*.(w..(.*.(w..).*.(Rich.*.(................PE..d....WOg.........." ...*.....2......................................................n.....`..........................................@..L...<A..x....p.......`.......J...3......L....3..T............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data...p....P.......8..............@....pdata.......`.......:..............@..@.rsrc........p.......>..............@..@.reloc..L............H..............@..B........................................................................................................................................................................................................................................

                                                                C:\Users\user\AppData\Local\Temp\_MEI32682\unicodedata.pyd

                                                                Download File
                                                                Process:C:\Users\user\Desktop\lock.exe
                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                Category:dropped
                                                                Size (bytes):711912
                                                                Entropy (8bit):5.867548153768221
                                                                Encrypted:false
                                                                SSDEEP:12288:LY4dLI/X77mvfldCKGihH32W3cnPSqrUgLnm:LY4W7qNxr3cnPXLnm
                                                                MD5:43B8B61DEBBC6DD93124A00DDD922D8C
                                                                SHA1:5DEE63D250AC6233AAC7E462EEE65C5326224F01
                                                                SHA-256:3F462EE6E7743A87E5791181936539642E3761C55DE3DE980A125F91FE21F123
                                                                SHA-512:DD4791045CF887E6722FEAE4442C38E641F19EC994A8EAF7667E9DF9EA84378D6D718CAF3390F92443F6BBF39840C150121BB6FA896C4BADD3F78F1FFE4DE19D
                                                                Malicious:false
                                                                Antivirus:
                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b..Q&...&...&.../fY. ...7...$...7...%...7.......7...+.......%...T...$...&...i.......'.......'.....5.'.......'...Rich&...................PE..d....WOg.........." ...*.B...f......P,....................................................`.........................................P...X................................6..........p...T...........................0...@............`..h............................text....@.......B.................. ..`.rdata...?...`...@...F..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

                                                                Static File Info

                                                                General

                                                                File type:PE32+ executable (console) x86-64, for MS Windows
                                                                Entropy (8bit):7.9899422070970205
                                                                TrID:
                                                                • Win64 Executable Console (202006/5) 92.65%
                                                                • Win64 Executable (generic) (12005/4) 5.51%
                                                                • Generic Win/DOS Executable (2004/3) 0.92%
                                                                • DOS Executable Generic (2002/1) 0.92%
                                                                • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                File name:lock.exe
                                                                File size:7'211'056 bytes
                                                                MD5:298dcbbe53e340a4a430c430ec9e3b5d
                                                                SHA1:0231acec8068d615edf6b6eb1abc3d4afb828028
                                                                SHA256:b58b7853318f6c9f0d66d1f2a8d7ff5ad42be424fdf8e04615d8c38980b3811b
                                                                SHA512:bc9772949f8ce933289ce119cff72582ecb734fc2a7c494b1c155b7d60cf162a41cb1282dd6c1409d8d73104b733dc5a3a9ceaa32440088cfe0eb2727f2b1117
                                                                SSDEEP:196608:YxT83kdaXMCHGLLc54i1wN+DrRRu7NtbFRKnZMZDYhmh1wlxN8:C/cXMCHWUj7rRQ7XbFsn6ZUEWN
                                                                TLSH:6D76338523B101F9FEB3513EC9E0ED36D664BC6527B0C68367E84B636E131D96A3D221
                                                                File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......xh.B<...<...<...wq..;...wq......wq..6...,.W.>...,...5...,...-...,.......wq..;...<.......w...%...w...=...Rich<...........PE..d..

                                                                File Icon

                                                                Icon Hash:2e1e7c4c4c61e979

                                                                Static PE Info

                                                                General

                                                                Entrypoint:0x14000c380
                                                                Entrypoint Section:.text
                                                                Digitally signed:false
                                                                Imagebase:0x140000000
                                                                Subsystem:windows cui
                                                                Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
                                                                DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
                                                                Time Stamp:0x6781636A [Fri Jan 10 18:14:02 2025 UTC]
                                                                TLS Callbacks:
                                                                CLR (.Net) Version:
                                                                OS Version Major:6
                                                                OS Version Minor:0
                                                                File Version Major:6
                                                                File Version Minor:0
                                                                Subsystem Version Major:6
                                                                Subsystem Version Minor:0
                                                                Import Hash:a06f302f71edd380da3d5bf4a6d94ebd

                                                                Entrypoint Preview

                                                                Instruction
                                                                dec eax
                                                                sub esp, 28h
                                                                call 00007FDA58C0E50Ch
                                                                dec eax
                                                                add esp, 28h
                                                                jmp 00007FDA58C0E11Fh
                                                                int3
                                                                int3
                                                                int3
                                                                int3
                                                                int3
                                                                int3
                                                                int3
                                                                int3
                                                                int3
                                                                int3
                                                                int3
                                                                int3
                                                                int3
                                                                int3
                                                                dec eax
                                                                sub esp, 28h
                                                                call 00007FDA58C0E898h
                                                                test eax, eax
                                                                je 00007FDA58C0E2D3h
                                                                dec eax
                                                                mov eax, dword ptr [00000030h]
                                                                dec eax
                                                                mov ecx, dword ptr [eax+08h]
                                                                jmp 00007FDA58C0E2B7h
                                                                dec eax
                                                                cmp ecx, eax
                                                                je 00007FDA58C0E2C6h
                                                                xor eax, eax
                                                                dec eax
                                                                cmpxchg dword ptr [000381ACh], ecx
                                                                jne 00007FDA58C0E2A0h
                                                                xor al, al
                                                                dec eax
                                                                add esp, 28h
                                                                ret
                                                                mov al, 01h
                                                                jmp 00007FDA58C0E2A9h
                                                                int3
                                                                int3
                                                                int3
                                                                dec eax
                                                                sub esp, 28h
                                                                test ecx, ecx
                                                                jne 00007FDA58C0E2B9h
                                                                mov byte ptr [00038195h], 00000001h
                                                                call 00007FDA58C0D9F5h
                                                                call 00007FDA58C0ECB0h
                                                                test al, al
                                                                jne 00007FDA58C0E2B6h
                                                                xor al, al
                                                                jmp 00007FDA58C0E2C6h
                                                                call 00007FDA58C1D1BFh
                                                                test al, al
                                                                jne 00007FDA58C0E2BBh
                                                                xor ecx, ecx
                                                                call 00007FDA58C0ECC0h
                                                                jmp 00007FDA58C0E29Ch
                                                                mov al, 01h
                                                                dec eax
                                                                add esp, 28h
                                                                ret
                                                                int3
                                                                int3
                                                                inc eax
                                                                push ebx
                                                                dec eax
                                                                sub esp, 20h
                                                                cmp byte ptr [0003815Ch], 00000000h
                                                                mov ebx, ecx
                                                                jne 00007FDA58C0E319h
                                                                cmp ecx, 01h
                                                                jnbe 00007FDA58C0E31Ch
                                                                call 00007FDA58C0E80Eh
                                                                test eax, eax
                                                                je 00007FDA58C0E2DAh
                                                                test ebx, ebx
                                                                jne 00007FDA58C0E2D6h
                                                                dec eax
                                                                lea ecx, dword ptr [00038146h]
                                                                call 00007FDA58C1CFB2h

                                                                Data Directories

                                                                NameVirtual AddressVirtual Size Is in Section
                                                                IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                IMAGE_DIRECTORY_ENTRY_IMPORT0x3e9ec0x50.rdata
                                                                IMAGE_DIRECTORY_ENTRY_RESOURCE0x490000xef8c.rsrc
                                                                IMAGE_DIRECTORY_ENTRY_EXCEPTION0x460000x22bc.pdata
                                                                IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                IMAGE_DIRECTORY_ENTRY_BASERELOC0x580000x768.reloc
                                                                IMAGE_DIRECTORY_ENTRY_DEBUG0x3bfb00x1c.rdata
                                                                IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x3be700x140.rdata
                                                                IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                IMAGE_DIRECTORY_ENTRY_IAT0x2d0000x400.rdata
                                                                IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                Sections

                                                                NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                .text0x10000x2b1700x2b200420661550c659f884db561712e500aaeFalse0.5455615942028985data6.498595774489571IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                .rdata0x2d0000x128020x12a00c9f94e25f69b90443986225347c44292False0.5229393875838926data5.768400103245174IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                .data0x400000x54080xe00aff56347f897785154c53727472c548dFalse0.13504464285714285data1.8315705466577277IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                .pdata0x460000x22bc0x24002411a276649fc67a0a93227155911735False0.4740668402777778data5.334571311334213IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                .rsrc0x490000xef8c0xf0005d72e0338b034862f777c781ab7d2219False0.8010091145833333data7.3501462320035476IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                .reloc0x580000x7680x80042d6242177dbae8e11ed5d64b87d0d48False0.5576171875data5.268722219019965IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                Resources

                                                                NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                RT_ICON0x492080xea8Device independent bitmap graphic, 48 x 96 x 8, image size 00.56636460554371
                                                                RT_ICON0x4a0b00x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 00.7287906137184116
                                                                RT_ICON0x4a9580x568Device independent bitmap graphic, 16 x 32 x 8, image size 00.7471098265895953
                                                                RT_ICON0x4aec00x909bPNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced0.9971636186822983
                                                                RT_ICON0x53f5c0x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 00.38309128630705397
                                                                RT_ICON0x565040x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 00.4826454033771107
                                                                RT_ICON0x575ac0x468Device independent bitmap graphic, 16 x 32 x 32, image size 00.699468085106383
                                                                RT_GROUP_ICON0x57a140x68data0.7019230769230769
                                                                RT_MANIFEST0x57a7c0x50dXML 1.0 document, ASCII text0.4694508894044857

                                                                Imports

                                                                DLLImport
                                                                USER32.dllTranslateMessage, ShutdownBlockReasonCreate, GetWindowThreadProcessId, SetWindowLongPtrW, GetWindowLongPtrW, MsgWaitForMultipleObjects, ShowWindow, DestroyWindow, CreateWindowExW, RegisterClassW, DefWindowProcW, PeekMessageW, DispatchMessageW, GetMessageW
                                                                KERNEL32.dllGetTimeZoneInformation, GetProcessHeap, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCPInfo, GetOEMCP, GetACP, IsValidCodePage, GetStringTypeW, FormatMessageW, GetLastError, GetModuleFileNameW, LoadLibraryExW, SetDllDirectoryW, CreateSymbolicLinkW, GetProcAddress, CreateDirectoryW, GetCommandLineW, GetEnvironmentVariableW, ExpandEnvironmentStringsW, DeleteFileW, FindClose, FindFirstFileW, FindNextFileW, HeapSize, RemoveDirectoryW, GetTempPathW, CloseHandle, QueryPerformanceCounter, QueryPerformanceFrequency, WaitForSingleObject, Sleep, GetCurrentProcess, GetCurrentProcessId, TerminateProcess, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LocalFree, SetConsoleCtrlHandler, GetConsoleWindow, K32EnumProcessModules, K32GetModuleFileNameExW, CreateFileW, FindFirstFileExW, GetFinalPathNameByHandleW, MultiByteToWideChar, WideCharToMultiByte, GetFileAttributesExW, HeapReAlloc, WriteConsoleW, SetEndOfFile, GetDriveTypeW, IsDebuggerPresent, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsProcessorFeaturePresent, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, GetModuleHandleW, RtlUnwindEx, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, ReadFile, GetFullPathNameW, SetStdHandle, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, GetCommandLineA, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, CompareStringW, LCMapStringW, GetCurrentDirectoryW, FlushFileBuffers, SetEnvironmentVariableW
                                                                ADVAPI32.dllConvertSidToStringSidW, GetTokenInformation, OpenProcessToken, ConvertStringSecurityDescriptorToSecurityDescriptorW

                                                                Network Behavior

                                                                DNS Answers

                                                                TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                Jan 10, 2025 20:03:49.476397038 CET1.1.1.1192.168.2.60xdd9bNo error (0)g-bing-com.ax-0001.ax-msedge.netax-0001.ax-msedge.netCNAME (Canonical name)IN (0x0001)false
                                                                Jan 10, 2025 20:03:49.476397038 CET1.1.1.1192.168.2.60xdd9bNo error (0)ax-0001.ax-msedge.net150.171.27.10A (IP address)IN (0x0001)false
                                                                Jan 10, 2025 20:03:49.476397038 CET1.1.1.1192.168.2.60xdd9bNo error (0)ax-0001.ax-msedge.net150.171.28.10A (IP address)IN (0x0001)false

                                                                Statistics

                                                                CPU Usage

                                                                Click to jump to process

                                                                Memory Usage

                                                                Click to jump to process

                                                                Behavior

                                                                Click to jump to process

                                                                System Behavior

                                                                General

                                                                Target ID:0
                                                                Start time:14:02:48
                                                                Start date:10/01/2025
                                                                Path:C:\Users\user\Desktop\lock.exe
                                                                Wow64 process (32bit):false
                                                                Commandline:"C:\Users\user\Desktop\lock.exe"
                                                                Imagebase:0x7ff693140000
                                                                File size:7'211'056 bytes
                                                                MD5 hash:298DCBBE53E340A4A430C430EC9E3B5D
                                                                Has elevated privileges:true
                                                                Has administrator privileges:true
                                                                Programmed in:C, C++ or other language
                                                                Reputation:low
                                                                Has exited:false

                                                                General

                                                                Target ID:2
                                                                Start time:14:02:48
                                                                Start date:10/01/2025
                                                                Path:C:\Windows\System32\conhost.exe
                                                                Wow64 process (32bit):false
                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                Imagebase:0x7ff66e660000
                                                                File size:862'208 bytes
                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                Has elevated privileges:true
                                                                Has administrator privileges:true
                                                                Programmed in:C, C++ or other language
                                                                Reputation:high
                                                                Has exited:false

                                                                General

                                                                Target ID:3
                                                                Start time:14:02:50
                                                                Start date:10/01/2025
                                                                Path:C:\Users\user\Desktop\lock.exe
                                                                Wow64 process (32bit):false
                                                                Commandline:"C:\Users\user\Desktop\lock.exe"
                                                                Imagebase:0x7ff693140000
                                                                File size:7'211'056 bytes
                                                                MD5 hash:298DCBBE53E340A4A430C430EC9E3B5D
                                                                Has elevated privileges:true
                                                                Has administrator privileges:true
                                                                Programmed in:C, C++ or other language
                                                                Reputation:low
                                                                Has exited:false

                                                                Disassembly

                                                                Reset < >

                                                                  Execution Graph

                                                                  Execution Coverage:8.4%
                                                                  Dynamic/Decrypted Code Coverage:0%
                                                                  Signature Coverage:16.1%
                                                                  Total number of Nodes:2000
                                                                  Total number of Limit Nodes:32
                                                                  execution_graph 21270 7ff69316bfd9 21273 7ff6931562e8 LeaveCriticalSection 21270->21273 20450 7ff6931565e4 20451 7ff69315661b 20450->20451 20452 7ff6931565fe 20450->20452 20451->20452 20454 7ff69315662e CreateFileW 20451->20454 20453 7ff693155e28 _fread_nolock 11 API calls 20452->20453 20455 7ff693156603 20453->20455 20456 7ff693156698 20454->20456 20457 7ff693156662 20454->20457 20459 7ff693155e48 _get_daylight 11 API calls 20455->20459 20501 7ff693156bc0 20456->20501 20475 7ff693156738 GetFileType 20457->20475 20462 7ff69315660b 20459->20462 20468 7ff69315b824 _invalid_parameter_noinfo 37 API calls 20462->20468 20464 7ff69315668d CloseHandle 20469 7ff693156616 20464->20469 20465 7ff693156677 CloseHandle 20465->20469 20466 7ff6931566cc 20522 7ff693156980 20466->20522 20467 7ff6931566a1 20470 7ff693155dbc _fread_nolock 11 API calls 20467->20470 20468->20469 20474 7ff6931566ab 20470->20474 20474->20469 20476 7ff693156786 20475->20476 20477 7ff693156843 20475->20477 20480 7ff6931567b2 GetFileInformationByHandle 20476->20480 20485 7ff693156abc 21 API calls 20476->20485 20478 7ff69315684b 20477->20478 20479 7ff69315686d 20477->20479 20481 7ff69315685e GetLastError 20478->20481 20482 7ff69315684f 20478->20482 20484 7ff693156890 PeekNamedPipe 20479->20484 20500 7ff69315682e 20479->20500 20480->20481 20483 7ff6931567db 20480->20483 20488 7ff693155dbc _fread_nolock 11 API calls 20481->20488 20486 7ff693155e48 _get_daylight 11 API calls 20482->20486 20487 7ff693156980 51 API calls 20483->20487 20484->20500 20489 7ff6931567a0 20485->20489 20486->20500 20490 7ff6931567e6 20487->20490 20488->20500 20489->20480 20489->20500 20539 7ff6931568e0 20490->20539 20491 7ff69314bb10 _log10_special 8 API calls 20493 7ff693156670 20491->20493 20493->20464 20493->20465 20495 7ff6931568e0 10 API calls 20496 7ff693156805 20495->20496 20497 7ff6931568e0 10 API calls 20496->20497 20498 7ff693156816 20497->20498 20499 7ff693155e48 _get_daylight 11 API calls 20498->20499 20498->20500 20499->20500 20500->20491 20502 7ff693156bf6 20501->20502 20503 7ff693155e48 _get_daylight 11 API calls 20502->20503 20521 7ff693156c8e __vcrt_freefls 20502->20521 20505 7ff693156c08 20503->20505 20504 7ff69314bb10 _log10_special 8 API calls 20506 7ff69315669d 20504->20506 20507 7ff693155e48 _get_daylight 11 API calls 20505->20507 20506->20466 20506->20467 20508 7ff693156c10 20507->20508 20509 7ff693158d44 45 API calls 20508->20509 20510 7ff693156c25 20509->20510 20511 7ff693156c2d 20510->20511 20512 7ff693156c37 20510->20512 20513 7ff693155e48 _get_daylight 11 API calls 20511->20513 20514 7ff693155e48 _get_daylight 11 API calls 20512->20514 20519 7ff693156c32 20513->20519 20515 7ff693156c3c 20514->20515 20516 7ff693155e48 _get_daylight 11 API calls 20515->20516 20515->20521 20517 7ff693156c46 20516->20517 20518 7ff693158d44 45 API calls 20517->20518 20518->20519 20520 7ff693156c80 GetDriveTypeW 20519->20520 20519->20521 20520->20521 20521->20504 20524 7ff6931569a8 20522->20524 20523 7ff6931566d9 20532 7ff693156abc 20523->20532 20524->20523 20546 7ff693160994 20524->20546 20526 7ff693156a3c 20526->20523 20527 7ff693160994 51 API calls 20526->20527 20528 7ff693156a4f 20527->20528 20528->20523 20529 7ff693160994 51 API calls 20528->20529 20530 7ff693156a62 20529->20530 20530->20523 20531 7ff693160994 51 API calls 20530->20531 20531->20523 20533 7ff693156ad6 20532->20533 20534 7ff693156b0d 20533->20534 20536 7ff693156ae6 20533->20536 20535 7ff693160828 21 API calls 20534->20535 20537 7ff693156af6 20535->20537 20536->20537 20538 7ff693155dbc _fread_nolock 11 API calls 20536->20538 20537->20474 20538->20537 20540 7ff6931568fc 20539->20540 20541 7ff693156909 FileTimeToSystemTime 20539->20541 20540->20541 20543 7ff693156904 20540->20543 20542 7ff69315691d SystemTimeToTzSpecificLocalTime 20541->20542 20541->20543 20542->20543 20544 7ff69314bb10 _log10_special 8 API calls 20543->20544 20545 7ff6931567f5 20544->20545 20545->20495 20547 7ff6931609c5 20546->20547 20548 7ff6931609a1 20546->20548 20551 7ff6931609ff 20547->20551 20552 7ff693160a1e 20547->20552 20548->20547 20549 7ff6931609a6 20548->20549 20550 7ff693155e48 _get_daylight 11 API calls 20549->20550 20553 7ff6931609ab 20550->20553 20554 7ff693155e48 _get_daylight 11 API calls 20551->20554 20556 7ff693155e8c 45 API calls 20552->20556 20557 7ff69315b824 _invalid_parameter_noinfo 37 API calls 20553->20557 20555 7ff693160a04 20554->20555 20558 7ff69315b824 _invalid_parameter_noinfo 37 API calls 20555->20558 20562 7ff693160a2b 20556->20562 20559 7ff6931609b6 20557->20559 20561 7ff693160a0f 20558->20561 20559->20526 20560 7ff69316174c 51 API calls 20560->20562 20561->20526 20562->20560 20562->20561 20614 7ff69316c06e 20615 7ff69316c07d 20614->20615 20616 7ff69316c087 20614->20616 20618 7ff6931615a8 LeaveCriticalSection 20615->20618 19875 7ff693161b38 19876 7ff693161b5c 19875->19876 19879 7ff693161b6c 19875->19879 19877 7ff693155e48 _get_daylight 11 API calls 19876->19877 19900 7ff693161b61 19877->19900 19878 7ff693161e4c 19881 7ff693155e48 _get_daylight 11 API calls 19878->19881 19879->19878 19880 7ff693161b8e 19879->19880 19882 7ff693161baf 19880->19882 20006 7ff6931621f4 19880->20006 19883 7ff693161e51 19881->19883 19886 7ff693161c21 19882->19886 19888 7ff693161bd5 19882->19888 19892 7ff693161c15 19882->19892 19884 7ff69315b464 __free_lconv_mon 11 API calls 19883->19884 19884->19900 19890 7ff69315fe04 _get_daylight 11 API calls 19886->19890 19904 7ff693161be4 19886->19904 19887 7ff693161cce 19899 7ff693161ceb 19887->19899 19905 7ff693161d3d 19887->19905 20021 7ff69315a5fc 19888->20021 19893 7ff693161c37 19890->19893 19892->19887 19892->19904 20027 7ff69316839c 19892->20027 19896 7ff69315b464 __free_lconv_mon 11 API calls 19893->19896 19895 7ff69315b464 __free_lconv_mon 11 API calls 19895->19900 19901 7ff693161c45 19896->19901 19897 7ff693161bfd 19897->19892 19907 7ff6931621f4 45 API calls 19897->19907 19898 7ff693161bdf 19902 7ff693155e48 _get_daylight 11 API calls 19898->19902 19903 7ff69315b464 __free_lconv_mon 11 API calls 19899->19903 19901->19892 19901->19904 19909 7ff69315fe04 _get_daylight 11 API calls 19901->19909 19902->19904 19906 7ff693161cf4 19903->19906 19904->19895 19905->19904 19908 7ff69316464c 40 API calls 19905->19908 19915 7ff693161cf9 19906->19915 20063 7ff69316464c 19906->20063 19907->19892 19910 7ff693161d7a 19908->19910 19912 7ff693161c67 19909->19912 19913 7ff69315b464 __free_lconv_mon 11 API calls 19910->19913 19917 7ff69315b464 __free_lconv_mon 11 API calls 19912->19917 19918 7ff693161d84 19913->19918 19914 7ff693161d25 19919 7ff69315b464 __free_lconv_mon 11 API calls 19914->19919 19916 7ff693161e40 19915->19916 19921 7ff69315fe04 _get_daylight 11 API calls 19915->19921 19920 7ff69315b464 __free_lconv_mon 11 API calls 19916->19920 19917->19892 19918->19904 19918->19915 19919->19915 19920->19900 19922 7ff693161dc8 19921->19922 19923 7ff693161dd9 19922->19923 19924 7ff693161dd0 19922->19924 19926 7ff69315b3ac __std_exception_copy 37 API calls 19923->19926 19925 7ff69315b464 __free_lconv_mon 11 API calls 19924->19925 19927 7ff693161dd7 19925->19927 19928 7ff693161de8 19926->19928 19932 7ff69315b464 __free_lconv_mon 11 API calls 19927->19932 19929 7ff693161e7b 19928->19929 19930 7ff693161df0 19928->19930 19931 7ff69315b844 _isindst 17 API calls 19929->19931 20072 7ff6931684b4 19930->20072 19934 7ff693161e8f 19931->19934 19932->19900 19938 7ff693161eb8 19934->19938 19945 7ff693161ec8 19934->19945 19936 7ff693161e17 19939 7ff693155e48 _get_daylight 11 API calls 19936->19939 19937 7ff693161e38 19941 7ff69315b464 __free_lconv_mon 11 API calls 19937->19941 19940 7ff693155e48 _get_daylight 11 API calls 19938->19940 19942 7ff693161e1c 19939->19942 19968 7ff693161ebd 19940->19968 19941->19916 19943 7ff69315b464 __free_lconv_mon 11 API calls 19942->19943 19943->19927 19944 7ff6931621ab 19947 7ff693155e48 _get_daylight 11 API calls 19944->19947 19945->19944 19946 7ff693161eea 19945->19946 19948 7ff693161f07 19946->19948 20091 7ff6931622dc 19946->20091 19949 7ff6931621b0 19947->19949 19952 7ff693161f7b 19948->19952 19954 7ff693161f2f 19948->19954 19958 7ff693161f6f 19948->19958 19950 7ff69315b464 __free_lconv_mon 11 API calls 19949->19950 19950->19968 19956 7ff693161fa3 19952->19956 19959 7ff69315fe04 _get_daylight 11 API calls 19952->19959 19974 7ff693161f3e 19952->19974 19953 7ff69316202e 19967 7ff69316204b 19953->19967 19975 7ff69316209e 19953->19975 20106 7ff69315a638 19954->20106 19956->19958 19961 7ff69315fe04 _get_daylight 11 API calls 19956->19961 19956->19974 19958->19953 19958->19974 20112 7ff69316825c 19958->20112 19963 7ff693161f95 19959->19963 19966 7ff693161fc5 19961->19966 19962 7ff69315b464 __free_lconv_mon 11 API calls 19962->19968 19969 7ff69315b464 __free_lconv_mon 11 API calls 19963->19969 19964 7ff693161f57 19964->19958 19973 7ff6931622dc 45 API calls 19964->19973 19965 7ff693161f39 19970 7ff693155e48 _get_daylight 11 API calls 19965->19970 19971 7ff69315b464 __free_lconv_mon 11 API calls 19966->19971 19972 7ff69315b464 __free_lconv_mon 11 API calls 19967->19972 19969->19956 19970->19974 19971->19958 19976 7ff693162054 19972->19976 19973->19958 19974->19962 19975->19974 19977 7ff69316464c 40 API calls 19975->19977 19979 7ff69316464c 40 API calls 19976->19979 19982 7ff69316205a 19976->19982 19978 7ff6931620dc 19977->19978 19980 7ff69315b464 __free_lconv_mon 11 API calls 19978->19980 19984 7ff693162086 19979->19984 19981 7ff6931620e6 19980->19981 19981->19974 19981->19982 19983 7ff69316219f 19982->19983 19987 7ff69315fe04 _get_daylight 11 API calls 19982->19987 19986 7ff69315b464 __free_lconv_mon 11 API calls 19983->19986 19985 7ff69315b464 __free_lconv_mon 11 API calls 19984->19985 19985->19982 19986->19968 19988 7ff69316212b 19987->19988 19989 7ff69316213c 19988->19989 19990 7ff693162133 19988->19990 19992 7ff6931616e4 37 API calls 19989->19992 19991 7ff69315b464 __free_lconv_mon 11 API calls 19990->19991 20005 7ff69316213a 19991->20005 19993 7ff69316214a 19992->19993 19994 7ff693162152 SetEnvironmentVariableW 19993->19994 19995 7ff6931621df 19993->19995 19996 7ff693162197 19994->19996 19997 7ff693162176 19994->19997 19998 7ff69315b844 _isindst 17 API calls 19995->19998 20002 7ff69315b464 __free_lconv_mon 11 API calls 19996->20002 20000 7ff693155e48 _get_daylight 11 API calls 19997->20000 20001 7ff6931621f3 19998->20001 19999 7ff69315b464 __free_lconv_mon 11 API calls 19999->19968 20003 7ff69316217b 20000->20003 20002->19983 20004 7ff69315b464 __free_lconv_mon 11 API calls 20003->20004 20004->20005 20005->19999 20007 7ff693162211 20006->20007 20008 7ff693162229 20006->20008 20007->19882 20008->20008 20009 7ff69315fe04 _get_daylight 11 API calls 20008->20009 20016 7ff69316224d 20009->20016 20010 7ff6931622d2 20012 7ff69315b40c _CreateFrameInfo 45 API calls 20010->20012 20011 7ff6931622ae 20013 7ff69315b464 __free_lconv_mon 11 API calls 20011->20013 20014 7ff6931622d8 20012->20014 20013->20007 20015 7ff69315fe04 _get_daylight 11 API calls 20015->20016 20016->20010 20016->20011 20016->20015 20017 7ff69315b464 __free_lconv_mon 11 API calls 20016->20017 20018 7ff69315b3ac __std_exception_copy 37 API calls 20016->20018 20019 7ff6931622bd 20016->20019 20017->20016 20018->20016 20020 7ff69315b844 _isindst 17 API calls 20019->20020 20020->20010 20022 7ff69315a60c 20021->20022 20023 7ff69315a615 20021->20023 20022->20023 20136 7ff69315a0d4 20022->20136 20023->19897 20023->19898 20028 7ff6931683a9 20027->20028 20029 7ff6931674c4 20027->20029 20031 7ff693155e8c 45 API calls 20028->20031 20030 7ff6931674d1 20029->20030 20036 7ff693167507 20029->20036 20034 7ff693155e48 _get_daylight 11 API calls 20030->20034 20049 7ff693167478 20030->20049 20033 7ff6931683dd 20031->20033 20032 7ff693167531 20035 7ff693155e48 _get_daylight 11 API calls 20032->20035 20041 7ff6931683f3 20033->20041 20044 7ff69316840a 20033->20044 20055 7ff6931683e2 20033->20055 20037 7ff6931674db 20034->20037 20039 7ff693167536 20035->20039 20036->20032 20040 7ff693167556 20036->20040 20038 7ff69315b824 _invalid_parameter_noinfo 37 API calls 20037->20038 20042 7ff6931674e6 20038->20042 20043 7ff69315b824 _invalid_parameter_noinfo 37 API calls 20039->20043 20050 7ff693155e8c 45 API calls 20040->20050 20061 7ff693167541 20040->20061 20045 7ff693155e48 _get_daylight 11 API calls 20041->20045 20042->19892 20043->20061 20047 7ff693168426 20044->20047 20048 7ff693168414 20044->20048 20046 7ff6931683f8 20045->20046 20051 7ff69315b824 _invalid_parameter_noinfo 37 API calls 20046->20051 20053 7ff693168437 20047->20053 20054 7ff69316844e 20047->20054 20052 7ff693155e48 _get_daylight 11 API calls 20048->20052 20049->19892 20050->20061 20051->20055 20056 7ff693168419 20052->20056 20353 7ff693167514 20053->20353 20362 7ff69316a1bc 20054->20362 20055->19892 20059 7ff69315b824 _invalid_parameter_noinfo 37 API calls 20056->20059 20059->20055 20061->19892 20062 7ff693155e48 _get_daylight 11 API calls 20062->20055 20064 7ff69316468b 20063->20064 20065 7ff69316466e 20063->20065 20066 7ff693164695 20064->20066 20402 7ff693168ea8 20064->20402 20065->20064 20067 7ff69316467c 20065->20067 20409 7ff693168ee4 20066->20409 20069 7ff693155e48 _get_daylight 11 API calls 20067->20069 20071 7ff693164681 memcpy_s 20069->20071 20071->19914 20073 7ff693155e8c 45 API calls 20072->20073 20074 7ff69316851a 20073->20074 20076 7ff693168528 20074->20076 20421 7ff693160190 20074->20421 20424 7ff693156468 20076->20424 20079 7ff693168614 20081 7ff693168625 20079->20081 20084 7ff69315b464 __free_lconv_mon 11 API calls 20079->20084 20080 7ff693155e8c 45 API calls 20083 7ff693168597 20080->20083 20082 7ff693161e13 20081->20082 20085 7ff69315b464 __free_lconv_mon 11 API calls 20081->20085 20082->19936 20082->19937 20086 7ff693160190 5 API calls 20083->20086 20087 7ff6931685a0 20083->20087 20084->20081 20085->20082 20086->20087 20088 7ff693156468 14 API calls 20087->20088 20089 7ff6931685fb 20088->20089 20089->20079 20090 7ff693168603 SetEnvironmentVariableW 20089->20090 20090->20079 20092 7ff69316231c 20091->20092 20093 7ff6931622ff 20091->20093 20094 7ff69315fe04 _get_daylight 11 API calls 20092->20094 20093->19948 20100 7ff693162340 20094->20100 20095 7ff69315b40c _CreateFrameInfo 45 API calls 20097 7ff6931623ca 20095->20097 20096 7ff6931623a1 20098 7ff69315b464 __free_lconv_mon 11 API calls 20096->20098 20098->20093 20099 7ff69315fe04 _get_daylight 11 API calls 20099->20100 20100->20096 20100->20099 20101 7ff69315b464 __free_lconv_mon 11 API calls 20100->20101 20102 7ff6931616e4 37 API calls 20100->20102 20103 7ff6931623b0 20100->20103 20105 7ff6931623c4 20100->20105 20101->20100 20102->20100 20104 7ff69315b844 _isindst 17 API calls 20103->20104 20104->20105 20105->20095 20107 7ff69315a648 20106->20107 20108 7ff69315a651 20106->20108 20107->20108 20109 7ff69315a148 40 API calls 20107->20109 20108->19964 20108->19965 20110 7ff69315a65a 20109->20110 20110->20108 20111 7ff69315a508 12 API calls 20110->20111 20111->20108 20113 7ff693168269 20112->20113 20114 7ff693168296 20112->20114 20113->20114 20115 7ff69316826e 20113->20115 20118 7ff6931682da 20114->20118 20120 7ff6931682f9 20114->20120 20134 7ff6931682ce __crtLCMapStringW 20114->20134 20116 7ff693155e48 _get_daylight 11 API calls 20115->20116 20117 7ff693168273 20116->20117 20119 7ff69315b824 _invalid_parameter_noinfo 37 API calls 20117->20119 20121 7ff693155e48 _get_daylight 11 API calls 20118->20121 20122 7ff69316827e 20119->20122 20123 7ff693168315 20120->20123 20124 7ff693168303 20120->20124 20125 7ff6931682df 20121->20125 20122->19958 20128 7ff693155e8c 45 API calls 20123->20128 20127 7ff693155e48 _get_daylight 11 API calls 20124->20127 20126 7ff69315b824 _invalid_parameter_noinfo 37 API calls 20125->20126 20126->20134 20129 7ff693168308 20127->20129 20130 7ff693168322 20128->20130 20131 7ff69315b824 _invalid_parameter_noinfo 37 API calls 20129->20131 20130->20134 20446 7ff693169d78 20130->20446 20131->20134 20134->19958 20135 7ff693155e48 _get_daylight 11 API calls 20135->20134 20137 7ff69315a0ed 20136->20137 20138 7ff69315a0e9 20136->20138 20159 7ff693163860 20137->20159 20138->20023 20151 7ff69315a428 20138->20151 20143 7ff69315a10b 20185 7ff69315a1b8 20143->20185 20144 7ff69315a0ff 20145 7ff69315b464 __free_lconv_mon 11 API calls 20144->20145 20145->20138 20148 7ff69315b464 __free_lconv_mon 11 API calls 20149 7ff69315a132 20148->20149 20150 7ff69315b464 __free_lconv_mon 11 API calls 20149->20150 20150->20138 20152 7ff69315a451 20151->20152 20157 7ff69315a46a 20151->20157 20152->20023 20153 7ff69315fe04 _get_daylight 11 API calls 20153->20157 20154 7ff69315a4fa 20156 7ff69315b464 __free_lconv_mon 11 API calls 20154->20156 20155 7ff693161a58 WideCharToMultiByte 20155->20157 20156->20152 20157->20152 20157->20153 20157->20154 20157->20155 20158 7ff69315b464 __free_lconv_mon 11 API calls 20157->20158 20158->20157 20160 7ff69316386d 20159->20160 20164 7ff69315a0f2 20159->20164 20204 7ff69315c124 20160->20204 20165 7ff693163b9c GetEnvironmentStringsW 20164->20165 20166 7ff693163bcc 20165->20166 20167 7ff69315a0f7 20165->20167 20168 7ff693161a58 WideCharToMultiByte 20166->20168 20167->20143 20167->20144 20169 7ff693163c1d 20168->20169 20170 7ff693163c24 FreeEnvironmentStringsW 20169->20170 20171 7ff69315e6c4 _fread_nolock 12 API calls 20169->20171 20170->20167 20172 7ff693163c37 20171->20172 20173 7ff693163c48 20172->20173 20174 7ff693163c3f 20172->20174 20176 7ff693161a58 WideCharToMultiByte 20173->20176 20175 7ff69315b464 __free_lconv_mon 11 API calls 20174->20175 20177 7ff693163c46 20175->20177 20178 7ff693163c6b 20176->20178 20177->20170 20179 7ff693163c79 20178->20179 20180 7ff693163c6f 20178->20180 20182 7ff69315b464 __free_lconv_mon 11 API calls 20179->20182 20181 7ff69315b464 __free_lconv_mon 11 API calls 20180->20181 20183 7ff693163c77 FreeEnvironmentStringsW 20181->20183 20182->20183 20183->20167 20187 7ff69315a1dd 20185->20187 20186 7ff69315fe04 _get_daylight 11 API calls 20198 7ff69315a213 20186->20198 20187->20186 20188 7ff69315a21b 20189 7ff69315b464 __free_lconv_mon 11 API calls 20188->20189 20190 7ff69315a113 20189->20190 20190->20148 20191 7ff69315a28e 20192 7ff69315b464 __free_lconv_mon 11 API calls 20191->20192 20192->20190 20193 7ff69315fe04 _get_daylight 11 API calls 20193->20198 20194 7ff69315a27d 20195 7ff69315a3e4 11 API calls 20194->20195 20197 7ff69315a285 20195->20197 20196 7ff69315b3ac __std_exception_copy 37 API calls 20196->20198 20200 7ff69315b464 __free_lconv_mon 11 API calls 20197->20200 20198->20188 20198->20191 20198->20193 20198->20194 20198->20196 20199 7ff69315a2b3 20198->20199 20201 7ff69315b464 __free_lconv_mon 11 API calls 20198->20201 20202 7ff69315b844 _isindst 17 API calls 20199->20202 20200->20188 20201->20198 20203 7ff69315a2c6 20202->20203 20205 7ff69315c135 FlsGetValue 20204->20205 20206 7ff69315c150 FlsSetValue 20204->20206 20208 7ff69315c142 20205->20208 20209 7ff69315c14a 20205->20209 20207 7ff69315c15d 20206->20207 20206->20208 20211 7ff69315fe04 _get_daylight 11 API calls 20207->20211 20210 7ff69315b40c _CreateFrameInfo 45 API calls 20208->20210 20212 7ff69315c148 20208->20212 20209->20206 20213 7ff69315c1c5 20210->20213 20214 7ff69315c16c 20211->20214 20224 7ff693163534 20212->20224 20215 7ff69315c18a FlsSetValue 20214->20215 20216 7ff69315c17a FlsSetValue 20214->20216 20218 7ff69315c196 FlsSetValue 20215->20218 20219 7ff69315c1a8 20215->20219 20217 7ff69315c183 20216->20217 20220 7ff69315b464 __free_lconv_mon 11 API calls 20217->20220 20218->20217 20221 7ff69315bdfc _get_daylight 11 API calls 20219->20221 20220->20208 20222 7ff69315c1b0 20221->20222 20223 7ff69315b464 __free_lconv_mon 11 API calls 20222->20223 20223->20212 20247 7ff6931637a4 20224->20247 20226 7ff693163569 20262 7ff693163234 20226->20262 20229 7ff693163586 20229->20164 20230 7ff69315e6c4 _fread_nolock 12 API calls 20231 7ff693163597 20230->20231 20232 7ff69316359f 20231->20232 20234 7ff6931635ae 20231->20234 20233 7ff69315b464 __free_lconv_mon 11 API calls 20232->20233 20233->20229 20234->20234 20269 7ff6931638dc 20234->20269 20237 7ff6931636aa 20238 7ff693155e48 _get_daylight 11 API calls 20237->20238 20240 7ff6931636af 20238->20240 20239 7ff693163705 20242 7ff69316376c 20239->20242 20280 7ff693163064 20239->20280 20243 7ff69315b464 __free_lconv_mon 11 API calls 20240->20243 20241 7ff6931636c4 20241->20239 20244 7ff69315b464 __free_lconv_mon 11 API calls 20241->20244 20246 7ff69315b464 __free_lconv_mon 11 API calls 20242->20246 20243->20229 20244->20239 20246->20229 20248 7ff6931637c7 20247->20248 20249 7ff6931637d1 20248->20249 20295 7ff693161548 EnterCriticalSection 20248->20295 20251 7ff693163843 20249->20251 20253 7ff69315b40c _CreateFrameInfo 45 API calls 20249->20253 20251->20226 20255 7ff69316385b 20253->20255 20257 7ff6931638b2 20255->20257 20259 7ff69315c124 50 API calls 20255->20259 20257->20226 20260 7ff69316389c 20259->20260 20261 7ff693163534 65 API calls 20260->20261 20261->20257 20263 7ff693155e8c 45 API calls 20262->20263 20264 7ff693163248 20263->20264 20265 7ff693163266 20264->20265 20266 7ff693163254 GetOEMCP 20264->20266 20267 7ff69316326b GetACP 20265->20267 20268 7ff69316327b 20265->20268 20266->20268 20267->20268 20268->20229 20268->20230 20270 7ff693163234 47 API calls 20269->20270 20271 7ff693163909 20270->20271 20272 7ff693163a5f 20271->20272 20274 7ff693163946 IsValidCodePage 20271->20274 20279 7ff693163960 memcpy_s 20271->20279 20273 7ff69314bb10 _log10_special 8 API calls 20272->20273 20275 7ff6931636a1 20273->20275 20274->20272 20276 7ff693163957 20274->20276 20275->20237 20275->20241 20277 7ff693163986 GetCPInfo 20276->20277 20276->20279 20277->20272 20277->20279 20296 7ff69316334c 20279->20296 20352 7ff693161548 EnterCriticalSection 20280->20352 20297 7ff693163389 GetCPInfo 20296->20297 20306 7ff69316347f 20296->20306 20302 7ff69316339c 20297->20302 20297->20306 20298 7ff69314bb10 _log10_special 8 API calls 20300 7ff69316351e 20298->20300 20299 7ff6931640b0 48 API calls 20301 7ff693163413 20299->20301 20300->20272 20307 7ff693168df4 20301->20307 20302->20299 20305 7ff693168df4 54 API calls 20305->20306 20306->20298 20308 7ff693155e8c 45 API calls 20307->20308 20309 7ff693168e19 20308->20309 20312 7ff693168ac0 20309->20312 20313 7ff693168b01 20312->20313 20314 7ff693160b10 _fread_nolock MultiByteToWideChar 20313->20314 20317 7ff693168b4b 20314->20317 20315 7ff693168dc9 20316 7ff69314bb10 _log10_special 8 API calls 20315->20316 20318 7ff693163446 20316->20318 20317->20315 20319 7ff69315e6c4 _fread_nolock 12 API calls 20317->20319 20321 7ff693168b83 20317->20321 20333 7ff693168c81 20317->20333 20318->20305 20319->20321 20320 7ff69315b464 __free_lconv_mon 11 API calls 20320->20315 20322 7ff693160b10 _fread_nolock MultiByteToWideChar 20321->20322 20321->20333 20323 7ff693168bf6 20322->20323 20323->20333 20343 7ff693160350 20323->20343 20326 7ff693168c92 20328 7ff69315e6c4 _fread_nolock 12 API calls 20326->20328 20330 7ff693168d64 20326->20330 20332 7ff693168cb0 20326->20332 20327 7ff693168c41 20329 7ff693160350 __crtLCMapStringW 6 API calls 20327->20329 20327->20333 20328->20332 20329->20333 20331 7ff69315b464 __free_lconv_mon 11 API calls 20330->20331 20330->20333 20331->20333 20332->20333 20334 7ff693160350 __crtLCMapStringW 6 API calls 20332->20334 20333->20315 20333->20320 20335 7ff693168d30 20334->20335 20335->20330 20336 7ff693168d66 20335->20336 20337 7ff693168d50 20335->20337 20339 7ff693161a58 WideCharToMultiByte 20336->20339 20338 7ff693161a58 WideCharToMultiByte 20337->20338 20340 7ff693168d5e 20338->20340 20339->20340 20340->20330 20341 7ff693168d7e 20340->20341 20341->20333 20342 7ff69315b464 __free_lconv_mon 11 API calls 20341->20342 20342->20333 20344 7ff69315ff7c __crtLCMapStringW 5 API calls 20343->20344 20345 7ff69316038e 20344->20345 20346 7ff693160396 20345->20346 20349 7ff69316043c 20345->20349 20346->20326 20346->20327 20346->20333 20348 7ff6931603ff LCMapStringW 20348->20346 20350 7ff69315ff7c __crtLCMapStringW 5 API calls 20349->20350 20351 7ff69316046a __crtLCMapStringW 20350->20351 20351->20348 20354 7ff693167531 20353->20354 20356 7ff693167548 20353->20356 20355 7ff693155e48 _get_daylight 11 API calls 20354->20355 20357 7ff693167536 20355->20357 20356->20354 20358 7ff693167556 20356->20358 20359 7ff69315b824 _invalid_parameter_noinfo 37 API calls 20357->20359 20360 7ff693155e8c 45 API calls 20358->20360 20361 7ff693167541 20358->20361 20359->20361 20360->20361 20361->20055 20363 7ff693155e8c 45 API calls 20362->20363 20364 7ff69316a1e1 20363->20364 20367 7ff693169e38 20364->20367 20369 7ff693169e86 20367->20369 20368 7ff69314bb10 _log10_special 8 API calls 20370 7ff693168475 20368->20370 20371 7ff693169f0d 20369->20371 20373 7ff693169ef8 GetCPInfo 20369->20373 20376 7ff693169f11 20369->20376 20370->20055 20370->20062 20372 7ff693160b10 _fread_nolock MultiByteToWideChar 20371->20372 20371->20376 20374 7ff693169fa5 20372->20374 20373->20371 20373->20376 20375 7ff69315e6c4 _fread_nolock 12 API calls 20374->20375 20374->20376 20377 7ff693169fdc 20374->20377 20375->20377 20376->20368 20377->20376 20378 7ff693160b10 _fread_nolock MultiByteToWideChar 20377->20378 20379 7ff69316a04a 20378->20379 20380 7ff693160b10 _fread_nolock MultiByteToWideChar 20379->20380 20389 7ff69316a12c 20379->20389 20382 7ff69316a070 20380->20382 20381 7ff69315b464 __free_lconv_mon 11 API calls 20381->20376 20383 7ff69315e6c4 _fread_nolock 12 API calls 20382->20383 20384 7ff69316a09d 20382->20384 20382->20389 20383->20384 20385 7ff693160b10 _fread_nolock MultiByteToWideChar 20384->20385 20384->20389 20386 7ff69316a114 20385->20386 20387 7ff69316a11a 20386->20387 20388 7ff69316a134 20386->20388 20387->20389 20391 7ff69315b464 __free_lconv_mon 11 API calls 20387->20391 20396 7ff6931601d4 20388->20396 20389->20376 20389->20381 20391->20389 20393 7ff69316a173 20393->20376 20395 7ff69315b464 __free_lconv_mon 11 API calls 20393->20395 20394 7ff69315b464 __free_lconv_mon 11 API calls 20394->20393 20395->20376 20397 7ff69315ff7c __crtLCMapStringW 5 API calls 20396->20397 20398 7ff693160212 20397->20398 20399 7ff69316043c __crtLCMapStringW 5 API calls 20398->20399 20400 7ff69316021a 20398->20400 20401 7ff693160283 CompareStringW 20399->20401 20400->20393 20400->20394 20401->20400 20403 7ff693168eca HeapSize 20402->20403 20404 7ff693168eb1 20402->20404 20405 7ff693155e48 _get_daylight 11 API calls 20404->20405 20406 7ff693168eb6 20405->20406 20407 7ff69315b824 _invalid_parameter_noinfo 37 API calls 20406->20407 20408 7ff693168ec1 20407->20408 20408->20066 20410 7ff693168ef9 20409->20410 20411 7ff693168f03 20409->20411 20412 7ff69315e6c4 _fread_nolock 12 API calls 20410->20412 20413 7ff693168f08 20411->20413 20420 7ff693168f0f _get_daylight 20411->20420 20414 7ff693168f01 20412->20414 20415 7ff69315b464 __free_lconv_mon 11 API calls 20413->20415 20414->20071 20415->20414 20416 7ff693168f15 20418 7ff693155e48 _get_daylight 11 API calls 20416->20418 20417 7ff693168f42 HeapReAlloc 20417->20414 20417->20420 20418->20414 20419 7ff693164800 _get_daylight 2 API calls 20419->20420 20420->20416 20420->20417 20420->20419 20422 7ff69315ff7c __crtLCMapStringW 5 API calls 20421->20422 20423 7ff6931601b0 20422->20423 20423->20076 20425 7ff6931564b6 20424->20425 20426 7ff693156492 20424->20426 20427 7ff6931564bb 20425->20427 20428 7ff693156510 20425->20428 20430 7ff69315b464 __free_lconv_mon 11 API calls 20426->20430 20435 7ff6931564a1 20426->20435 20431 7ff6931564d0 20427->20431 20432 7ff69315b464 __free_lconv_mon 11 API calls 20427->20432 20427->20435 20429 7ff693160b10 _fread_nolock MultiByteToWideChar 20428->20429 20438 7ff69315652c 20429->20438 20430->20435 20433 7ff69315e6c4 _fread_nolock 12 API calls 20431->20433 20432->20431 20433->20435 20434 7ff693156533 GetLastError 20437 7ff693155dbc _fread_nolock 11 API calls 20434->20437 20435->20079 20435->20080 20436 7ff69315656e 20436->20435 20440 7ff693160b10 _fread_nolock MultiByteToWideChar 20436->20440 20441 7ff693156540 20437->20441 20438->20434 20438->20436 20439 7ff693156561 20438->20439 20443 7ff69315b464 __free_lconv_mon 11 API calls 20438->20443 20444 7ff69315e6c4 _fread_nolock 12 API calls 20439->20444 20445 7ff6931565b2 20440->20445 20442 7ff693155e48 _get_daylight 11 API calls 20441->20442 20442->20435 20443->20439 20444->20436 20445->20434 20445->20435 20448 7ff693169da1 __crtLCMapStringW 20446->20448 20447 7ff69316835e 20447->20134 20447->20135 20448->20447 20449 7ff6931601d4 6 API calls 20448->20449 20449->20447 20672 7ff69316be53 20673 7ff69316be63 20672->20673 20676 7ff6931562e8 LeaveCriticalSection 20673->20676 20909 7ff69315acd0 20912 7ff69315ac48 20909->20912 20919 7ff693161548 EnterCriticalSection 20912->20919 20920 7ff69315bed0 20921 7ff69315bed5 20920->20921 20925 7ff69315beea 20920->20925 20926 7ff69315bef0 20921->20926 20927 7ff69315bf32 20926->20927 20928 7ff69315bf3a 20926->20928 20929 7ff69315b464 __free_lconv_mon 11 API calls 20927->20929 20930 7ff69315b464 __free_lconv_mon 11 API calls 20928->20930 20929->20928 20931 7ff69315bf47 20930->20931 20932 7ff69315b464 __free_lconv_mon 11 API calls 20931->20932 20933 7ff69315bf54 20932->20933 20934 7ff69315b464 __free_lconv_mon 11 API calls 20933->20934 20935 7ff69315bf61 20934->20935 20936 7ff69315b464 __free_lconv_mon 11 API calls 20935->20936 20937 7ff69315bf6e 20936->20937 20938 7ff69315b464 __free_lconv_mon 11 API calls 20937->20938 20939 7ff69315bf7b 20938->20939 20940 7ff69315b464 __free_lconv_mon 11 API calls 20939->20940 20941 7ff69315bf88 20940->20941 20942 7ff69315b464 __free_lconv_mon 11 API calls 20941->20942 20943 7ff69315bf95 20942->20943 20944 7ff69315b464 __free_lconv_mon 11 API calls 20943->20944 20945 7ff69315bfa5 20944->20945 20946 7ff69315b464 __free_lconv_mon 11 API calls 20945->20946 20947 7ff69315bfb5 20946->20947 20952 7ff69315bd9c 20947->20952 20966 7ff693161548 EnterCriticalSection 20952->20966 20968 7ff6931626d0 20986 7ff693161548 EnterCriticalSection 20968->20986 20563 7ff69314b0a0 20564 7ff69314b0ce 20563->20564 20565 7ff69314b0b5 20563->20565 20565->20564 20567 7ff69315e6c4 12 API calls 20565->20567 20566 7ff69314b12e 20567->20566 20994 7ff693162920 21005 7ff693168654 20994->21005 21006 7ff693168661 21005->21006 21007 7ff69315b464 __free_lconv_mon 11 API calls 21006->21007 21008 7ff69316867d 21006->21008 21007->21006 21009 7ff69315b464 __free_lconv_mon 11 API calls 21008->21009 21010 7ff693162929 21008->21010 21009->21008 21011 7ff693161548 EnterCriticalSection 21010->21011 16909 7ff69314c1fc 16930 7ff69314c3dc 16909->16930 16912 7ff69314c21d __scrt_acquire_startup_lock 16915 7ff69314c35d 16912->16915 16920 7ff69314c23b __scrt_release_startup_lock 16912->16920 16913 7ff69314c353 17097 7ff69314c6fc IsProcessorFeaturePresent 16913->17097 16916 7ff69314c6fc 7 API calls 16915->16916 16918 7ff69314c368 _CreateFrameInfo 16916->16918 16917 7ff69314c260 16919 7ff69314c2e6 16938 7ff69315a6b8 16919->16938 16920->16917 16920->16919 17086 7ff69315aa64 16920->17086 16923 7ff69314c2eb 16944 7ff693141000 16923->16944 16927 7ff69314c30f 16927->16918 17093 7ff69314c560 16927->17093 16931 7ff69314c3e4 16930->16931 16932 7ff69314c3f0 __scrt_dllmain_crt_thread_attach 16931->16932 16933 7ff69314c3fd 16932->16933 16934 7ff69314c215 16932->16934 17104 7ff69315b30c 16933->17104 16934->16912 16934->16913 16939 7ff69315a6c8 16938->16939 16942 7ff69315a6dd 16938->16942 16939->16942 17147 7ff69315a148 16939->17147 16942->16923 16945 7ff693142b80 16944->16945 17346 7ff6931563c0 16945->17346 16947 7ff693142bbc 17353 7ff693142a70 16947->17353 16951 7ff69314bb10 _log10_special 8 API calls 16953 7ff6931430ec 16951->16953 17091 7ff69314c84c GetModuleHandleW 16953->17091 16954 7ff693142bfd 17513 7ff693141c60 16954->17513 16955 7ff693142cdb 17522 7ff6931439d0 16955->17522 16958 7ff693142c1c 17425 7ff693147e70 16958->17425 16960 7ff693142d2a 17545 7ff693141e50 16960->17545 16964 7ff693142c4f 16971 7ff693142c7b __vcrt_freefls 16964->16971 17517 7ff693147fe0 16964->17517 16965 7ff693142d1d 16966 7ff693142d45 16965->16966 16967 7ff693142d22 16965->16967 16969 7ff693141c60 49 API calls 16966->16969 17541 7ff69314f5a4 16967->17541 16972 7ff693142d64 16969->16972 16973 7ff693147e70 14 API calls 16971->16973 16980 7ff693142c9e __vcrt_freefls 16971->16980 16977 7ff693141930 115 API calls 16972->16977 16973->16980 16975 7ff693142dcc 16976 7ff693147fe0 40 API calls 16975->16976 16978 7ff693142dd8 16976->16978 16979 7ff693142d8e 16977->16979 16981 7ff693147fe0 40 API calls 16978->16981 16979->16958 16982 7ff693142d9e 16979->16982 16986 7ff693142cce __vcrt_freefls 16980->16986 17556 7ff693147f80 16980->17556 16984 7ff693142de4 16981->16984 16983 7ff693141e50 81 API calls 16982->16983 16992 7ff693142bc9 __vcrt_freefls 16983->16992 16985 7ff693147fe0 40 API calls 16984->16985 16985->16986 16987 7ff693147e70 14 API calls 16986->16987 16988 7ff693142e04 16987->16988 16989 7ff693142ef9 16988->16989 16990 7ff693142e29 __vcrt_freefls 16988->16990 16991 7ff693141e50 81 API calls 16989->16991 16993 7ff693147f80 40 API calls 16990->16993 17002 7ff693142e6c 16990->17002 16991->16992 16992->16951 16993->17002 16994 7ff69314303a 16997 7ff693147e70 14 API calls 16994->16997 16995 7ff693143033 17563 7ff6931485b0 16995->17563 16999 7ff69314304f __vcrt_freefls 16997->16999 17000 7ff693143187 16999->17000 17001 7ff69314308a 16999->17001 17570 7ff6931438f0 17000->17570 17003 7ff69314311a 17001->17003 17004 7ff693143094 17001->17004 17002->16994 17002->16995 17007 7ff693147e70 14 API calls 17003->17007 17438 7ff6931485c0 17004->17438 17010 7ff693143126 17007->17010 17008 7ff693143195 17011 7ff6931431b7 17008->17011 17012 7ff6931431ab 17008->17012 17014 7ff6931430a5 17010->17014 17017 7ff693143133 17010->17017 17013 7ff693141c60 49 API calls 17011->17013 17573 7ff693143a40 17012->17573 17025 7ff69314310e __vcrt_freefls 17013->17025 17021 7ff693141e50 81 API calls 17014->17021 17018 7ff693141c60 49 API calls 17017->17018 17022 7ff693143151 17018->17022 17019 7ff69314320a 17488 7ff693148950 17019->17488 17021->16992 17024 7ff693143158 17022->17024 17022->17025 17028 7ff693141e50 81 API calls 17024->17028 17025->17019 17026 7ff6931431ed SetDllDirectoryW LoadLibraryExW 17025->17026 17026->17019 17027 7ff69314321d SetDllDirectoryW 17030 7ff693143250 17027->17030 17074 7ff6931432a1 17027->17074 17028->16992 17032 7ff693147e70 14 API calls 17030->17032 17031 7ff693143433 17034 7ff69314343e 17031->17034 17040 7ff693143445 17031->17040 17039 7ff69314325c __vcrt_freefls 17032->17039 17033 7ff693143362 17493 7ff693142780 17033->17493 17035 7ff6931485b0 5 API calls 17034->17035 17037 7ff693143443 17035->17037 17037->17040 17041 7ff693143339 17039->17041 17045 7ff693143295 17039->17045 17650 7ff693142720 17040->17650 17044 7ff693147f80 40 API calls 17041->17044 17044->17074 17045->17074 17576 7ff693146200 17045->17576 17074->17031 17074->17033 17087 7ff69315aa7b 17086->17087 17088 7ff69315aa9c 17086->17088 17087->16919 19826 7ff69315b358 17088->19826 17092 7ff69314c85d 17091->17092 17092->16927 17094 7ff69314c571 17093->17094 17095 7ff69314c326 17094->17095 17096 7ff69314ce18 7 API calls 17094->17096 17095->16917 17096->17095 17098 7ff69314c722 _isindst memcpy_s 17097->17098 17099 7ff69314c741 RtlCaptureContext RtlLookupFunctionEntry 17098->17099 17100 7ff69314c76a RtlVirtualUnwind 17099->17100 17101 7ff69314c7a6 memcpy_s 17099->17101 17100->17101 17102 7ff69314c7d8 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 17101->17102 17103 7ff69314c826 _isindst 17102->17103 17103->16915 17105 7ff69316471c 17104->17105 17106 7ff69314c402 17105->17106 17114 7ff69315d420 17105->17114 17106->16934 17108 7ff69314ce18 17106->17108 17109 7ff69314ce2a 17108->17109 17110 7ff69314ce20 17108->17110 17109->16934 17126 7ff69314d1b4 17110->17126 17125 7ff693161548 EnterCriticalSection 17114->17125 17127 7ff69314d1c3 17126->17127 17128 7ff69314ce25 17126->17128 17134 7ff69314d3f0 17127->17134 17130 7ff69314d220 17128->17130 17131 7ff69314d24b 17130->17131 17132 7ff69314d22e DeleteCriticalSection 17131->17132 17133 7ff69314d24f 17131->17133 17132->17131 17133->17109 17138 7ff69314d258 17134->17138 17139 7ff69314d342 TlsFree 17138->17139 17141 7ff69314d29c __vcrt_InitializeCriticalSectionEx 17138->17141 17140 7ff69314d2ca LoadLibraryExW 17143 7ff69314d2eb GetLastError 17140->17143 17144 7ff69314d369 17140->17144 17141->17139 17141->17140 17142 7ff69314d389 GetProcAddress 17141->17142 17146 7ff69314d30d LoadLibraryExW 17141->17146 17142->17139 17143->17141 17144->17142 17145 7ff69314d380 FreeLibrary 17144->17145 17145->17142 17146->17141 17146->17144 17148 7ff69315a161 17147->17148 17155 7ff69315a15d 17147->17155 17168 7ff693163cac GetEnvironmentStringsW 17148->17168 17151 7ff69315a17a 17181 7ff69315a2c8 17151->17181 17152 7ff69315a16e 17175 7ff69315b464 17152->17175 17155->16942 17160 7ff69315a508 17155->17160 17157 7ff69315b464 __free_lconv_mon 11 API calls 17158 7ff69315a1a1 17157->17158 17159 7ff69315b464 __free_lconv_mon 11 API calls 17158->17159 17159->17155 17161 7ff69315a52b 17160->17161 17166 7ff69315a542 17160->17166 17161->16942 17162 7ff69315fe04 _get_daylight 11 API calls 17162->17166 17163 7ff69315a5b6 17165 7ff69315b464 __free_lconv_mon 11 API calls 17163->17165 17164 7ff693160b10 MultiByteToWideChar _fread_nolock 17164->17166 17165->17161 17166->17161 17166->17162 17166->17163 17166->17164 17167 7ff69315b464 __free_lconv_mon 11 API calls 17166->17167 17167->17166 17169 7ff69315a166 17168->17169 17172 7ff693163cd0 17168->17172 17169->17151 17169->17152 17171 7ff693163d07 memcpy_s 17173 7ff69315b464 __free_lconv_mon 11 API calls 17171->17173 17200 7ff69315e6c4 17172->17200 17174 7ff693163d27 FreeEnvironmentStringsW 17173->17174 17174->17169 17176 7ff69315b469 RtlFreeHeap 17175->17176 17177 7ff69315b498 17175->17177 17176->17177 17178 7ff69315b484 GetLastError 17176->17178 17177->17155 17179 7ff69315b491 __free_lconv_mon 17178->17179 17180 7ff693155e48 _get_daylight 9 API calls 17179->17180 17180->17177 17182 7ff69315a2f0 17181->17182 17183 7ff69315fe04 _get_daylight 11 API calls 17182->17183 17194 7ff69315a32b 17183->17194 17184 7ff69315a333 17185 7ff69315b464 __free_lconv_mon 11 API calls 17184->17185 17186 7ff69315a182 17185->17186 17186->17157 17187 7ff69315a3ad 17188 7ff69315b464 __free_lconv_mon 11 API calls 17187->17188 17188->17186 17189 7ff69315fe04 _get_daylight 11 API calls 17189->17194 17190 7ff69315a39c 17271 7ff69315a3e4 17190->17271 17194->17184 17194->17187 17194->17189 17194->17190 17195 7ff69315a3d0 17194->17195 17197 7ff69315b464 __free_lconv_mon 11 API calls 17194->17197 17262 7ff6931616e4 17194->17262 17277 7ff69315b844 IsProcessorFeaturePresent 17195->17277 17196 7ff69315b464 __free_lconv_mon 11 API calls 17196->17184 17197->17194 17201 7ff69315e70f 17200->17201 17205 7ff69315e6d3 _get_daylight 17200->17205 17210 7ff693155e48 17201->17210 17203 7ff69315e6f6 HeapAlloc 17204 7ff69315e70d 17203->17204 17203->17205 17204->17171 17205->17201 17205->17203 17207 7ff693164800 17205->17207 17213 7ff693164840 17207->17213 17219 7ff69315c1c8 GetLastError 17210->17219 17212 7ff693155e51 17212->17204 17218 7ff693161548 EnterCriticalSection 17213->17218 17220 7ff69315c209 FlsSetValue 17219->17220 17225 7ff69315c1ec 17219->17225 17221 7ff69315c21b 17220->17221 17224 7ff69315c1f9 SetLastError 17220->17224 17236 7ff69315fe04 17221->17236 17224->17212 17225->17220 17225->17224 17227 7ff69315c248 FlsSetValue 17230 7ff69315c266 17227->17230 17231 7ff69315c254 FlsSetValue 17227->17231 17228 7ff69315c238 FlsSetValue 17229 7ff69315c241 17228->17229 17232 7ff69315b464 __free_lconv_mon 5 API calls 17229->17232 17243 7ff69315bdfc 17230->17243 17231->17229 17232->17224 17241 7ff69315fe15 _get_daylight 17236->17241 17237 7ff69315fe66 17240 7ff693155e48 _get_daylight 10 API calls 17237->17240 17238 7ff69315fe4a HeapAlloc 17239 7ff69315c22a 17238->17239 17238->17241 17239->17227 17239->17228 17240->17239 17241->17237 17241->17238 17242 7ff693164800 _get_daylight 2 API calls 17241->17242 17242->17241 17248 7ff69315bcd4 17243->17248 17260 7ff693161548 EnterCriticalSection 17248->17260 17263 7ff6931616fb 17262->17263 17264 7ff6931616f1 17262->17264 17265 7ff693155e48 _get_daylight 11 API calls 17263->17265 17264->17263 17269 7ff693161717 17264->17269 17266 7ff693161703 17265->17266 17281 7ff69315b824 17266->17281 17268 7ff69316170f 17268->17194 17269->17268 17270 7ff693155e48 _get_daylight 11 API calls 17269->17270 17270->17266 17273 7ff69315a3e9 17271->17273 17276 7ff69315a3a4 17271->17276 17272 7ff69315a412 17275 7ff69315b464 __free_lconv_mon 11 API calls 17272->17275 17273->17272 17274 7ff69315b464 __free_lconv_mon 11 API calls 17273->17274 17274->17273 17275->17276 17276->17196 17278 7ff69315b857 17277->17278 17324 7ff69315b558 17278->17324 17284 7ff69315b6bc 17281->17284 17283 7ff69315b83d 17283->17268 17285 7ff69315b6e7 17284->17285 17288 7ff69315b758 17285->17288 17287 7ff69315b70e 17287->17283 17298 7ff69315b4a0 17288->17298 17293 7ff69315b793 17293->17287 17294 7ff69315b844 _isindst 17 API calls 17295 7ff69315b823 17294->17295 17296 7ff69315b6bc _invalid_parameter_noinfo 37 API calls 17295->17296 17297 7ff69315b83d 17296->17297 17297->17287 17299 7ff69315b4bc GetLastError 17298->17299 17300 7ff69315b4f7 17298->17300 17301 7ff69315b4cc 17299->17301 17300->17293 17304 7ff69315b50c 17300->17304 17307 7ff69315c290 17301->17307 17305 7ff69315b528 GetLastError SetLastError 17304->17305 17306 7ff69315b540 17304->17306 17305->17306 17306->17293 17306->17294 17308 7ff69315c2ca FlsSetValue 17307->17308 17309 7ff69315c2af FlsGetValue 17307->17309 17311 7ff69315c2d7 17308->17311 17312 7ff69315b4e7 SetLastError 17308->17312 17310 7ff69315c2c4 17309->17310 17309->17312 17310->17308 17313 7ff69315fe04 _get_daylight 11 API calls 17311->17313 17312->17300 17314 7ff69315c2e6 17313->17314 17315 7ff69315c304 FlsSetValue 17314->17315 17316 7ff69315c2f4 FlsSetValue 17314->17316 17318 7ff69315c322 17315->17318 17319 7ff69315c310 FlsSetValue 17315->17319 17317 7ff69315c2fd 17316->17317 17320 7ff69315b464 __free_lconv_mon 11 API calls 17317->17320 17321 7ff69315bdfc _get_daylight 11 API calls 17318->17321 17319->17317 17320->17312 17322 7ff69315c32a 17321->17322 17323 7ff69315b464 __free_lconv_mon 11 API calls 17322->17323 17323->17312 17325 7ff69315b592 _isindst memcpy_s 17324->17325 17326 7ff69315b5ba RtlCaptureContext RtlLookupFunctionEntry 17325->17326 17327 7ff69315b62a IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 17326->17327 17328 7ff69315b5f4 RtlVirtualUnwind 17326->17328 17329 7ff69315b67c _isindst 17327->17329 17328->17327 17332 7ff69314bb10 17329->17332 17333 7ff69314bb19 17332->17333 17334 7ff69314bb24 GetCurrentProcess TerminateProcess 17333->17334 17335 7ff69314bea0 IsProcessorFeaturePresent 17333->17335 17336 7ff69314beb8 17335->17336 17341 7ff69314c098 RtlCaptureContext 17336->17341 17342 7ff69314c0b2 RtlLookupFunctionEntry 17341->17342 17343 7ff69314c0c8 RtlVirtualUnwind 17342->17343 17344 7ff69314becb 17342->17344 17343->17342 17343->17344 17345 7ff69314be60 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 17344->17345 17348 7ff6931606f0 17346->17348 17347 7ff69315b758 _invalid_parameter_noinfo 37 API calls 17352 7ff69316076c 17347->17352 17349 7ff693160796 17348->17349 17350 7ff693160743 17348->17350 17663 7ff6931605c8 17349->17663 17350->17347 17352->16947 17671 7ff69314be10 17353->17671 17356 7ff693142aab GetLastError 17678 7ff693142310 17356->17678 17357 7ff693142ad0 17673 7ff693148840 FindFirstFileExW 17357->17673 17360 7ff693142ac6 17365 7ff69314bb10 _log10_special 8 API calls 17360->17365 17362 7ff693142b3d 17708 7ff693148a00 17362->17708 17363 7ff693142ae3 17695 7ff6931488c0 CreateFileW 17363->17695 17368 7ff693142b75 17365->17368 17368->16992 17375 7ff693141930 17368->17375 17369 7ff693142b4b 17369->17360 17373 7ff693141f30 78 API calls 17369->17373 17370 7ff693142b0c __vcrt_InitializeCriticalSectionEx 17370->17362 17371 7ff693142af4 17698 7ff693141f30 17371->17698 17373->17360 17376 7ff6931439d0 108 API calls 17375->17376 17377 7ff693141965 17376->17377 17378 7ff693141c23 17377->17378 17380 7ff6931473d0 83 API calls 17377->17380 17379 7ff69314bb10 _log10_special 8 API calls 17378->17379 17381 7ff693141c3e 17379->17381 17382 7ff6931419ab 17380->17382 17381->16954 17381->16955 17424 7ff6931419e3 17382->17424 18122 7ff69314fc2c 17382->18122 17384 7ff69314f5a4 74 API calls 17384->17378 17385 7ff6931419c5 17386 7ff6931419c9 17385->17386 17387 7ff6931419e8 17385->17387 17388 7ff693155e48 _get_daylight 11 API calls 17386->17388 18126 7ff69314f8f4 17387->18126 17390 7ff6931419ce 17388->17390 18129 7ff693142020 17390->18129 17393 7ff693141a06 17395 7ff693155e48 _get_daylight 11 API calls 17393->17395 17394 7ff693141a25 17397 7ff693141a3c 17394->17397 17398 7ff693141a5b 17394->17398 17396 7ff693141a0b 17395->17396 17399 7ff693142020 87 API calls 17396->17399 17400 7ff693155e48 _get_daylight 11 API calls 17397->17400 17401 7ff693141c60 49 API calls 17398->17401 17399->17424 17402 7ff693141a41 17400->17402 17403 7ff693141a72 17401->17403 17404 7ff693142020 87 API calls 17402->17404 17405 7ff693141c60 49 API calls 17403->17405 17404->17424 17406 7ff693141abd 17405->17406 17407 7ff69314fc2c 73 API calls 17406->17407 17408 7ff693141ae1 17407->17408 17409 7ff693141af6 17408->17409 17410 7ff693141b15 17408->17410 17411 7ff693155e48 _get_daylight 11 API calls 17409->17411 17412 7ff69314f8f4 _fread_nolock 53 API calls 17410->17412 17413 7ff693141afb 17411->17413 17414 7ff693141b2a 17412->17414 17415 7ff693142020 87 API calls 17413->17415 17416 7ff693141b30 17414->17416 17417 7ff693141b4f 17414->17417 17415->17424 17418 7ff693155e48 _get_daylight 11 API calls 17416->17418 18144 7ff69314f668 17417->18144 17420 7ff693141b35 17418->17420 17422 7ff693142020 87 API calls 17420->17422 17422->17424 17423 7ff693141e50 81 API calls 17423->17424 17424->17384 17426 7ff693147e7a 17425->17426 17427 7ff693148950 2 API calls 17426->17427 17428 7ff693147e99 GetEnvironmentVariableW 17427->17428 17429 7ff693147eb6 ExpandEnvironmentStringsW 17428->17429 17430 7ff693147f02 17428->17430 17429->17430 17431 7ff693147ed8 17429->17431 17432 7ff69314bb10 _log10_special 8 API calls 17430->17432 17434 7ff693148a00 2 API calls 17431->17434 17433 7ff693147f14 17432->17433 17433->16964 17435 7ff693147eea 17434->17435 17436 7ff69314bb10 _log10_special 8 API calls 17435->17436 17437 7ff693147efa 17436->17437 17437->16964 17439 7ff6931485d5 17438->17439 18407 7ff693147bb0 GetCurrentProcess OpenProcessToken 17439->18407 17442 7ff693147bb0 7 API calls 17443 7ff693148601 17442->17443 17444 7ff69314861a 17443->17444 17445 7ff693148634 17443->17445 17447 7ff693141d50 48 API calls 17444->17447 17446 7ff693141d50 48 API calls 17445->17446 17448 7ff693148647 LocalFree LocalFree 17446->17448 17449 7ff693148632 17447->17449 17450 7ff693148663 17448->17450 17452 7ff69314866f 17448->17452 17449->17448 18417 7ff693142220 17450->18417 17453 7ff69314bb10 _log10_special 8 API calls 17452->17453 17454 7ff693143099 17453->17454 17454->17014 17455 7ff693147ca0 17454->17455 17456 7ff693147cb8 17455->17456 17457 7ff693147cdc 17456->17457 17458 7ff693147d3a GetTempPathW GetCurrentProcessId 17456->17458 17460 7ff693147e70 14 API calls 17457->17460 18428 7ff693148760 17458->18428 17461 7ff693147ce8 17460->17461 18435 7ff693147610 17461->18435 17467 7ff693147d68 __vcrt_freefls 17475 7ff693147da5 __vcrt_freefls 17467->17475 18432 7ff693159aa4 17467->18432 17473 7ff693147e14 __vcrt_freefls 17474 7ff69314bb10 _log10_special 8 API calls 17473->17474 17475->17473 17480 7ff693148950 2 API calls 17475->17480 17489 7ff693148972 MultiByteToWideChar 17488->17489 17492 7ff693148996 17488->17492 17491 7ff6931489ac __vcrt_freefls 17489->17491 17489->17492 17490 7ff6931489b3 MultiByteToWideChar 17490->17491 17491->17027 17492->17490 17492->17491 17504 7ff69314278e memcpy_s 17493->17504 17494 7ff69314bb10 _log10_special 8 API calls 17496 7ff693142a24 17494->17496 17495 7ff693142987 17495->17494 17496->16992 17512 7ff693148590 LocalFree 17496->17512 17498 7ff693141c60 49 API calls 17498->17504 17499 7ff6931429a2 17501 7ff693141e50 81 API calls 17499->17501 17501->17495 17503 7ff693142989 17507 7ff693141e50 81 API calls 17503->17507 17504->17495 17504->17498 17504->17499 17504->17503 17506 7ff693142140 81 API calls 17504->17506 17510 7ff693142990 17504->17510 18717 7ff693143970 17504->18717 18723 7ff693147260 17504->18723 18735 7ff6931415e0 17504->18735 18783 7ff693146560 17504->18783 18787 7ff6931435a0 17504->18787 18831 7ff693143860 17504->18831 17506->17504 17507->17495 17511 7ff693141e50 81 API calls 17510->17511 17511->17495 17514 7ff693141c85 17513->17514 17515 7ff6931558c4 49 API calls 17514->17515 17516 7ff693141ca8 17515->17516 17516->16958 17518 7ff693148950 2 API calls 17517->17518 17519 7ff693147ff4 17518->17519 17520 7ff693159174 38 API calls 17519->17520 17521 7ff693148006 __vcrt_freefls 17520->17521 17521->16971 17523 7ff6931439dc 17522->17523 17524 7ff693148950 2 API calls 17523->17524 17525 7ff693143a04 17524->17525 17526 7ff693148950 2 API calls 17525->17526 17527 7ff693143a17 17526->17527 19014 7ff693156f54 17527->19014 17530 7ff69314bb10 _log10_special 8 API calls 17531 7ff693142ceb 17530->17531 17531->16960 17532 7ff6931473d0 17531->17532 17533 7ff6931473f4 17532->17533 17534 7ff6931474cb __vcrt_freefls 17533->17534 17535 7ff69314fc2c 73 API calls 17533->17535 17534->16965 17536 7ff693147410 17535->17536 17536->17534 19405 7ff693158804 17536->19405 17538 7ff693147425 17538->17534 17539 7ff69314fc2c 73 API calls 17538->17539 17540 7ff69314f8f4 _fread_nolock 53 API calls 17538->17540 17539->17538 17540->17538 17542 7ff69314f5d4 17541->17542 19420 7ff69314f380 17542->19420 17544 7ff69314f5ed 17544->16960 17546 7ff69314be10 17545->17546 17547 7ff693141e74 GetCurrentProcessId 17546->17547 17548 7ff693141c60 49 API calls 17547->17548 17549 7ff693141ec5 17548->17549 17550 7ff6931558c4 49 API calls 17549->17550 17551 7ff693141f02 17550->17551 17552 7ff693141cc0 80 API calls 17551->17552 17553 7ff693141f0c 17552->17553 17554 7ff69314bb10 _log10_special 8 API calls 17553->17554 17555 7ff693141f1c 17554->17555 17555->16992 17557 7ff693148950 2 API calls 17556->17557 17558 7ff693147f9c 17557->17558 17559 7ff693148950 2 API calls 17558->17559 17560 7ff693147fac 17559->17560 17561 7ff693159174 38 API calls 17560->17561 17562 7ff693147fba __vcrt_freefls 17561->17562 17562->16975 17564 7ff693148510 GetConsoleWindow 17563->17564 17565 7ff69314852a GetCurrentProcessId GetWindowThreadProcessId 17564->17565 17566 7ff693143038 17564->17566 17565->17566 17567 7ff693148549 17565->17567 17566->16994 17567->17566 17568 7ff693148551 ShowWindow 17567->17568 17568->17566 17569 7ff693148560 Sleep 17568->17569 17569->17566 17569->17568 17571 7ff693141c60 49 API calls 17570->17571 17572 7ff69314390d 17571->17572 17572->17008 17574 7ff693141c60 49 API calls 17573->17574 17575 7ff693143a70 17574->17575 17575->17025 17577 7ff693146215 17576->17577 17578 7ff693155e48 _get_daylight 11 API calls 17577->17578 17581 7ff6931432b3 17577->17581 17579 7ff693146222 17578->17579 17580 7ff693142020 87 API calls 17579->17580 17580->17581 17582 7ff693146780 17581->17582 19431 7ff693141450 17582->19431 19537 7ff6931457a0 17650->19537 17670 7ff6931562dc EnterCriticalSection 17663->17670 17672 7ff693142a7c GetModuleFileNameW 17671->17672 17672->17356 17672->17357 17674 7ff69314887f FindClose 17673->17674 17675 7ff693148892 17673->17675 17674->17675 17676 7ff69314bb10 _log10_special 8 API calls 17675->17676 17677 7ff693142ada 17676->17677 17677->17362 17677->17363 17679 7ff69314be10 17678->17679 17680 7ff693142330 GetCurrentProcessId 17679->17680 17713 7ff693141d50 17680->17713 17682 7ff69314237b 17717 7ff693155b18 17682->17717 17685 7ff693141d50 48 API calls 17686 7ff6931423eb FormatMessageW 17685->17686 17688 7ff693142436 17686->17688 17689 7ff693142424 17686->17689 17735 7ff693141e00 17688->17735 17690 7ff693141d50 48 API calls 17689->17690 17690->17688 17693 7ff69314bb10 _log10_special 8 API calls 17694 7ff693142464 17693->17694 17694->17360 17696 7ff693142af0 17695->17696 17697 7ff693148900 GetFinalPathNameByHandleW CloseHandle 17695->17697 17696->17370 17696->17371 17697->17696 17699 7ff693141f54 17698->17699 17700 7ff693141d50 48 API calls 17699->17700 17701 7ff693141fa5 17700->17701 17702 7ff693155b18 48 API calls 17701->17702 17703 7ff693141fe3 17702->17703 17704 7ff693141e00 78 API calls 17703->17704 17705 7ff693142001 17704->17705 17706 7ff69314bb10 _log10_special 8 API calls 17705->17706 17707 7ff693142011 17706->17707 17707->17360 17709 7ff693148a2a WideCharToMultiByte 17708->17709 17710 7ff693148a55 17708->17710 17709->17710 17712 7ff693148a6b __vcrt_freefls 17709->17712 17711 7ff693148a72 WideCharToMultiByte 17710->17711 17710->17712 17711->17712 17712->17369 17714 7ff693141d75 17713->17714 17715 7ff693155b18 48 API calls 17714->17715 17716 7ff693141d98 17715->17716 17716->17682 17721 7ff693155b72 17717->17721 17718 7ff693155b97 17719 7ff69315b758 _invalid_parameter_noinfo 37 API calls 17718->17719 17723 7ff693155bc1 17719->17723 17720 7ff693155bd3 17739 7ff693152e08 17720->17739 17721->17718 17721->17720 17725 7ff69314bb10 _log10_special 8 API calls 17723->17725 17724 7ff693155cb4 17726 7ff69315b464 __free_lconv_mon 11 API calls 17724->17726 17727 7ff6931423bb 17725->17727 17726->17723 17727->17685 17729 7ff693155cda 17729->17724 17731 7ff693155ce4 17729->17731 17730 7ff693155c89 17732 7ff69315b464 __free_lconv_mon 11 API calls 17730->17732 17734 7ff69315b464 __free_lconv_mon 11 API calls 17731->17734 17732->17723 17733 7ff693155c80 17733->17724 17733->17730 17734->17723 17736 7ff693141e26 17735->17736 18107 7ff6931557a0 17736->18107 17738 7ff693141e3c 17738->17693 17740 7ff693152e46 17739->17740 17741 7ff693152e36 17739->17741 17742 7ff693152e4f 17740->17742 17747 7ff693152e7d 17740->17747 17743 7ff69315b758 _invalid_parameter_noinfo 37 API calls 17741->17743 17744 7ff69315b758 _invalid_parameter_noinfo 37 API calls 17742->17744 17745 7ff693152e75 17743->17745 17744->17745 17745->17724 17745->17729 17745->17730 17745->17733 17747->17741 17747->17745 17750 7ff693154450 17747->17750 17783 7ff6931535a0 17747->17783 17820 7ff693152390 17747->17820 17751 7ff693154492 17750->17751 17752 7ff693154503 17750->17752 17753 7ff69315452d 17751->17753 17754 7ff693154498 17751->17754 17755 7ff693154508 17752->17755 17760 7ff69315455c 17752->17760 17843 7ff69315132c 17753->17843 17756 7ff6931544cc 17754->17756 17757 7ff69315449d 17754->17757 17758 7ff69315450a 17755->17758 17759 7ff69315453d 17755->17759 17765 7ff6931544a3 17756->17765 17769 7ff69315456b 17756->17769 17762 7ff693154573 17757->17762 17757->17765 17763 7ff6931544ac 17758->17763 17772 7ff693154519 17758->17772 17850 7ff693150f1c 17759->17850 17760->17762 17764 7ff693154566 17760->17764 17760->17769 17857 7ff693155158 17762->17857 17782 7ff69315459c 17763->17782 17823 7ff693154c04 17763->17823 17764->17753 17764->17769 17765->17763 17770 7ff6931544de 17765->17770 17779 7ff6931544c7 17765->17779 17769->17782 17861 7ff69315173c 17769->17861 17770->17782 17833 7ff693154f40 17770->17833 17772->17753 17774 7ff69315451e 17772->17774 17774->17782 17839 7ff693155004 17774->17839 17775 7ff69314bb10 _log10_special 8 API calls 17777 7ff693154896 17775->17777 17777->17747 17781 7ff693154788 17779->17781 17779->17782 17868 7ff693155270 17779->17868 17781->17782 17874 7ff69315fad0 17781->17874 17782->17775 17784 7ff6931535c4 17783->17784 17785 7ff6931535ae 17783->17785 17788 7ff69315b758 _invalid_parameter_noinfo 37 API calls 17784->17788 17801 7ff693153604 17784->17801 17786 7ff693154492 17785->17786 17787 7ff693154503 17785->17787 17785->17801 17789 7ff69315452d 17786->17789 17790 7ff693154498 17786->17790 17791 7ff69315455c 17787->17791 17792 7ff693154508 17787->17792 17788->17801 17797 7ff69315132c 38 API calls 17789->17797 17793 7ff6931544cc 17790->17793 17794 7ff69315449d 17790->17794 17798 7ff693154573 17791->17798 17800 7ff693154566 17791->17800 17805 7ff69315456b 17791->17805 17795 7ff69315450a 17792->17795 17796 7ff69315453d 17792->17796 17802 7ff6931544a3 17793->17802 17793->17805 17794->17798 17794->17802 17799 7ff6931544ac 17795->17799 17809 7ff693154519 17795->17809 17803 7ff693150f1c 38 API calls 17796->17803 17816 7ff6931544c7 17797->17816 17806 7ff693155158 45 API calls 17798->17806 17804 7ff693154c04 47 API calls 17799->17804 17819 7ff69315459c 17799->17819 17800->17789 17800->17805 17801->17747 17802->17799 17807 7ff6931544de 17802->17807 17802->17816 17803->17816 17804->17816 17808 7ff69315173c 38 API calls 17805->17808 17805->17819 17806->17816 17810 7ff693154f40 46 API calls 17807->17810 17807->17819 17808->17816 17809->17789 17811 7ff69315451e 17809->17811 17810->17816 17813 7ff693155004 37 API calls 17811->17813 17811->17819 17812 7ff69314bb10 _log10_special 8 API calls 17814 7ff693154896 17812->17814 17813->17816 17814->17747 17815 7ff693155270 45 API calls 17818 7ff693154788 17815->17818 17816->17815 17816->17818 17816->17819 17817 7ff69315fad0 46 API calls 17817->17818 17818->17817 17818->17819 17819->17812 18090 7ff6931505a0 17820->18090 17824 7ff693154c2a 17823->17824 17886 7ff693150158 17824->17886 17828 7ff693154d6f 17831 7ff693155270 45 API calls 17828->17831 17832 7ff693154dfd 17828->17832 17830 7ff693155270 45 API calls 17830->17828 17831->17832 17832->17779 17834 7ff693154f75 17833->17834 17835 7ff693154f93 17834->17835 17836 7ff693155270 45 API calls 17834->17836 17838 7ff693154fba 17834->17838 17837 7ff69315fad0 46 API calls 17835->17837 17836->17835 17837->17838 17838->17779 17842 7ff693155025 17839->17842 17840 7ff69315b758 _invalid_parameter_noinfo 37 API calls 17841 7ff693155056 17840->17841 17841->17779 17842->17840 17842->17841 17844 7ff69315135f 17843->17844 17845 7ff69315138e 17844->17845 17847 7ff69315144b 17844->17847 17849 7ff6931513cb 17845->17849 18022 7ff693150200 17845->18022 17848 7ff69315b758 _invalid_parameter_noinfo 37 API calls 17847->17848 17848->17849 17849->17779 17851 7ff693150f4f 17850->17851 17852 7ff693150f7e 17851->17852 17854 7ff69315103b 17851->17854 17853 7ff693150200 12 API calls 17852->17853 17856 7ff693150fbb 17852->17856 17853->17856 17855 7ff69315b758 _invalid_parameter_noinfo 37 API calls 17854->17855 17855->17856 17856->17779 17858 7ff69315519b 17857->17858 17860 7ff69315519f __crtLCMapStringW 17858->17860 18030 7ff6931551f4 17858->18030 17860->17779 17862 7ff69315176f 17861->17862 17863 7ff69315179e 17862->17863 17865 7ff69315185b 17862->17865 17864 7ff693150200 12 API calls 17863->17864 17867 7ff6931517db 17863->17867 17864->17867 17866 7ff69315b758 _invalid_parameter_noinfo 37 API calls 17865->17866 17866->17867 17867->17779 17869 7ff693155287 17868->17869 18034 7ff69315ea80 17869->18034 17875 7ff69315fb01 17874->17875 17884 7ff69315fb0f 17874->17884 17876 7ff69315fb2f 17875->17876 17877 7ff693155270 45 API calls 17875->17877 17875->17884 17878 7ff69315fb67 17876->17878 17879 7ff69315fb40 17876->17879 17877->17876 17881 7ff69315fbf2 17878->17881 17882 7ff69315fb91 17878->17882 17878->17884 18080 7ff693161310 17879->18080 17883 7ff693160b10 _fread_nolock MultiByteToWideChar 17881->17883 17882->17884 18083 7ff693160b10 17882->18083 17883->17884 17884->17781 17887 7ff69315018f 17886->17887 17893 7ff69315017e 17886->17893 17888 7ff69315e6c4 _fread_nolock 12 API calls 17887->17888 17887->17893 17889 7ff6931501bc 17888->17889 17890 7ff6931501d0 17889->17890 17892 7ff69315b464 __free_lconv_mon 11 API calls 17889->17892 17891 7ff69315b464 __free_lconv_mon 11 API calls 17890->17891 17891->17893 17892->17890 17894 7ff69315f638 17893->17894 17895 7ff69315f688 17894->17895 17896 7ff69315f655 17894->17896 17895->17896 17898 7ff69315f6ba 17895->17898 17897 7ff69315b758 _invalid_parameter_noinfo 37 API calls 17896->17897 17906 7ff693154d4d 17897->17906 17901 7ff69315f7cd 17898->17901 17911 7ff69315f702 17898->17911 17899 7ff69315f8bf 17949 7ff69315eb24 17899->17949 17901->17899 17902 7ff69315f885 17901->17902 17903 7ff69315f854 17901->17903 17905 7ff69315f817 17901->17905 17908 7ff69315f80d 17901->17908 17942 7ff69315eebc 17902->17942 17935 7ff69315f19c 17903->17935 17925 7ff69315f3cc 17905->17925 17906->17828 17906->17830 17908->17902 17910 7ff69315f812 17908->17910 17910->17903 17910->17905 17911->17906 17916 7ff69315b3ac 17911->17916 17914 7ff69315b844 _isindst 17 API calls 17915 7ff69315f91c 17914->17915 17917 7ff69315b3b9 17916->17917 17918 7ff69315b3c3 17916->17918 17917->17918 17923 7ff69315b3de 17917->17923 17919 7ff693155e48 _get_daylight 11 API calls 17918->17919 17920 7ff69315b3ca 17919->17920 17922 7ff69315b824 _invalid_parameter_noinfo 37 API calls 17920->17922 17921 7ff69315b3d6 17921->17906 17921->17914 17922->17921 17923->17921 17924 7ff693155e48 _get_daylight 11 API calls 17923->17924 17924->17920 17958 7ff69316531c 17925->17958 17929 7ff69315f474 17930 7ff69315f478 17929->17930 17931 7ff69315f4c9 17929->17931 17933 7ff69315f494 17929->17933 17930->17906 18011 7ff69315efb8 17931->18011 18007 7ff69315f274 17933->18007 17936 7ff69316531c 38 API calls 17935->17936 17937 7ff69315f1e6 17936->17937 17938 7ff693164d64 37 API calls 17937->17938 17939 7ff69315f236 17938->17939 17940 7ff69315f23a 17939->17940 17941 7ff69315f274 45 API calls 17939->17941 17940->17906 17941->17940 17943 7ff69316531c 38 API calls 17942->17943 17944 7ff69315ef07 17943->17944 17945 7ff693164d64 37 API calls 17944->17945 17946 7ff69315ef5f 17945->17946 17947 7ff69315ef63 17946->17947 17948 7ff69315efb8 45 API calls 17946->17948 17947->17906 17948->17947 17950 7ff69315eb9c 17949->17950 17951 7ff69315eb69 17949->17951 17953 7ff69315ebb4 17950->17953 17956 7ff69315ec35 17950->17956 17952 7ff69315b758 _invalid_parameter_noinfo 37 API calls 17951->17952 17955 7ff69315eb95 memcpy_s 17952->17955 17954 7ff69315eebc 46 API calls 17953->17954 17954->17955 17955->17906 17956->17955 17957 7ff693155270 45 API calls 17956->17957 17957->17955 17959 7ff69316536f fegetenv 17958->17959 17960 7ff69316909c 37 API calls 17959->17960 17964 7ff6931653c2 17960->17964 17961 7ff6931653ef 17966 7ff69315b3ac __std_exception_copy 37 API calls 17961->17966 17962 7ff6931654b2 17963 7ff69316909c 37 API calls 17962->17963 17965 7ff6931654dc 17963->17965 17964->17962 17967 7ff69316548c 17964->17967 17968 7ff6931653dd 17964->17968 17969 7ff69316909c 37 API calls 17965->17969 17970 7ff69316546d 17966->17970 17973 7ff69315b3ac __std_exception_copy 37 API calls 17967->17973 17968->17961 17968->17962 17971 7ff6931654ed 17969->17971 17972 7ff693166594 17970->17972 17977 7ff693165475 17970->17977 17974 7ff693169290 20 API calls 17971->17974 17975 7ff69315b844 _isindst 17 API calls 17972->17975 17973->17970 17985 7ff693165556 memcpy_s 17974->17985 17976 7ff6931665a9 17975->17976 17978 7ff69314bb10 _log10_special 8 API calls 17977->17978 17979 7ff69315f419 17978->17979 18003 7ff693164d64 17979->18003 17980 7ff6931658ff memcpy_s 17981 7ff693165c3f 17982 7ff693164e80 37 API calls 17981->17982 17989 7ff693166357 17982->17989 17983 7ff693165beb 17983->17981 17986 7ff6931665ac memcpy_s 37 API calls 17983->17986 17984 7ff693165597 memcpy_s 17999 7ff6931659f3 memcpy_s 17984->17999 18000 7ff693165edb memcpy_s 17984->18000 17985->17980 17985->17984 17987 7ff693155e48 _get_daylight 11 API calls 17985->17987 17986->17981 17988 7ff6931659d0 17987->17988 17990 7ff69315b824 _invalid_parameter_noinfo 37 API calls 17988->17990 17991 7ff6931665ac memcpy_s 37 API calls 17989->17991 17995 7ff6931663b2 17989->17995 17990->17984 17991->17995 17992 7ff693166538 17994 7ff69316909c 37 API calls 17992->17994 17993 7ff693155e48 11 API calls _get_daylight 17993->17999 17994->17977 17995->17992 17997 7ff693164e80 37 API calls 17995->17997 18002 7ff6931665ac memcpy_s 37 API calls 17995->18002 17996 7ff693155e48 11 API calls _get_daylight 17996->18000 17997->17995 17998 7ff69315b824 37 API calls _invalid_parameter_noinfo 17998->18000 17999->17983 17999->17993 18001 7ff69315b824 37 API calls _invalid_parameter_noinfo 17999->18001 18000->17981 18000->17983 18000->17996 18000->17998 18001->17999 18002->17995 18004 7ff693164d83 18003->18004 18005 7ff69315b758 _invalid_parameter_noinfo 37 API calls 18004->18005 18006 7ff693164dae memcpy_s 18004->18006 18005->18006 18006->17929 18008 7ff69315f2a0 memcpy_s 18007->18008 18009 7ff693155270 45 API calls 18008->18009 18010 7ff69315f35a memcpy_s 18008->18010 18009->18010 18010->17930 18012 7ff69315eff3 18011->18012 18017 7ff69315f040 memcpy_s 18011->18017 18013 7ff69315b758 _invalid_parameter_noinfo 37 API calls 18012->18013 18014 7ff69315f01f 18013->18014 18014->17930 18015 7ff69315f0ab 18016 7ff69315b3ac __std_exception_copy 37 API calls 18015->18016 18021 7ff69315f0ed memcpy_s 18016->18021 18017->18015 18018 7ff693155270 45 API calls 18017->18018 18018->18015 18019 7ff69315b844 _isindst 17 API calls 18020 7ff69315f198 18019->18020 18021->18019 18023 7ff693150237 18022->18023 18029 7ff693150226 18022->18029 18024 7ff69315e6c4 _fread_nolock 12 API calls 18023->18024 18023->18029 18025 7ff693150268 18024->18025 18026 7ff69315027c 18025->18026 18027 7ff69315b464 __free_lconv_mon 11 API calls 18025->18027 18028 7ff69315b464 __free_lconv_mon 11 API calls 18026->18028 18027->18026 18028->18029 18029->17849 18031 7ff69315521a 18030->18031 18032 7ff693155212 18030->18032 18031->17860 18033 7ff693155270 45 API calls 18032->18033 18033->18031 18035 7ff69315ea99 18034->18035 18036 7ff6931552af 18034->18036 18035->18036 18042 7ff693164574 18035->18042 18038 7ff69315eaec 18036->18038 18039 7ff6931552bf 18038->18039 18040 7ff69315eb05 18038->18040 18039->17781 18040->18039 18077 7ff6931638c0 18040->18077 18054 7ff69315c050 GetLastError 18042->18054 18045 7ff6931645ce 18045->18036 18055 7ff69315c074 FlsGetValue 18054->18055 18056 7ff69315c091 FlsSetValue 18054->18056 18058 7ff69315c081 18055->18058 18059 7ff69315c08b 18055->18059 18057 7ff69315c0a3 18056->18057 18056->18058 18061 7ff69315fe04 _get_daylight 11 API calls 18057->18061 18060 7ff69315c0fd SetLastError 18058->18060 18059->18056 18063 7ff69315c10a 18060->18063 18064 7ff69315c11d 18060->18064 18062 7ff69315c0b2 18061->18062 18066 7ff69315c0d0 FlsSetValue 18062->18066 18067 7ff69315c0c0 FlsSetValue 18062->18067 18063->18045 18076 7ff693161548 EnterCriticalSection 18063->18076 18065 7ff69315b40c _CreateFrameInfo 38 API calls 18064->18065 18068 7ff69315c122 18065->18068 18070 7ff69315c0dc FlsSetValue 18066->18070 18071 7ff69315c0ee 18066->18071 18069 7ff69315c0c9 18067->18069 18072 7ff69315b464 __free_lconv_mon 11 API calls 18069->18072 18070->18069 18073 7ff69315bdfc _get_daylight 11 API calls 18071->18073 18072->18058 18074 7ff69315c0f6 18073->18074 18075 7ff69315b464 __free_lconv_mon 11 API calls 18074->18075 18075->18060 18078 7ff69315c050 _CreateFrameInfo 45 API calls 18077->18078 18079 7ff6931638c9 18078->18079 18086 7ff693167ff8 18080->18086 18085 7ff693160b19 MultiByteToWideChar 18083->18085 18089 7ff69316805c 18086->18089 18087 7ff69314bb10 _log10_special 8 API calls 18088 7ff69316132d 18087->18088 18088->17884 18089->18087 18091 7ff6931505d5 18090->18091 18093 7ff6931505e7 18090->18093 18092 7ff693155e48 _get_daylight 11 API calls 18091->18092 18094 7ff6931505da 18092->18094 18095 7ff6931505f5 18093->18095 18099 7ff693150631 18093->18099 18096 7ff69315b824 _invalid_parameter_noinfo 37 API calls 18094->18096 18097 7ff69315b758 _invalid_parameter_noinfo 37 API calls 18095->18097 18104 7ff6931505e5 18096->18104 18097->18104 18098 7ff6931509ad 18100 7ff693155e48 _get_daylight 11 API calls 18098->18100 18098->18104 18099->18098 18101 7ff693155e48 _get_daylight 11 API calls 18099->18101 18102 7ff693150c41 18100->18102 18103 7ff6931509a2 18101->18103 18105 7ff69315b824 _invalid_parameter_noinfo 37 API calls 18102->18105 18106 7ff69315b824 _invalid_parameter_noinfo 37 API calls 18103->18106 18104->17747 18105->18104 18106->18098 18108 7ff6931557ca 18107->18108 18109 7ff693155802 18108->18109 18111 7ff693155835 18108->18111 18110 7ff69315b758 _invalid_parameter_noinfo 37 API calls 18109->18110 18113 7ff69315582b 18110->18113 18114 7ff6931500d8 18111->18114 18113->17738 18121 7ff6931562dc EnterCriticalSection 18114->18121 18123 7ff69314fc5c 18122->18123 18150 7ff69314f9bc 18123->18150 18125 7ff69314fc75 18125->17385 18162 7ff69314f914 18126->18162 18130 7ff69314be10 18129->18130 18131 7ff693142040 GetCurrentProcessId 18130->18131 18132 7ff693141c60 49 API calls 18131->18132 18133 7ff69314208b 18132->18133 18176 7ff6931558c4 18133->18176 18137 7ff6931420ec 18138 7ff693141c60 49 API calls 18137->18138 18139 7ff693142106 18138->18139 18216 7ff693141cc0 18139->18216 18142 7ff69314bb10 _log10_special 8 API calls 18143 7ff693142120 18142->18143 18143->17424 18145 7ff693141b69 18144->18145 18146 7ff69314f671 18144->18146 18145->17423 18145->17424 18147 7ff693155e48 _get_daylight 11 API calls 18146->18147 18148 7ff69314f676 18147->18148 18149 7ff69315b824 _invalid_parameter_noinfo 37 API calls 18148->18149 18149->18145 18151 7ff69314fa26 18150->18151 18152 7ff69314f9e6 18150->18152 18151->18152 18154 7ff69314fa32 18151->18154 18153 7ff69315b758 _invalid_parameter_noinfo 37 API calls 18152->18153 18155 7ff69314fa0d 18153->18155 18161 7ff6931562dc EnterCriticalSection 18154->18161 18155->18125 18163 7ff69314f93e 18162->18163 18174 7ff693141a00 18162->18174 18164 7ff69314f98a 18163->18164 18165 7ff69314f94d memcpy_s 18163->18165 18163->18174 18175 7ff6931562dc EnterCriticalSection 18164->18175 18168 7ff693155e48 _get_daylight 11 API calls 18165->18168 18170 7ff69314f962 18168->18170 18172 7ff69315b824 _invalid_parameter_noinfo 37 API calls 18170->18172 18172->18174 18174->17393 18174->17394 18179 7ff69315591e 18176->18179 18177 7ff693155943 18178 7ff69315b758 _invalid_parameter_noinfo 37 API calls 18177->18178 18182 7ff69315596d 18178->18182 18179->18177 18180 7ff69315597f 18179->18180 18227 7ff6931527b8 18180->18227 18184 7ff69314bb10 _log10_special 8 API calls 18182->18184 18183 7ff69315b464 __free_lconv_mon 11 API calls 18183->18182 18186 7ff6931420ca 18184->18186 18194 7ff6931560a0 18186->18194 18187 7ff693155a80 18189 7ff693155a5c 18187->18189 18190 7ff693155a8a 18187->18190 18188 7ff693155a28 18188->18189 18192 7ff693155a31 18188->18192 18189->18183 18193 7ff69315b464 __free_lconv_mon 11 API calls 18190->18193 18191 7ff69315b464 __free_lconv_mon 11 API calls 18191->18182 18192->18191 18193->18182 18195 7ff69315c1c8 _get_daylight 11 API calls 18194->18195 18196 7ff6931560b7 18195->18196 18197 7ff69315fe04 _get_daylight 11 API calls 18196->18197 18198 7ff6931560f7 18196->18198 18203 7ff6931560bf 18196->18203 18199 7ff6931560ec 18197->18199 18198->18203 18365 7ff69315fe8c 18198->18365 18200 7ff69315b464 __free_lconv_mon 11 API calls 18199->18200 18200->18198 18203->18137 18204 7ff69315b844 _isindst 17 API calls 18205 7ff69315613c 18204->18205 18206 7ff69315fe04 _get_daylight 11 API calls 18205->18206 18207 7ff693156189 18206->18207 18208 7ff69315b464 __free_lconv_mon 11 API calls 18207->18208 18209 7ff693156197 18208->18209 18210 7ff69315fe04 _get_daylight 11 API calls 18209->18210 18214 7ff6931561c1 18209->18214 18211 7ff6931561b3 18210->18211 18213 7ff69315b464 __free_lconv_mon 11 API calls 18211->18213 18213->18214 18215 7ff6931561ca 18214->18215 18374 7ff6931602e0 18214->18374 18215->18137 18217 7ff693141ccc 18216->18217 18218 7ff693148950 2 API calls 18217->18218 18219 7ff693141cf4 18218->18219 18220 7ff693141d19 18219->18220 18221 7ff693141cfe 18219->18221 18388 7ff693141db0 18220->18388 18222 7ff693141e00 78 API calls 18221->18222 18224 7ff693141d17 18222->18224 18225 7ff69314bb10 _log10_special 8 API calls 18224->18225 18226 7ff693141d40 18225->18226 18226->18142 18228 7ff6931527f6 18227->18228 18229 7ff6931527e6 18227->18229 18230 7ff6931527ff 18228->18230 18237 7ff69315282d 18228->18237 18233 7ff69315b758 _invalid_parameter_noinfo 37 API calls 18229->18233 18231 7ff69315b758 _invalid_parameter_noinfo 37 API calls 18230->18231 18232 7ff693152825 18231->18232 18232->18187 18232->18188 18232->18189 18232->18192 18233->18232 18234 7ff693155270 45 API calls 18234->18237 18236 7ff693152adc 18239 7ff69315b758 _invalid_parameter_noinfo 37 API calls 18236->18239 18237->18229 18237->18232 18237->18234 18237->18236 18241 7ff693153b88 18237->18241 18267 7ff693153268 18237->18267 18297 7ff693152300 18237->18297 18239->18229 18242 7ff693153bca 18241->18242 18243 7ff693153c3d 18241->18243 18244 7ff693153c67 18242->18244 18245 7ff693153bd0 18242->18245 18246 7ff693153c97 18243->18246 18247 7ff693153c42 18243->18247 18314 7ff693151128 18244->18314 18253 7ff693153bd5 18245->18253 18256 7ff693153ca6 18245->18256 18246->18244 18246->18256 18265 7ff693153c00 18246->18265 18248 7ff693153c77 18247->18248 18249 7ff693153c44 18247->18249 18321 7ff693150d18 18248->18321 18251 7ff693153be5 18249->18251 18255 7ff693153c53 18249->18255 18266 7ff693153cd5 18251->18266 18300 7ff6931549b0 18251->18300 18253->18251 18257 7ff693153c18 18253->18257 18253->18265 18255->18244 18259 7ff693153c58 18255->18259 18256->18266 18328 7ff693151538 18256->18328 18257->18266 18310 7ff693154e6c 18257->18310 18262 7ff693155004 37 API calls 18259->18262 18259->18266 18261 7ff69314bb10 _log10_special 8 API calls 18263 7ff693153f6b 18261->18263 18262->18265 18263->18237 18265->18266 18335 7ff69315f920 18265->18335 18266->18261 18268 7ff693153289 18267->18268 18269 7ff693153273 18267->18269 18270 7ff69315b758 _invalid_parameter_noinfo 37 API calls 18268->18270 18288 7ff6931532c7 18268->18288 18271 7ff693153bca 18269->18271 18272 7ff693153c3d 18269->18272 18269->18288 18270->18288 18273 7ff693153c67 18271->18273 18274 7ff693153bd0 18271->18274 18275 7ff693153c97 18272->18275 18276 7ff693153c42 18272->18276 18279 7ff693151128 38 API calls 18273->18279 18282 7ff693153bd5 18274->18282 18284 7ff693153ca6 18274->18284 18275->18273 18275->18284 18295 7ff693153c00 18275->18295 18277 7ff693153c77 18276->18277 18278 7ff693153c44 18276->18278 18283 7ff693150d18 38 API calls 18277->18283 18280 7ff693153be5 18278->18280 18287 7ff693153c53 18278->18287 18279->18295 18281 7ff6931549b0 47 API calls 18280->18281 18296 7ff693153cd5 18280->18296 18281->18295 18282->18280 18285 7ff693153c18 18282->18285 18282->18295 18283->18295 18286 7ff693151538 38 API calls 18284->18286 18284->18296 18289 7ff693154e6c 47 API calls 18285->18289 18285->18296 18286->18295 18287->18273 18290 7ff693153c58 18287->18290 18288->18237 18289->18295 18292 7ff693155004 37 API calls 18290->18292 18290->18296 18291 7ff69314bb10 _log10_special 8 API calls 18293 7ff693153f6b 18291->18293 18292->18295 18293->18237 18294 7ff69315f920 47 API calls 18294->18295 18295->18294 18295->18296 18296->18291 18348 7ff6931502ec 18297->18348 18301 7ff6931549d2 18300->18301 18302 7ff693150158 12 API calls 18301->18302 18303 7ff693154a1a 18302->18303 18304 7ff69315f638 46 API calls 18303->18304 18305 7ff693154aed 18304->18305 18306 7ff693155270 45 API calls 18305->18306 18308 7ff693154b0f 18305->18308 18306->18308 18307 7ff693155270 45 API calls 18309 7ff693154b98 18307->18309 18308->18307 18308->18308 18308->18309 18309->18265 18311 7ff693154e84 18310->18311 18313 7ff693154eec 18310->18313 18312 7ff69315f920 47 API calls 18311->18312 18311->18313 18312->18313 18313->18265 18315 7ff69315115b 18314->18315 18316 7ff69315118a 18315->18316 18318 7ff693151247 18315->18318 18317 7ff693150158 12 API calls 18316->18317 18320 7ff6931511c7 18316->18320 18317->18320 18319 7ff69315b758 _invalid_parameter_noinfo 37 API calls 18318->18319 18319->18320 18320->18265 18322 7ff693150d4b 18321->18322 18323 7ff693150d7a 18322->18323 18325 7ff693150e37 18322->18325 18324 7ff693150158 12 API calls 18323->18324 18327 7ff693150db7 18323->18327 18324->18327 18326 7ff69315b758 _invalid_parameter_noinfo 37 API calls 18325->18326 18326->18327 18327->18265 18329 7ff69315156b 18328->18329 18330 7ff69315159a 18329->18330 18332 7ff693151657 18329->18332 18331 7ff693150158 12 API calls 18330->18331 18334 7ff6931515d7 18330->18334 18331->18334 18333 7ff69315b758 _invalid_parameter_noinfo 37 API calls 18332->18333 18333->18334 18334->18265 18336 7ff69315f948 18335->18336 18337 7ff69315f98d 18336->18337 18339 7ff693155270 45 API calls 18336->18339 18341 7ff69315f94d memcpy_s 18336->18341 18344 7ff69315f976 memcpy_s 18336->18344 18337->18341 18337->18344 18345 7ff693161a58 18337->18345 18338 7ff69315b758 _invalid_parameter_noinfo 37 API calls 18338->18341 18339->18337 18341->18265 18344->18338 18344->18341 18347 7ff693161a7c WideCharToMultiByte 18345->18347 18349 7ff69315032b 18348->18349 18350 7ff693150319 18348->18350 18353 7ff693150338 18349->18353 18356 7ff693150375 18349->18356 18351 7ff693155e48 _get_daylight 11 API calls 18350->18351 18352 7ff69315031e 18351->18352 18354 7ff69315b824 _invalid_parameter_noinfo 37 API calls 18352->18354 18355 7ff69315b758 _invalid_parameter_noinfo 37 API calls 18353->18355 18362 7ff693150329 18354->18362 18355->18362 18357 7ff69315041e 18356->18357 18358 7ff693155e48 _get_daylight 11 API calls 18356->18358 18359 7ff693155e48 _get_daylight 11 API calls 18357->18359 18357->18362 18360 7ff693150413 18358->18360 18361 7ff6931504c8 18359->18361 18363 7ff69315b824 _invalid_parameter_noinfo 37 API calls 18360->18363 18364 7ff69315b824 _invalid_parameter_noinfo 37 API calls 18361->18364 18362->18237 18363->18357 18364->18362 18368 7ff69315fea9 18365->18368 18366 7ff69315feae 18367 7ff693155e48 _get_daylight 11 API calls 18366->18367 18370 7ff69315611d 18366->18370 18373 7ff69315feb8 18367->18373 18368->18366 18368->18370 18371 7ff69315fef8 18368->18371 18369 7ff69315b824 _invalid_parameter_noinfo 37 API calls 18369->18370 18370->18203 18370->18204 18371->18370 18372 7ff693155e48 _get_daylight 11 API calls 18371->18372 18372->18373 18373->18369 18379 7ff69315ff7c 18374->18379 18377 7ff69316031b 18377->18214 18378 7ff693160335 InitializeCriticalSectionAndSpinCount 18378->18377 18380 7ff69315ffd9 18379->18380 18381 7ff69315ffd4 __vcrt_InitializeCriticalSectionEx 18379->18381 18380->18377 18380->18378 18381->18380 18382 7ff693160009 LoadLibraryExW 18381->18382 18383 7ff6931600fe GetProcAddress 18381->18383 18387 7ff693160068 LoadLibraryExW 18381->18387 18384 7ff6931600de 18382->18384 18385 7ff69316002e GetLastError 18382->18385 18383->18380 18384->18383 18386 7ff6931600f5 FreeLibrary 18384->18386 18385->18381 18386->18383 18387->18381 18387->18384 18389 7ff693141dd6 18388->18389 18392 7ff69315567c 18389->18392 18391 7ff693141dec 18391->18224 18393 7ff6931556a6 18392->18393 18394 7ff6931556de 18393->18394 18396 7ff693155711 18393->18396 18395 7ff69315b758 _invalid_parameter_noinfo 37 API calls 18394->18395 18398 7ff693155707 18395->18398 18399 7ff693150118 18396->18399 18398->18391 18406 7ff6931562dc EnterCriticalSection 18399->18406 18408 7ff693147bf1 GetTokenInformation 18407->18408 18409 7ff693147c73 __vcrt_freefls 18407->18409 18410 7ff693147c1d 18408->18410 18411 7ff693147c12 GetLastError 18408->18411 18412 7ff693147c86 CloseHandle 18409->18412 18413 7ff693147c8c 18409->18413 18410->18409 18414 7ff693147c39 GetTokenInformation 18410->18414 18411->18409 18411->18410 18412->18413 18413->17442 18414->18409 18416 7ff693147c5c 18414->18416 18415 7ff693147c66 ConvertSidToStringSidW 18415->18409 18416->18409 18416->18415 18418 7ff69314be10 18417->18418 18419 7ff693142244 GetCurrentProcessId 18418->18419 18420 7ff693141d50 48 API calls 18419->18420 18421 7ff693142295 18420->18421 18422 7ff693155b18 48 API calls 18421->18422 18423 7ff6931422d3 18422->18423 18424 7ff693141e00 78 API calls 18423->18424 18425 7ff6931422f1 18424->18425 18426 7ff69314bb10 _log10_special 8 API calls 18425->18426 18427 7ff693142301 18426->18427 18427->17452 18429 7ff693148785 18428->18429 18430 7ff693155b18 48 API calls 18429->18430 18431 7ff6931487a4 18430->18431 18431->17467 18477 7ff6931596d0 18432->18477 18436 7ff69314761c 18435->18436 18437 7ff693148950 2 API calls 18436->18437 18438 7ff69314763b 18437->18438 18439 7ff693147656 ExpandEnvironmentStringsW 18438->18439 18440 7ff693147643 18438->18440 18441 7ff69314767c __vcrt_freefls 18439->18441 18718 7ff69314397a 18717->18718 18719 7ff693148950 2 API calls 18718->18719 18720 7ff69314399f 18719->18720 18721 7ff69314bb10 _log10_special 8 API calls 18720->18721 18722 7ff6931439c7 18721->18722 18722->17504 18725 7ff69314726e 18723->18725 18724 7ff693147392 18728 7ff69314bb10 _log10_special 8 API calls 18724->18728 18725->18724 18726 7ff693141c60 49 API calls 18725->18726 18727 7ff6931472f5 18726->18727 18727->18724 18730 7ff693141c60 49 API calls 18727->18730 18731 7ff693143970 10 API calls 18727->18731 18732 7ff69314734b 18727->18732 18729 7ff6931473c3 18728->18729 18729->17504 18730->18727 18731->18727 18733 7ff693148950 2 API calls 18732->18733 18734 7ff693147363 CreateDirectoryW 18733->18734 18734->18724 18734->18727 18736 7ff693141617 18735->18736 18737 7ff6931415f3 18735->18737 18739 7ff6931439d0 108 API calls 18736->18739 18856 7ff693141030 18737->18856 18741 7ff69314162b 18739->18741 18742 7ff693141633 18741->18742 18743 7ff693141662 18741->18743 18745 7ff693155e48 _get_daylight 11 API calls 18742->18745 18746 7ff6931439d0 108 API calls 18743->18746 18748 7ff693141638 18745->18748 18749 7ff693141676 18746->18749 18750 7ff693142020 87 API calls 18748->18750 18751 7ff693141698 18749->18751 18752 7ff69314167e 18749->18752 18754 7ff693141e50 81 API calls 18752->18754 18784 7ff6931465cb 18783->18784 18786 7ff693146584 18783->18786 18784->17504 18786->18784 18920 7ff693155f64 18786->18920 18788 7ff6931435b1 18787->18788 18789 7ff6931438f0 49 API calls 18788->18789 18790 7ff6931435eb 18789->18790 18791 7ff6931438f0 49 API calls 18790->18791 18792 7ff6931435fb 18791->18792 18793 7ff69314361d 18792->18793 18794 7ff69314364c 18792->18794 18951 7ff693143520 18793->18951 18796 7ff693143520 51 API calls 18794->18796 18832 7ff693141c60 49 API calls 18831->18832 18833 7ff693143884 18832->18833 18833->17504 18857 7ff6931439d0 108 API calls 18856->18857 18858 7ff69314106c 18857->18858 18859 7ff693141089 18858->18859 18860 7ff693141074 18858->18860 18862 7ff69314fc2c 73 API calls 18859->18862 18861 7ff693141e50 81 API calls 18860->18861 18865 7ff693141084 __vcrt_freefls 18861->18865 18863 7ff69314109f 18862->18863 18921 7ff693155f9e 18920->18921 18922 7ff693155f71 18920->18922 18924 7ff693155fc1 18921->18924 18925 7ff693155fdd 18921->18925 18923 7ff693155e48 _get_daylight 11 API calls 18922->18923 18927 7ff693155f28 18922->18927 18926 7ff693155f7b 18923->18926 18928 7ff693155e48 _get_daylight 11 API calls 18924->18928 18935 7ff693155e8c 18925->18935 18930 7ff69315b824 _invalid_parameter_noinfo 37 API calls 18926->18930 18927->18786 18931 7ff693155fc6 18928->18931 18933 7ff693155f86 18930->18933 18932 7ff69315b824 _invalid_parameter_noinfo 37 API calls 18931->18932 18934 7ff693155fd1 18932->18934 18933->18786 18934->18786 18936 7ff693155eab 18935->18936 18937 7ff693155eb0 18935->18937 18936->18934 18937->18936 18938 7ff69315c050 _CreateFrameInfo 45 API calls 18937->18938 18952 7ff693143546 18951->18952 19015 7ff693156e88 19014->19015 19016 7ff693156eae 19015->19016 19019 7ff693156ee1 19015->19019 19017 7ff693155e48 _get_daylight 11 API calls 19016->19017 19018 7ff693156eb3 19017->19018 19020 7ff69315b824 _invalid_parameter_noinfo 37 API calls 19018->19020 19021 7ff693156ee7 19019->19021 19022 7ff693156ef4 19019->19022 19025 7ff693143a26 19020->19025 19023 7ff693155e48 _get_daylight 11 API calls 19021->19023 19033 7ff69315bb30 19022->19033 19023->19025 19025->17530 19046 7ff693161548 EnterCriticalSection 19033->19046 19406 7ff693158834 19405->19406 19409 7ff693158310 19406->19409 19408 7ff69315884d 19408->17538 19410 7ff69315832b 19409->19410 19411 7ff69315835a 19409->19411 19413 7ff69315b758 _invalid_parameter_noinfo 37 API calls 19410->19413 19419 7ff6931562dc EnterCriticalSection 19411->19419 19415 7ff69315834b 19413->19415 19415->19408 19421 7ff69314f39b 19420->19421 19422 7ff69314f3c9 19420->19422 19423 7ff69315b758 _invalid_parameter_noinfo 37 API calls 19421->19423 19429 7ff69314f3bb 19422->19429 19430 7ff6931562dc EnterCriticalSection 19422->19430 19423->19429 19429->17544 19432 7ff6931439d0 108 API calls 19431->19432 19433 7ff693141473 19432->19433 19434 7ff69314149c 19433->19434 19435 7ff69314147b 19433->19435 19538 7ff6931457b5 19537->19538 19539 7ff693141c60 49 API calls 19538->19539 19540 7ff6931457f1 19539->19540 19541 7ff69314581d 19540->19541 19542 7ff6931457fa 19540->19542 19544 7ff693143a40 49 API calls 19541->19544 19543 7ff693141e50 81 API calls 19542->19543 19560 7ff693145813 19543->19560 19545 7ff693145835 19544->19545 19546 7ff693145853 19545->19546 19549 7ff693141e50 81 API calls 19545->19549 19548 7ff69314bb10 _log10_special 8 API calls 19549->19546 19560->19548 19827 7ff69315c050 _CreateFrameInfo 45 API calls 19826->19827 19828 7ff69315b361 19827->19828 19831 7ff69315b40c 19828->19831 19840 7ff6931648c0 19831->19840 19866 7ff693164878 19840->19866 19871 7ff693161548 EnterCriticalSection 19866->19871 21590 7ff693160bfc 21591 7ff693160dee 21590->21591 21594 7ff693160c3e _isindst 21590->21594 21592 7ff693155e48 _get_daylight 11 API calls 21591->21592 21593 7ff693160dde 21592->21593 21595 7ff69314bb10 _log10_special 8 API calls 21593->21595 21594->21591 21597 7ff693160cbe _isindst 21594->21597 21596 7ff693160e09 21595->21596 21611 7ff693167404 21597->21611 21602 7ff693160e1a 21603 7ff69315b844 _isindst 17 API calls 21602->21603 21605 7ff693160e2e 21603->21605 21609 7ff693160d1b 21609->21593 21636 7ff693167448 21609->21636 21612 7ff693167413 21611->21612 21613 7ff693160cdc 21611->21613 21643 7ff693161548 EnterCriticalSection 21612->21643 21618 7ff693166808 21613->21618 21619 7ff693166811 21618->21619 21623 7ff693160cf1 21618->21623 21620 7ff693155e48 _get_daylight 11 API calls 21619->21620 21621 7ff693166816 21620->21621 21622 7ff69315b824 _invalid_parameter_noinfo 37 API calls 21621->21622 21622->21623 21623->21602 21624 7ff693166838 21623->21624 21625 7ff693160d02 21624->21625 21626 7ff693166841 21624->21626 21625->21602 21630 7ff693166868 21625->21630 21627 7ff693155e48 _get_daylight 11 API calls 21626->21627 21628 7ff693166846 21627->21628 21629 7ff69315b824 _invalid_parameter_noinfo 37 API calls 21628->21629 21629->21625 21631 7ff693166871 21630->21631 21633 7ff693160d13 21630->21633 21632 7ff693155e48 _get_daylight 11 API calls 21631->21632 21634 7ff693166876 21632->21634 21633->21602 21633->21609 21635 7ff69315b824 _invalid_parameter_noinfo 37 API calls 21634->21635 21635->21633 21644 7ff693161548 EnterCriticalSection 21636->21644 20792 7ff693156280 20793 7ff69315628b 20792->20793 20801 7ff693160514 20793->20801 20814 7ff693161548 EnterCriticalSection 20801->20814 21135 7ff69314c110 21136 7ff69314c120 21135->21136 21152 7ff69315aae0 21136->21152 21138 7ff69314c12c 21158 7ff69314c418 21138->21158 21140 7ff69314c199 21141 7ff69314c6fc 7 API calls 21140->21141 21151 7ff69314c1b5 21140->21151 21143 7ff69314c1c5 21141->21143 21142 7ff69314c144 _RTC_Initialize 21142->21140 21163 7ff69314c5c8 21142->21163 21145 7ff69314c159 21166 7ff693159f50 21145->21166 21153 7ff69315aaf1 21152->21153 21154 7ff69315aaf9 21153->21154 21155 7ff693155e48 _get_daylight 11 API calls 21153->21155 21154->21138 21156 7ff69315ab08 21155->21156 21157 7ff69315b824 _invalid_parameter_noinfo 37 API calls 21156->21157 21157->21154 21159 7ff69314c429 21158->21159 21162 7ff69314c42e __scrt_release_startup_lock 21158->21162 21160 7ff69314c6fc 7 API calls 21159->21160 21159->21162 21161 7ff69314c4a2 21160->21161 21162->21142 21191 7ff69314c58c 21163->21191 21165 7ff69314c5d1 21165->21145 21167 7ff69314c165 21166->21167 21168 7ff693159f70 21166->21168 21167->21140 21190 7ff69314c69c InitializeSListHead 21167->21190 21169 7ff693159f78 21168->21169 21170 7ff693159f8e GetModuleFileNameW 21168->21170 21171 7ff693155e48 _get_daylight 11 API calls 21169->21171 21174 7ff693159fb9 21170->21174 21172 7ff693159f7d 21171->21172 21173 7ff69315b824 _invalid_parameter_noinfo 37 API calls 21172->21173 21173->21167 21175 7ff693159ef0 11 API calls 21174->21175 21176 7ff693159ff9 21175->21176 21177 7ff69315a001 21176->21177 21181 7ff69315a019 21176->21181 21178 7ff693155e48 _get_daylight 11 API calls 21177->21178 21179 7ff69315a006 21178->21179 21182 7ff69315b464 __free_lconv_mon 11 API calls 21179->21182 21180 7ff69315a03b 21183 7ff69315b464 __free_lconv_mon 11 API calls 21180->21183 21181->21180 21184 7ff69315a067 21181->21184 21185 7ff69315a080 21181->21185 21182->21167 21183->21167 21186 7ff69315b464 __free_lconv_mon 11 API calls 21184->21186 21188 7ff69315b464 __free_lconv_mon 11 API calls 21185->21188 21187 7ff69315a070 21186->21187 21189 7ff69315b464 __free_lconv_mon 11 API calls 21187->21189 21188->21180 21189->21167 21192 7ff69314c5a6 21191->21192 21194 7ff69314c59f 21191->21194 21195 7ff69315b16c 21192->21195 21194->21165 21198 7ff69315ada8 21195->21198 21205 7ff693161548 EnterCriticalSection 21198->21205

                                                                  Executed Functions

                                                                  Function 00007FF693148020 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257synchronizationwindowregistryCOMMON
                                                                  Download Yara Rule

                                                                  Control-flow Graph

                                                                  • Executed
                                                                  • Not Executed
                                                                  control_flow_graph 0 7ff693148020-7ff693148166 call 7ff69314be10 call 7ff693148950 SetConsoleCtrlHandler GetStartupInfoW call 7ff693156260 call 7ff69315b384 call 7ff693159658 call 7ff693156260 call 7ff69315b384 call 7ff693159658 call 7ff693156260 call 7ff69315b384 call 7ff693159658 GetCommandLineW CreateProcessW 23 7ff69314818d-7ff6931481c9 RegisterClassW 0->23 24 7ff693148168-7ff693148188 GetLastError call 7ff693142310 0->24 26 7ff6931481cb GetLastError 23->26 27 7ff6931481d1-7ff693148225 CreateWindowExW 23->27 32 7ff693148479-7ff69314849f call 7ff69314bb10 24->32 26->27 29 7ff693148227-7ff69314822d GetLastError 27->29 30 7ff69314822f-7ff693148234 ShowWindow 27->30 31 7ff69314823a-7ff69314824a WaitForSingleObject 29->31 30->31 33 7ff69314824c 31->33 34 7ff6931482c8-7ff6931482cf 31->34 36 7ff693148250-7ff693148253 33->36 37 7ff693148312-7ff693148319 34->37 38 7ff6931482d1-7ff6931482e1 WaitForSingleObject 34->38 40 7ff69314825b-7ff693148262 36->40 41 7ff693148255 GetLastError 36->41 44 7ff69314831f-7ff693148335 QueryPerformanceFrequency QueryPerformanceCounter 37->44 45 7ff693148400-7ff693148419 GetMessageW 37->45 42 7ff6931482e7-7ff6931482f7 TerminateProcess 38->42 43 7ff693148438-7ff693148442 38->43 40->38 46 7ff693148264-7ff693148281 PeekMessageW 40->46 41->40 51 7ff6931482f9 GetLastError 42->51 52 7ff6931482ff-7ff69314830d WaitForSingleObject 42->52 49 7ff693148444-7ff69314844a DestroyWindow 43->49 50 7ff693148451-7ff693148475 GetExitCodeProcess CloseHandle * 2 43->50 53 7ff693148340-7ff693148378 MsgWaitForMultipleObjects PeekMessageW 44->53 47 7ff69314841b-7ff693148429 TranslateMessage DispatchMessageW 45->47 48 7ff69314842f-7ff693148436 45->48 56 7ff6931482b6-7ff6931482c6 WaitForSingleObject 46->56 57 7ff693148283-7ff6931482b4 TranslateMessage DispatchMessageW PeekMessageW 46->57 47->48 48->43 48->45 49->50 50->32 51->52 52->43 54 7ff69314837a 53->54 55 7ff6931483b3-7ff6931483ba 53->55 58 7ff693148380-7ff6931483b1 TranslateMessage DispatchMessageW PeekMessageW 54->58 55->45 59 7ff6931483bc-7ff6931483e5 QueryPerformanceCounter 55->59 56->34 56->36 57->56 57->57 58->55 58->58 59->53 60 7ff6931483eb-7ff6931483f2 59->60 60->43 61 7ff6931483f4-7ff6931483f8 60->61 61->45
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: ErrorLastMessage$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
                                                                  • String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
                                                                  • API String ID: 4208240515-3165540532
                                                                  • Opcode ID: 40a2b2c96db5062fbaff54aa02804a1320958b809a954de9be60782f8870c354
                                                                  • Instruction ID: 842b30c751afc8334d58ad2ea02d70657057a8eca33b6c29641ebf5728a4d5f3
                                                                  • Opcode Fuzzy Hash: 40a2b2c96db5062fbaff54aa02804a1320958b809a954de9be60782f8870c354
                                                                  • Instruction Fuzzy Hash: ACD18631A08B8286EB209F74E8566AD3768FF84B9CF444276DA5DA3AB4DF3CD545C700
                                                                  Function 00007FF693167BD4 Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON
                                                                  Download Yara Rule

                                                                  Control-flow Graph

                                                                  • Executed
                                                                  • Not Executed
                                                                  control_flow_graph 564 7ff693167bd4-7ff693167c47 call 7ff693167908 567 7ff693167c49-7ff693167c52 call 7ff693155e28 564->567 568 7ff693167c61-7ff693167c6b call 7ff69315945c 564->568 575 7ff693167c55-7ff693167c5c call 7ff693155e48 567->575 573 7ff693167c6d-7ff693167c84 call 7ff693155e28 call 7ff693155e48 568->573 574 7ff693167c86-7ff693167cef CreateFileW 568->574 573->575 577 7ff693167d6c-7ff693167d77 GetFileType 574->577 578 7ff693167cf1-7ff693167cf7 574->578 591 7ff693167fa2-7ff693167fc2 575->591 584 7ff693167dca-7ff693167dd1 577->584 585 7ff693167d79-7ff693167db4 GetLastError call 7ff693155dbc CloseHandle 577->585 581 7ff693167d39-7ff693167d67 GetLastError call 7ff693155dbc 578->581 582 7ff693167cf9-7ff693167cfd 578->582 581->575 582->581 589 7ff693167cff-7ff693167d37 CreateFileW 582->589 587 7ff693167dd9-7ff693167ddc 584->587 588 7ff693167dd3-7ff693167dd7 584->588 585->575 598 7ff693167dba-7ff693167dc5 call 7ff693155e48 585->598 594 7ff693167de2-7ff693167e37 call 7ff693159374 587->594 595 7ff693167dde 587->595 588->594 589->577 589->581 603 7ff693167e56-7ff693167e87 call 7ff693167688 594->603 604 7ff693167e39-7ff693167e45 call 7ff693167b10 594->604 595->594 598->575 609 7ff693167e8d-7ff693167ecf 603->609 610 7ff693167e89-7ff693167e8b 603->610 604->603 611 7ff693167e47 604->611 613 7ff693167ef1-7ff693167efc 609->613 614 7ff693167ed1-7ff693167ed5 609->614 612 7ff693167e49-7ff693167e51 call 7ff69315b9c8 610->612 611->612 612->591 616 7ff693167f02-7ff693167f06 613->616 617 7ff693167fa0 613->617 614->613 615 7ff693167ed7-7ff693167eec 614->615 615->613 616->617 620 7ff693167f0c-7ff693167f51 CloseHandle CreateFileW 616->620 617->591 621 7ff693167f86-7ff693167f9b 620->621 622 7ff693167f53-7ff693167f81 GetLastError call 7ff693155dbc call 7ff69315959c 620->622 621->617 622->621
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
                                                                  • String ID:
                                                                  • API String ID: 1617910340-0
                                                                  • Opcode ID: f7d25cc6398c99507331e2d119a18c280b6cb5988aed80ed714a7f2df808d279
                                                                  • Instruction ID: 077b25b95e42195b28537942c698ecefb1e223a6f71adecb85019c737f3eb948
                                                                  • Opcode Fuzzy Hash: f7d25cc6398c99507331e2d119a18c280b6cb5988aed80ed714a7f2df808d279
                                                                  • Instruction Fuzzy Hash: 84C1C433B28A4286EB20CFA5D4925BC3769F749BA8B011275DF2EA77A5DF38D455C300
                                                                  Function 00007FF693148840 Relevance: 3.0, APIs: 2, Instructions: 29COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: Find$CloseFileFirst
                                                                  • String ID:
                                                                  • API String ID: 2295610775-0
                                                                  • Opcode ID: c8bb1e00aee5117eaed99adb2432ba14ac7573cdfbb2fa81c580c042f8a510df
                                                                  • Instruction ID: 9db1f774c6f5699fd3a66dc43ce68198395d57899684be8547f387f3364b13f5
                                                                  • Opcode Fuzzy Hash: c8bb1e00aee5117eaed99adb2432ba14ac7573cdfbb2fa81c580c042f8a510df
                                                                  • Instruction Fuzzy Hash: 8BF0C832A1864286F7B08B60B44A3667394FB8436CF004336DA6E536E4CF3CD4098B00
                                                                  Function 00007FF693161B38 Relevance: 2.0, APIs: 1, Instructions: 461COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: CurrentFeaturePresentProcessProcessor
                                                                  • String ID:
                                                                  • API String ID: 1010374628-0
                                                                  • Opcode ID: de90d4660cad73c020d10a8b6ecdb18ed9fa62073eb22c4578e43967cc91730a
                                                                  • Instruction ID: 01d462115ad1e5419a46c114510b78a76184417cee6bf1c97b8a66835b144fbe
                                                                  • Opcode Fuzzy Hash: de90d4660cad73c020d10a8b6ecdb18ed9fa62073eb22c4578e43967cc91730a
                                                                  • Instruction Fuzzy Hash: 45029C31E0DA4280FA79AB95940327D769CEF45B98F4586B5DD1EE63F2DE3CE4428304
                                                                  Function 00007FF693141000 Relevance: 61.8, APIs: 3, Strings: 32, Instructions: 527COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: ErrorFileLastModuleName
                                                                  • String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$hide-early$hide-late$minimize-early$minimize-late$pkg$pyi-contents-directory$pyi-hide-console$pyi-python-flag$pyi-runtime-tmpdir
                                                                  • API String ID: 2776309574-3325264605
                                                                  • Opcode ID: cd3ae3c9ed3c93515127a7f46fbe5956c44fe22ef922b38f02e12823f10c3f82
                                                                  • Instruction ID: 06020492402d739e1013ea8a8b6d4636c2749ae603f9c99ad1de84d2290c77bc
                                                                  • Opcode Fuzzy Hash: cd3ae3c9ed3c93515127a7f46fbe5956c44fe22ef922b38f02e12823f10c3f82
                                                                  • Instruction Fuzzy Hash: A542A021A0C68291FB359B21E41B2F97659EF54788F8444B2DA9EE32F6EF2CE555C300
                                                                  Function 00007FF693141930 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184COMMON
                                                                  Download Yara Rule

                                                                  Control-flow Graph

                                                                  • Executed
                                                                  • Not Executed
                                                                  control_flow_graph 357 7ff693141930-7ff69314196b call 7ff6931439d0 360 7ff693141971-7ff6931419b1 call 7ff6931473d0 357->360 361 7ff693141c2e-7ff693141c52 call 7ff69314bb10 357->361 366 7ff6931419b7-7ff6931419c7 call 7ff69314fc2c 360->366 367 7ff693141c1b-7ff693141c1e call 7ff69314f5a4 360->367 372 7ff6931419c9-7ff6931419e3 call 7ff693155e48 call 7ff693142020 366->372 373 7ff6931419e8-7ff693141a04 call 7ff69314f8f4 366->373 371 7ff693141c23-7ff693141c2b 367->371 371->361 372->367 379 7ff693141a06-7ff693141a20 call 7ff693155e48 call 7ff693142020 373->379 380 7ff693141a25-7ff693141a3a call 7ff693155e68 373->380 379->367 386 7ff693141a3c-7ff693141a56 call 7ff693155e48 call 7ff693142020 380->386 387 7ff693141a5b-7ff693141adc call 7ff693141c60 * 2 call 7ff69314fc2c 380->387 386->367 399 7ff693141ae1-7ff693141af4 call 7ff693155e84 387->399 402 7ff693141af6-7ff693141b10 call 7ff693155e48 call 7ff693142020 399->402 403 7ff693141b15-7ff693141b2e call 7ff69314f8f4 399->403 402->367 409 7ff693141b30-7ff693141b4a call 7ff693155e48 call 7ff693142020 403->409 410 7ff693141b4f-7ff693141b6b call 7ff69314f668 403->410 409->367 416 7ff693141b6d-7ff693141b79 call 7ff693141e50 410->416 417 7ff693141b7e-7ff693141b8c 410->417 416->367 417->367 420 7ff693141b92-7ff693141b99 417->420 423 7ff693141ba1-7ff693141ba7 420->423 424 7ff693141ba9-7ff693141bb6 423->424 425 7ff693141bc0-7ff693141bcf 423->425 426 7ff693141bd1-7ff693141bda 424->426 425->425 425->426 427 7ff693141bdc-7ff693141bdf 426->427 428 7ff693141bef 426->428 427->428 429 7ff693141be1-7ff693141be4 427->429 430 7ff693141bf1-7ff693141c04 428->430 429->428 431 7ff693141be6-7ff693141be9 429->431 432 7ff693141c06 430->432 433 7ff693141c0d-7ff693141c19 430->433 431->428 434 7ff693141beb-7ff693141bed 431->434 432->433 433->367 433->423 434->430
                                                                  APIs
                                                                    • Part of subcall function 00007FF6931473D0: _fread_nolock.LIBCMT ref: 00007FF69314747A
                                                                  • _fread_nolock.LIBCMT ref: 00007FF6931419FB
                                                                    • Part of subcall function 00007FF693142020: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF693141B4A), ref: 00007FF693142070
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: _fread_nolock$CurrentProcess
                                                                  • String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
                                                                  • API String ID: 2397952137-3497178890
                                                                  • Opcode ID: 77b5bceb95b2de1e1f0885317eeacdcfaf3677dc8f04d310bb9146bf4f5e1f65
                                                                  • Instruction ID: 5f17ad28f35fd355e00d93dc9d84fa68d340ecc8a0f5384b3d6b6ecd18aa1525
                                                                  • Opcode Fuzzy Hash: 77b5bceb95b2de1e1f0885317eeacdcfaf3677dc8f04d310bb9146bf4f5e1f65
                                                                  • Instruction Fuzzy Hash: 95818331A0C68685EB34DB64D44B2F973A9FF48788F448076D98DE77A5DE3CE5858B00
                                                                  Function 00007FF6931415E0 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145COMMON
                                                                  Download Yara Rule

                                                                  Control-flow Graph

                                                                  • Executed
                                                                  • Not Executed
                                                                  control_flow_graph 435 7ff6931415e0-7ff6931415f1 436 7ff693141617-7ff693141631 call 7ff6931439d0 435->436 437 7ff6931415f3-7ff6931415fc call 7ff693141030 435->437 442 7ff693141633-7ff693141661 call 7ff693155e48 call 7ff693142020 436->442 443 7ff693141662-7ff69314167c call 7ff6931439d0 436->443 444 7ff69314160e-7ff693141616 437->444 445 7ff6931415fe-7ff693141609 call 7ff693141e50 437->445 452 7ff693141698-7ff6931416af call 7ff69314fc2c 443->452 453 7ff69314167e-7ff693141693 call 7ff693141e50 443->453 445->444 460 7ff6931416d9-7ff6931416dd 452->460 461 7ff6931416b1-7ff6931416d4 call 7ff693155e48 call 7ff693142020 452->461 459 7ff693141801-7ff693141804 call 7ff69314f5a4 453->459 469 7ff693141809-7ff69314181b 459->469 462 7ff6931416f7-7ff693141717 call 7ff693155e84 460->462 463 7ff6931416df-7ff6931416eb call 7ff6931411f0 460->463 474 7ff6931417f9-7ff6931417fc call 7ff69314f5a4 461->474 475 7ff693141719-7ff69314173c call 7ff693155e48 call 7ff693142020 462->475 476 7ff693141741-7ff69314174c 462->476 471 7ff6931416f0-7ff6931416f2 463->471 471->474 474->459 488 7ff6931417ef-7ff6931417f4 475->488 477 7ff6931417e2-7ff6931417ea call 7ff693155e70 476->477 478 7ff693141752-7ff693141757 476->478 477->488 481 7ff693141760-7ff693141782 call 7ff69314f8f4 478->481 490 7ff6931417ba-7ff6931417c6 call 7ff693155e48 481->490 491 7ff693141784-7ff69314179c call 7ff693150034 481->491 488->474 498 7ff6931417cd-7ff6931417d8 call 7ff693142020 490->498 496 7ff69314179e-7ff6931417a1 491->496 497 7ff6931417a5-7ff6931417b8 call 7ff693155e48 491->497 496->481 500 7ff6931417a3 496->500 497->498 503 7ff6931417dd 498->503 500->503 503->477
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: CurrentProcess
                                                                  • String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
                                                                  • API String ID: 2050909247-1550345328
                                                                  • Opcode ID: 8f95b05d6b4a64feb12c026889e79166f3b8a1895b82b6011afd26545709701d
                                                                  • Instruction ID: dac67ec34b7e0aca2b957ec860755f8ae29726a5f8aa5bf577083c2e02fe5f36
                                                                  • Opcode Fuzzy Hash: 8f95b05d6b4a64feb12c026889e79166f3b8a1895b82b6011afd26545709701d
                                                                  • Instruction Fuzzy Hash: 50519C31B0C64392EA34AB6195161AA7398FF4479CF8441B2EE0DA77B6DF3CE5558700
                                                                  Function 00007FF693147CA0 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116COMMON
                                                                  Download Yara Rule

                                                                  Control-flow Graph

                                                                  APIs
                                                                  • GetTempPathW.KERNEL32(FFFFFFFF,00000000,?,00007FF693143101), ref: 00007FF693147D44
                                                                  • GetCurrentProcessId.KERNEL32(?,00007FF693143101), ref: 00007FF693147D4A
                                                                  • CreateDirectoryW.KERNELBASE(?,00007FF693143101), ref: 00007FF693147D8C
                                                                    • Part of subcall function 00007FF693147E70: GetEnvironmentVariableW.KERNEL32(00007FF693142C4F), ref: 00007FF693147EA7
                                                                    • Part of subcall function 00007FF693147E70: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF693147EC9
                                                                    • Part of subcall function 00007FF693159174: _invalid_parameter_noinfo.LIBCMT ref: 00007FF69315918D
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: Environment$CreateCurrentDirectoryExpandPathProcessStringsTempVariable_invalid_parameter_noinfo
                                                                  • String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
                                                                  • API String ID: 365913792-1339014028
                                                                  • Opcode ID: ffb589f732eab392f51c917e2ec5332ba92e64a2874c8252f98761f4106046c7
                                                                  • Instruction ID: 71d44cf6788d6f8c8f5e0802d1ec7cc5cef2b3f9b324fc9bfdad21f350a3e5e4
                                                                  • Opcode Fuzzy Hash: ffb589f732eab392f51c917e2ec5332ba92e64a2874c8252f98761f4106046c7
                                                                  • Instruction Fuzzy Hash: F241C121B1968241FA30EB65985B2F9729AEF857C8F4011B1ED1EF77B6DE3CE9018300
                                                                  Function 00007FF6931411F0 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158COMMON
                                                                  Download Yara Rule

                                                                  Control-flow Graph

                                                                  • Executed
                                                                  • Not Executed
                                                                  control_flow_graph 627 7ff6931411f0-7ff69314124d call 7ff69314b340 630 7ff693141277-7ff69314128f call 7ff693155e84 627->630 631 7ff69314124f-7ff693141276 call 7ff693141e50 627->631 636 7ff693141291-7ff6931412af call 7ff693155e48 call 7ff693142020 630->636 637 7ff6931412b4-7ff6931412c4 call 7ff693155e84 630->637 649 7ff693141419-7ff69314144d call 7ff69314b020 call 7ff693155e70 * 2 636->649 643 7ff6931412e9-7ff6931412fb 637->643 644 7ff6931412c6-7ff6931412e4 call 7ff693155e48 call 7ff693142020 637->644 645 7ff693141300-7ff693141325 call 7ff69314f8f4 643->645 644->649 655 7ff69314132b-7ff693141335 call 7ff69314f668 645->655 656 7ff693141411 645->656 655->656 663 7ff69314133b-7ff693141347 655->663 656->649 665 7ff693141350-7ff693141378 call 7ff693149780 663->665 668 7ff6931413f6-7ff69314140c call 7ff693141e50 665->668 669 7ff69314137a-7ff69314137d 665->669 668->656 670 7ff6931413f1 669->670 671 7ff69314137f-7ff693141389 669->671 670->668 673 7ff69314138b-7ff693141399 call 7ff693150034 671->673 674 7ff6931413b4-7ff6931413b7 671->674 680 7ff69314139e-7ff6931413a1 673->680 675 7ff6931413b9-7ff6931413c7 call 7ff69316b0a0 674->675 676 7ff6931413ca-7ff6931413cf 674->676 675->676 676->665 679 7ff6931413d5-7ff6931413d8 676->679 684 7ff6931413ec-7ff6931413ef 679->684 685 7ff6931413da-7ff6931413dd 679->685 681 7ff6931413af-7ff6931413b2 680->681 682 7ff6931413a3-7ff6931413ad call 7ff69314f668 680->682 681->668 682->676 682->681 684->656 685->668 687 7ff6931413df-7ff6931413e7 685->687 687->645
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: CurrentProcess
                                                                  • String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
                                                                  • API String ID: 2050909247-2813020118
                                                                  • Opcode ID: 8a0332b0341f50a67e73ec307c9098d338b417508224822c74ba95814737376c
                                                                  • Instruction ID: caecc180995c88a2868fbd3dd990bd472585de48f401d466723112b343aff536
                                                                  • Opcode Fuzzy Hash: 8a0332b0341f50a67e73ec307c9098d338b417508224822c74ba95814737376c
                                                                  • Instruction Fuzzy Hash: 2C51F332A0C68281EA34AB62A4563BA7299FF84798F444175ED4DE77F6EF3CE445C700
                                                                  Function 00007FF693142A70 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61COMMON
                                                                  Download Yara Rule

                                                                  Control-flow Graph

                                                                  APIs
                                                                  • GetModuleFileNameW.KERNEL32(?,00007FF693142BC5), ref: 00007FF693142AA1
                                                                  • GetLastError.KERNEL32(?,00007FF693142BC5), ref: 00007FF693142AAB
                                                                    • Part of subcall function 00007FF693142310: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF693142AC6,?,00007FF693142BC5), ref: 00007FF693142360
                                                                    • Part of subcall function 00007FF693142310: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF693142AC6,?,00007FF693142BC5), ref: 00007FF69314241A
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: CurrentErrorFileFormatLastMessageModuleNameProcess
                                                                  • String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
                                                                  • API String ID: 4002088556-2863816727
                                                                  • Opcode ID: 093d1e49c6a3f32bbd7db28c580ca23961d52f0e240546522d41da137270d6a4
                                                                  • Instruction ID: 4d5730ae485ed87d6c43098b5b27c280b6b54bc9e91a45e0f36d06a19ce1fda6
                                                                  • Opcode Fuzzy Hash: 093d1e49c6a3f32bbd7db28c580ca23961d52f0e240546522d41da137270d6a4
                                                                  • Instruction Fuzzy Hash: C6218661B1C64281FB309B24E81B3B67259FF5838CF8042B6E55DE75F5EE2CE5458304
                                                                  Function 00007FF69315C95C Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE
                                                                  Download Yara Rule

                                                                  Control-flow Graph

                                                                  • Executed
                                                                  • Not Executed
                                                                  control_flow_graph 717 7ff69315c95c-7ff69315c982 718 7ff69315c99d-7ff69315c9a1 717->718 719 7ff69315c984-7ff69315c998 call 7ff693155e28 call 7ff693155e48 717->719 720 7ff69315cd77-7ff69315cd83 call 7ff693155e28 call 7ff693155e48 718->720 721 7ff69315c9a7-7ff69315c9ae 718->721 737 7ff69315cd8e 719->737 740 7ff69315cd89 call 7ff69315b824 720->740 721->720 723 7ff69315c9b4-7ff69315c9e2 721->723 723->720 726 7ff69315c9e8-7ff69315c9ef 723->726 729 7ff69315ca08-7ff69315ca0b 726->729 730 7ff69315c9f1-7ff69315ca03 call 7ff693155e28 call 7ff693155e48 726->730 735 7ff69315cd73-7ff69315cd75 729->735 736 7ff69315ca11-7ff69315ca17 729->736 730->740 738 7ff69315cd91-7ff69315cda8 735->738 736->735 741 7ff69315ca1d-7ff69315ca20 736->741 737->738 740->737 741->730 744 7ff69315ca22-7ff69315ca47 741->744 746 7ff69315ca7a-7ff69315ca81 744->746 747 7ff69315ca49-7ff69315ca4b 744->747 748 7ff69315ca56-7ff69315ca6d call 7ff693155e28 call 7ff693155e48 call 7ff69315b824 746->748 749 7ff69315ca83-7ff69315caab call 7ff69315e6c4 call 7ff69315b464 * 2 746->749 750 7ff69315ca4d-7ff69315ca54 747->750 751 7ff69315ca72-7ff69315ca78 747->751 779 7ff69315cc00 748->779 782 7ff69315caad-7ff69315cac3 call 7ff693155e48 call 7ff693155e28 749->782 783 7ff69315cac8-7ff69315caf3 call 7ff69315d184 749->783 750->748 750->751 752 7ff69315caf8-7ff69315cb0f 751->752 756 7ff69315cb8a-7ff69315cb94 call 7ff693164b8c 752->756 757 7ff69315cb11-7ff69315cb19 752->757 768 7ff69315cb9a-7ff69315cbaf 756->768 769 7ff69315cc1e 756->769 757->756 761 7ff69315cb1b-7ff69315cb1d 757->761 761->756 765 7ff69315cb1f-7ff69315cb35 761->765 765->756 770 7ff69315cb37-7ff69315cb43 765->770 768->769 774 7ff69315cbb1-7ff69315cbc3 GetConsoleMode 768->774 772 7ff69315cc23-7ff69315cc43 ReadFile 769->772 770->756 775 7ff69315cb45-7ff69315cb47 770->775 777 7ff69315cd3d-7ff69315cd46 GetLastError 772->777 778 7ff69315cc49-7ff69315cc51 772->778 774->769 780 7ff69315cbc5-7ff69315cbcd 774->780 775->756 781 7ff69315cb49-7ff69315cb61 775->781 787 7ff69315cd48-7ff69315cd5e call 7ff693155e48 call 7ff693155e28 777->787 788 7ff69315cd63-7ff69315cd66 777->788 778->777 784 7ff69315cc57 778->784 789 7ff69315cc03-7ff69315cc0d call 7ff69315b464 779->789 780->772 786 7ff69315cbcf-7ff69315cbf1 ReadConsoleW 780->786 781->756 790 7ff69315cb63-7ff69315cb6f 781->790 782->779 783->752 793 7ff69315cc5e-7ff69315cc73 784->793 795 7ff69315cbf3 GetLastError 786->795 796 7ff69315cc12-7ff69315cc1c 786->796 787->779 800 7ff69315cd6c-7ff69315cd6e 788->800 801 7ff69315cbf9-7ff69315cbfb call 7ff693155dbc 788->801 789->738 790->756 799 7ff69315cb71-7ff69315cb73 790->799 793->789 803 7ff69315cc75-7ff69315cc80 793->803 795->801 796->793 799->756 807 7ff69315cb75-7ff69315cb85 799->807 800->789 801->779 809 7ff69315cca7-7ff69315ccaf 803->809 810 7ff69315cc82-7ff69315cc9b call 7ff69315c574 803->810 807->756 813 7ff69315cd2b-7ff69315cd38 call 7ff69315c3b4 809->813 814 7ff69315ccb1-7ff69315ccc3 809->814 817 7ff69315cca0-7ff69315cca2 810->817 813->817 818 7ff69315ccc5 814->818 819 7ff69315cd1e-7ff69315cd26 814->819 817->789 821 7ff69315ccca-7ff69315ccd1 818->821 819->789 822 7ff69315cd0d-7ff69315cd18 821->822 823 7ff69315ccd3-7ff69315ccd7 821->823 822->819 824 7ff69315ccd9-7ff69315cce0 823->824 825 7ff69315ccf3 823->825 824->825 827 7ff69315cce2-7ff69315cce6 824->827 826 7ff69315ccf9-7ff69315cd09 825->826 826->821 828 7ff69315cd0b 826->828 827->825 829 7ff69315cce8-7ff69315ccf1 827->829 828->819 829->826
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: _invalid_parameter_noinfo
                                                                  • String ID:
                                                                  • API String ID: 3215553584-0
                                                                  • Opcode ID: e215fe86d7b0e6e2d08488d11c6944312657e99f94033e5188670243fcaba875
                                                                  • Instruction ID: f094827bf25e04ef7dafc68906379d3e7d6e51e62602943da3240c8af9a23977
                                                                  • Opcode Fuzzy Hash: e215fe86d7b0e6e2d08488d11c6944312657e99f94033e5188670243fcaba875
                                                                  • Instruction Fuzzy Hash: A1C1EF36A0CA8281E7718F1594422BE7BA8FB81BC0F5951B1DA4EE37B1DF7CE8558740
                                                                  Function 00007FF693147BB0 Relevance: 10.6, APIs: 7, Instructions: 63COMMON
                                                                  Download Yara Rule

                                                                  Control-flow Graph

                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
                                                                  • String ID:
                                                                  • API String ID: 995526605-0
                                                                  • Opcode ID: 4b16fab3d36e05ad3a3445a5c074aa8767ee98c8fbd83efe929b6b0b20bb971a
                                                                  • Instruction ID: 4262bf3b9576920eac2cd94a14a95565b68ae951e09ddad66276077748dd1f8b
                                                                  • Opcode Fuzzy Hash: 4b16fab3d36e05ad3a3445a5c074aa8767ee98c8fbd83efe929b6b0b20bb971a
                                                                  • Instruction Fuzzy Hash: 10216231A0CA8342EB209B55A44523AB3AAFF857E8F104275DAADD3AF4DF7CD4458700
                                                                  Function 00007FF6931485C0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64COMMON
                                                                  Download Yara Rule

                                                                  Control-flow Graph

                                                                  APIs
                                                                    • Part of subcall function 00007FF693147BB0: GetCurrentProcess.KERNEL32 ref: 00007FF693147BD0
                                                                    • Part of subcall function 00007FF693147BB0: OpenProcessToken.ADVAPI32 ref: 00007FF693147BE3
                                                                    • Part of subcall function 00007FF693147BB0: GetTokenInformation.KERNELBASE ref: 00007FF693147C08
                                                                    • Part of subcall function 00007FF693147BB0: GetLastError.KERNEL32 ref: 00007FF693147C12
                                                                    • Part of subcall function 00007FF693147BB0: GetTokenInformation.KERNELBASE ref: 00007FF693147C52
                                                                    • Part of subcall function 00007FF693147BB0: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF693147C6E
                                                                    • Part of subcall function 00007FF693147BB0: CloseHandle.KERNEL32 ref: 00007FF693147C86
                                                                  • LocalFree.KERNEL32(00000000,00007FF693143099), ref: 00007FF69314864C
                                                                  • LocalFree.KERNEL32 ref: 00007FF693148655
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
                                                                  • String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
                                                                  • API String ID: 6828938-1529539262
                                                                  • Opcode ID: d798866db3bd5df2efb7bc743f04e88858d4d647152387f2e8ebfd41b25b19db
                                                                  • Instruction ID: 944380ab9e78e2e5a537b912c00e52999fe1acf9bb92eaeffb348946e53a9f3b
                                                                  • Opcode Fuzzy Hash: d798866db3bd5df2efb7bc743f04e88858d4d647152387f2e8ebfd41b25b19db
                                                                  • Instruction Fuzzy Hash: 4E216231A0874681F6649B50E81A3FA7299FF88788F9440B6EA4DE37A6DF3DD944C740
                                                                  Function 00007FF69315DE60 Relevance: 6.2, APIs: 4, Instructions: 218COMMON
                                                                  Download Yara Rule

                                                                  Control-flow Graph

                                                                  • Executed
                                                                  • Not Executed
                                                                  control_flow_graph 936 7ff69315de60-7ff69315de85 937 7ff69315de8b-7ff69315de8e 936->937 938 7ff69315e153 936->938 939 7ff69315dec7-7ff69315def3 937->939 940 7ff69315de90-7ff69315dec2 call 7ff69315b758 937->940 941 7ff69315e155-7ff69315e165 938->941 943 7ff69315def5-7ff69315defc 939->943 944 7ff69315defe-7ff69315df04 939->944 940->941 943->940 943->944 946 7ff69315df06-7ff69315df0f call 7ff69315d220 944->946 947 7ff69315df14-7ff69315df29 call 7ff693164b8c 944->947 946->947 951 7ff69315e043-7ff69315e04c 947->951 952 7ff69315df2f-7ff69315df38 947->952 953 7ff69315e04e-7ff69315e054 951->953 954 7ff69315e0a0-7ff69315e0c5 WriteFile 951->954 952->951 955 7ff69315df3e-7ff69315df42 952->955 958 7ff69315e08c-7ff69315e09e call 7ff69315d918 953->958 959 7ff69315e056-7ff69315e059 953->959 956 7ff69315e0c7-7ff69315e0cd GetLastError 954->956 957 7ff69315e0d0 954->957 960 7ff69315df53-7ff69315df5e 955->960 961 7ff69315df44-7ff69315df4c call 7ff693155270 955->961 956->957 966 7ff69315e0d3 957->966 980 7ff69315e030-7ff69315e037 958->980 967 7ff69315e05b-7ff69315e05e 959->967 968 7ff69315e078-7ff69315e08a call 7ff69315db38 959->968 963 7ff69315df6f-7ff69315df84 GetConsoleMode 960->963 964 7ff69315df60-7ff69315df69 960->964 961->960 971 7ff69315df8a-7ff69315df90 963->971 972 7ff69315e03c 963->972 964->951 964->963 974 7ff69315e0d8 966->974 975 7ff69315e0e4-7ff69315e0ee 967->975 976 7ff69315e064-7ff69315e076 call 7ff69315da1c 967->976 968->980 978 7ff69315df96-7ff69315df99 971->978 979 7ff69315e019-7ff69315e02b call 7ff69315d4a0 971->979 972->951 981 7ff69315e0dd 974->981 982 7ff69315e14c-7ff69315e151 975->982 983 7ff69315e0f0-7ff69315e0f5 975->983 976->980 986 7ff69315df9b-7ff69315df9e 978->986 987 7ff69315dfa4-7ff69315dfb2 978->987 979->980 980->974 981->975 982->941 989 7ff69315e0f7-7ff69315e0fa 983->989 990 7ff69315e123-7ff69315e12d 983->990 986->981 986->987 995 7ff69315dfb4 987->995 996 7ff69315e010-7ff69315e014 987->996 991 7ff69315e0fc-7ff69315e10b 989->991 992 7ff69315e113-7ff69315e11e call 7ff693155e04 989->992 993 7ff69315e134-7ff69315e143 990->993 994 7ff69315e12f-7ff69315e132 990->994 991->992 992->990 993->982 994->938 994->993 998 7ff69315dfb8-7ff69315dfcf call 7ff693164c58 995->998 996->966 1002 7ff69315e007-7ff69315e00d GetLastError 998->1002 1003 7ff69315dfd1-7ff69315dfdd 998->1003 1002->996 1004 7ff69315dffc-7ff69315e003 1003->1004 1005 7ff69315dfdf-7ff69315dff1 call 7ff693164c58 1003->1005 1004->996 1006 7ff69315e005 1004->1006 1005->1002 1009 7ff69315dff3-7ff69315dffa 1005->1009 1006->998 1009->1004
                                                                  APIs
                                                                  • GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF69315DE4B), ref: 00007FF69315DF7C
                                                                  • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF69315DE4B), ref: 00007FF69315E007
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: ConsoleErrorLastMode
                                                                  • String ID:
                                                                  • API String ID: 953036326-0
                                                                  • Opcode ID: 25026d299ec132fa7e986de3a50f80dd4a1c565eb46710a002b358a032e27337
                                                                  • Instruction ID: ade818914669fac5ad5cafabd7d06038a9591939ea671d275edacac03127b8cc
                                                                  • Opcode Fuzzy Hash: 25026d299ec132fa7e986de3a50f80dd4a1c565eb46710a002b358a032e27337
                                                                  • Instruction Fuzzy Hash: 3291C132F1865285F7709F6594822BD3BA8EB44B88F5441B9DE0EF7AA4CF38E442D710
                                                                  Function 00007FF6931565E4 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON
                                                                  Download Yara Rule

                                                                  Control-flow Graph

                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: CloseCreateFileHandle_invalid_parameter_noinfo
                                                                  • String ID:
                                                                  • API String ID: 1279662727-0
                                                                  • Opcode ID: a7851f35165aa053145fe01894016aececa3f2381e8a001c745c02259ff3d92e
                                                                  • Instruction ID: c6101418a6dff8af604212451d34d5cf88fd629f2995815294ab20c306008877
                                                                  • Opcode Fuzzy Hash: a7851f35165aa053145fe01894016aececa3f2381e8a001c745c02259ff3d92e
                                                                  • Instruction Fuzzy Hash: 5241A232E1878283E7648B61D5123697264FB95364F10A374E69C93AE5DF6CA1E08740
                                                                  Function 00007FF69314F694 Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE
                                                                  Download Yara Rule

                                                                  Control-flow Graph

                                                                  • Executed
                                                                  • Not Executed
                                                                  control_flow_graph 1042 7ff69314f694-7ff69314f6c1 1043 7ff69314f6dd 1042->1043 1044 7ff69314f6c3-7ff69314f6c6 1042->1044 1046 7ff69314f6df-7ff69314f6f3 1043->1046 1044->1043 1045 7ff69314f6c8-7ff69314f6cb 1044->1045 1047 7ff69314f6cd-7ff69314f6d2 call 7ff693155e48 1045->1047 1048 7ff69314f6f4-7ff69314f6f7 1045->1048 1059 7ff69314f6d8 call 7ff69315b824 1047->1059 1050 7ff69314f707-7ff69314f70b 1048->1050 1051 7ff69314f6f9-7ff69314f705 1048->1051 1054 7ff69314f70d-7ff69314f717 call 7ff69316b740 1050->1054 1055 7ff69314f71f-7ff69314f722 1050->1055 1051->1050 1053 7ff69314f732-7ff69314f73b 1051->1053 1057 7ff69314f73d-7ff69314f740 1053->1057 1058 7ff69314f742 1053->1058 1054->1055 1055->1047 1056 7ff69314f724-7ff69314f730 1055->1056 1056->1047 1056->1053 1061 7ff69314f747-7ff69314f766 1057->1061 1058->1061 1059->1043 1064 7ff69314f76c-7ff69314f77a 1061->1064 1065 7ff69314f8ad-7ff69314f8b0 1061->1065 1066 7ff69314f77c-7ff69314f783 1064->1066 1067 7ff69314f7f2-7ff69314f7f7 1064->1067 1065->1046 1066->1067 1068 7ff69314f785 1066->1068 1069 7ff69314f7f9-7ff69314f805 1067->1069 1070 7ff69314f864-7ff69314f867 call 7ff69315cdac 1067->1070 1072 7ff69314f78b-7ff69314f795 1068->1072 1073 7ff69314f8d8 1068->1073 1074 7ff69314f807-7ff69314f80e 1069->1074 1075 7ff69314f811-7ff69314f817 1069->1075 1077 7ff69314f86c-7ff69314f86f 1070->1077 1078 7ff69314f79b-7ff69314f7a1 1072->1078 1079 7ff69314f8b5-7ff69314f8b9 1072->1079 1076 7ff69314f8dd-7ff69314f8e8 1073->1076 1074->1075 1075->1079 1080 7ff69314f81d-7ff69314f83a call 7ff69315b384 call 7ff69315c95c 1075->1080 1076->1046 1077->1076 1081 7ff69314f871-7ff69314f874 1077->1081 1082 7ff69314f7d9-7ff69314f7ed 1078->1082 1083 7ff69314f7a3-7ff69314f7a6 1078->1083 1084 7ff69314f8bb-7ff69314f8c3 call 7ff69316b740 1079->1084 1085 7ff69314f8c8-7ff69314f8d3 call 7ff693155e48 1079->1085 1100 7ff69314f83f-7ff69314f841 1080->1100 1081->1079 1087 7ff69314f876-7ff69314f88d 1081->1087 1088 7ff69314f894-7ff69314f89f 1082->1088 1089 7ff69314f7a8-7ff69314f7ae 1083->1089 1090 7ff69314f7c4-7ff69314f7cf call 7ff693155e48 call 7ff69315b824 1083->1090 1084->1085 1085->1059 1087->1088 1088->1064 1096 7ff69314f8a5 1088->1096 1097 7ff69314f7ba-7ff69314f7bf call 7ff69316b740 1089->1097 1098 7ff69314f7b0-7ff69314f7b8 call 7ff69316b0a0 1089->1098 1108 7ff69314f7d4 1090->1108 1096->1065 1097->1090 1098->1108 1104 7ff69314f8ed-7ff69314f8f2 1100->1104 1105 7ff69314f847 1100->1105 1104->1076 1105->1073 1109 7ff69314f84d-7ff69314f862 1105->1109 1108->1082 1109->1088
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: _invalid_parameter_noinfo
                                                                  • String ID:
                                                                  • API String ID: 3215553584-0
                                                                  • Opcode ID: 141dc46c6224036006d776e19841065f05dd1418e65b387591b1a003cf84bd0f
                                                                  • Instruction ID: 27e1e26afbec4f90bb7059ce90127b5a36ea01c2cc150e1e24d148bea00ed68d
                                                                  • Opcode Fuzzy Hash: 141dc46c6224036006d776e19841065f05dd1418e65b387591b1a003cf84bd0f
                                                                  • Instruction Fuzzy Hash: EB513822B0928686FA349E26940A67A7289FF44BACF148770DE6DE77F5CF3CD4518700
                                                                  Function 00007FF69314C1FC Relevance: 3.1, APIs: 2, Instructions: 102COMMON
                                                                  Download Yara Rule

                                                                  Control-flow Graph

                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
                                                                  • String ID:
                                                                  • API String ID: 1236291503-0
                                                                  • Opcode ID: bbbb43f9e1356fc36a8983c03ebcc8b7addcb0e166801d8c410c30bb16f29642
                                                                  • Instruction ID: db10444e2a0d90b4f1faed767595163132697c13c7e0237d4db5e842fefb0620
                                                                  • Opcode Fuzzy Hash: bbbb43f9e1356fc36a8983c03ebcc8b7addcb0e166801d8c410c30bb16f29642
                                                                  • Instruction Fuzzy Hash: 6E318F25E0C14352FA34ABA5A15B3B93399EF48788F4450B5E94DF76F3DE6DB8048305
                                                                  Function 00007FF69315D318 Relevance: 3.1, APIs: 2, Instructions: 71COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: FileHandleType
                                                                  • String ID:
                                                                  • API String ID: 3000768030-0
                                                                  • Opcode ID: b01a8b1655aeb6f71db35254c5ecf6a703e147159c44eee076082fbba724bcfb
                                                                  • Instruction ID: c6409015d30c0201f883025e13f929d8102f8e6508d96fbd7f178d23ed9d056c
                                                                  • Opcode Fuzzy Hash: b01a8b1655aeb6f71db35254c5ecf6a703e147159c44eee076082fbba724bcfb
                                                                  • Instruction Fuzzy Hash: A8319561A28B4681D7B08B1585811797654FB55BB0F6413B9DBAEE73F0CF38E451D300
                                                                  Function 00007FF69315D034 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF69315D020,?,?,?,?,?,00007FF69315D129), ref: 00007FF69315D080
                                                                  • GetLastError.KERNEL32(?,?,?,?,?,00007FF69315D020,?,?,?,?,?,00007FF69315D129), ref: 00007FF69315D08A
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: ErrorFileLastPointer
                                                                  • String ID:
                                                                  • API String ID: 2976181284-0
                                                                  • Opcode ID: fb6a81950565da05b050a92576ed7c02e19ce8787ed1f1a96796d90f6b6408b2
                                                                  • Instruction ID: b232c86fb1ca3826c25559ab381b46f79d37f639e3ea5398ce6098ddf3f8b5ef
                                                                  • Opcode Fuzzy Hash: fb6a81950565da05b050a92576ed7c02e19ce8787ed1f1a96796d90f6b6408b2
                                                                  • Instruction Fuzzy Hash: 06110162A18B8281DA208B25B441069B365EB40FF4F540371EE7EDB7F8CF3CD0558704
                                                                  Function 00007FF69315B464 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • RtlFreeHeap.NTDLL(?,?,?,00007FF693163F92,?,?,?,00007FF693163FCF,?,?,00000000,00007FF693164495,?,?,?,00007FF6931643C7), ref: 00007FF69315B47A
                                                                  • GetLastError.KERNEL32(?,?,?,00007FF693163F92,?,?,?,00007FF693163FCF,?,?,00000000,00007FF693164495,?,?,?,00007FF6931643C7), ref: 00007FF69315B484
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: ErrorFreeHeapLast
                                                                  • String ID:
                                                                  • API String ID: 485612231-0
                                                                  • Opcode ID: bcb6ed366288f57e679071cac10841f4f6d99062b1a4c36b0c72b5ea8c3cbe48
                                                                  • Instruction ID: 7f1db63480a70bfb8228ace1e5e31c508b4d9fc806999f6812e0d51eec9956a7
                                                                  • Opcode Fuzzy Hash: bcb6ed366288f57e679071cac10841f4f6d99062b1a4c36b0c72b5ea8c3cbe48
                                                                  • Instruction Fuzzy Hash: B8E0EC61F09A4282FF396BF2984717831A9EF88741F4485B4D90EE6272DF2C68958310
                                                                  Function 00007FF69315BA60 Relevance: 2.6, APIs: 2, Instructions: 59COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • CloseHandle.KERNELBASE(?,?,?,00007FF69315B8DD,?,?,00000000,00007FF69315B992), ref: 00007FF69315BACE
                                                                  • GetLastError.KERNEL32(?,?,?,00007FF69315B8DD,?,?,00000000,00007FF69315B992), ref: 00007FF69315BAD8
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: CloseErrorHandleLast
                                                                  • String ID:
                                                                  • API String ID: 918212764-0
                                                                  • Opcode ID: ee1f6f2c17bcac9912aebe9a75d3c59e1af1689cfc13c1c78b5a219ca8e97850
                                                                  • Instruction ID: 077627bf2730011bd105e6a5c4bafca39527719749e14a42c4d381f2a6520046
                                                                  • Opcode Fuzzy Hash: ee1f6f2c17bcac9912aebe9a75d3c59e1af1689cfc13c1c78b5a219ca8e97850
                                                                  • Instruction Fuzzy Hash: AB210A20F0D68241FE705761A4932BD36CAEF847A4F4492B5EA2EE77F1DE6CE4858301
                                                                  Function 00007FF69315CDAC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: _invalid_parameter_noinfo
                                                                  • String ID:
                                                                  • API String ID: 3215553584-0
                                                                  • Opcode ID: cf3d959f73a155a0d737dce44897d7a2acb78217b54b69b3c35a670fde34ce7f
                                                                  • Instruction ID: 4bf7a652f21fdf8d50ba15ead130dc235e550dfaca6933815a5622765ea64a0e
                                                                  • Opcode Fuzzy Hash: cf3d959f73a155a0d737dce44897d7a2acb78217b54b69b3c35a670fde34ce7f
                                                                  • Instruction Fuzzy Hash: 7E41F33694824287EA74CF19E54227D7BA8EB55B84F100171EA8EE3AE0CF7DE442C791
                                                                  Function 00007FF6931473D0 Relevance: 1.6, APIs: 1, Instructions: 85COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: _fread_nolock
                                                                  • String ID:
                                                                  • API String ID: 840049012-0
                                                                  • Opcode ID: fc3bf027eb3f861870c612c146644541cbcda1c53177062a94ffaef22df04a2d
                                                                  • Instruction ID: 1becd13beb4e47b4161862a513f79a9a06992ee8aab36e88fa66baf5000552cd
                                                                  • Opcode Fuzzy Hash: fc3bf027eb3f861870c612c146644541cbcda1c53177062a94ffaef22df04a2d
                                                                  • Instruction Fuzzy Hash: 5D219621B0869246FA309B12750A3BABA4AFF45BDCF8C44B0DD9D97796CE7CE442C300
                                                                  Function 00007FF69315C83C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: _invalid_parameter_noinfo
                                                                  • String ID:
                                                                  • API String ID: 3215553584-0
                                                                  • Opcode ID: 91dc31986c532176c65ca0e3ff35a3bba52d03db3277bf6d72548c5eb48738d3
                                                                  • Instruction ID: 7b16d6da00fc9a701195689b6d0345155008efb37374f20405ae156c16eb28a2
                                                                  • Opcode Fuzzy Hash: 91dc31986c532176c65ca0e3ff35a3bba52d03db3277bf6d72548c5eb48738d3
                                                                  • Instruction Fuzzy Hash: 1531AC36A1C60285E7216F15C8423BC7A98EF44BA0F4101B5EA2EE73F2DFBCE4518319
                                                                  Function 00007FF693156F54 Relevance: 1.6, APIs: 1, Instructions: 55COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: _invalid_parameter_noinfo
                                                                  • String ID:
                                                                  • API String ID: 3215553584-0
                                                                  • Opcode ID: 0e1df9a836e05c53306103cf914f9f5afd0b17d2d4247778ac0f8a736a470cc7
                                                                  • Instruction ID: 081ddff92e3eb7241768803b6212e99cd17c5fa59379368b1f48bc52122f8aef
                                                                  • Opcode Fuzzy Hash: 0e1df9a836e05c53306103cf914f9f5afd0b17d2d4247778ac0f8a736a470cc7
                                                                  • Instruction Fuzzy Hash: E2117222A1D64182EA719F51D41227EB2A8FF85B80F445071EB4DF7BB6CF7CD8618780
                                                                  Function 00007FF6931675C4 Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: _invalid_parameter_noinfo
                                                                  • String ID:
                                                                  • API String ID: 3215553584-0
                                                                  • Opcode ID: 705a0604598582430d769309be7d52bb613e0b4e097a3a0cc12fb03a34ef158b
                                                                  • Instruction ID: d669f7aeecfbfe01ec9724eb0aecdb52bf0f9d089fef8d01e7542fb23b496058
                                                                  • Opcode Fuzzy Hash: 705a0604598582430d769309be7d52bb613e0b4e097a3a0cc12fb03a34ef158b
                                                                  • Instruction Fuzzy Hash: 7621A732618A8287EB718F58E44237976A5EB84B98F144274E65DD76E5DF3CD4408B00
                                                                  Function 00007FF69314F914 Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: _invalid_parameter_noinfo
                                                                  • String ID:
                                                                  • API String ID: 3215553584-0
                                                                  • Opcode ID: 43297e0cb54a728217cf8f13d9f8c23c45e2da10c33361e46a2ef0799771412d
                                                                  • Instruction ID: ea1460523c32e2a85e7081d995a85ec2f735b540576ededbf674a752314a60ad
                                                                  • Opcode Fuzzy Hash: 43297e0cb54a728217cf8f13d9f8c23c45e2da10c33361e46a2ef0799771412d
                                                                  • Instruction Fuzzy Hash: 0201C821A0874140E924DB529806079B798FF55FE4F0C8671EE6CB3BE6DE3CD4018300
                                                                  Function 00007FF693158E38 Relevance: 1.5, APIs: 1, Instructions: 43COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: _invalid_parameter_noinfo
                                                                  • String ID:
                                                                  • API String ID: 3215553584-0
                                                                  • Opcode ID: 1708b530f5072f472fe09baedec27f5756de37f3e343805e4a7815c0544b33da
                                                                  • Instruction ID: fdb6f6acf9a1b3235c1069add471ac58df7722a4c6dc284c11d067c2c4d2bffb
                                                                  • Opcode Fuzzy Hash: 1708b530f5072f472fe09baedec27f5756de37f3e343805e4a7815c0544b33da
                                                                  • Instruction Fuzzy Hash: 9601A920F4D64280FE706B62660323A71ACEF04794F0446B6EA1DF26F6CF3CA8614316
                                                                  Function 00007FF69314C3DC Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF69314C3F0
                                                                    • Part of subcall function 00007FF69314CE18: __vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00007FF69314CE20
                                                                    • Part of subcall function 00007FF69314CE18: __vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00007FF69314CE25
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: __scrt_dllmain_crt_thread_attach__vcrt_uninitialize_locks__vcrt_uninitialize_ptd
                                                                  • String ID:
                                                                  • API String ID: 1208906642-0
                                                                  • Opcode ID: ececd82fc3177ae58a022cdb863293519d79894eaec9217f5cc72d6a823b184f
                                                                  • Instruction ID: b29c3d14726f45aa23192b9513cec491887b987936d74ecc64dbdfe11aebec4c
                                                                  • Opcode Fuzzy Hash: ececd82fc3177ae58a022cdb863293519d79894eaec9217f5cc72d6a823b184f
                                                                  • Instruction Fuzzy Hash: 6CE0B658D0D243A1FEB42661259F2BA368CDF2534CF4054F4D98EF31B3AE0D34571665
                                                                  Function 00007FF693159174 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: _invalid_parameter_noinfo
                                                                  • String ID:
                                                                  • API String ID: 3215553584-0
                                                                  • Opcode ID: ca4321753697ca9e26add91f4c87d6fa1af88743aafd66e8485bee4c71de2195
                                                                  • Instruction ID: b45e1b19339ceae39081b3fae7a1a1750255108885c7f4a255a5e4c2108441c5
                                                                  • Opcode Fuzzy Hash: ca4321753697ca9e26add91f4c87d6fa1af88743aafd66e8485bee4c71de2195
                                                                  • Instruction Fuzzy Hash: 63E0E262E082178BFB353BE049C71B87199CF18350F5460F4DA19E62E3DE2D6C956726
                                                                  Function 00007FF69315FE04 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • HeapAlloc.KERNEL32(?,?,00000000,00007FF69315C22A,?,?,?,00007FF693155E51,?,?,?,?,00007FF69315B392), ref: 00007FF69315FE59
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: AllocHeap
                                                                  • String ID:
                                                                  • API String ID: 4292702814-0
                                                                  • Opcode ID: e5baedaef9e1aefb999d7e678a491e2cb8f7af630fb86e3f47b81283e20e243b
                                                                  • Instruction ID: 19fb10a8c8832a98f9e65874f3501ec16df7424dcb31f19e8dd51c8a2d5a4ca8
                                                                  • Opcode Fuzzy Hash: e5baedaef9e1aefb999d7e678a491e2cb8f7af630fb86e3f47b81283e20e243b
                                                                  • Instruction Fuzzy Hash: 05F06D54B99307C5FE755BA2A9173B5729CDF89B80F0954B0C90EEA3F2EE1CE5A18310
                                                                  Function 00007FF69315E6C4 Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • HeapAlloc.KERNEL32(?,?,?,00007FF693150268,?,?,?,00007FF6931518D2,?,?,?,?,?,00007FF693154595), ref: 00007FF69315E702
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: AllocHeap
                                                                  • String ID:
                                                                  • API String ID: 4292702814-0
                                                                  • Opcode ID: c4f21c11c5720e62b677d9e99b1ce174dfbed18f849e52640c9a6f6ea7657029
                                                                  • Instruction ID: 3e85b7747bdc830393ccc22b0b4035b5ba30eb353c5fe97d6b5dedcfad8384fa
                                                                  • Opcode Fuzzy Hash: c4f21c11c5720e62b677d9e99b1ce174dfbed18f849e52640c9a6f6ea7657029
                                                                  • Instruction Fuzzy Hash: D6F08215F1D20245FE782BA159032B53189DF447A0F0806B0DD3EE62E1DE1CE4409720

                                                                  Non-executed Functions

                                                                  Function 00007FF693144C40 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetProcAddress.KERNEL32(?,00007FF69314590F,00000000,00007FF69314272E), ref: 00007FF693144C50
                                                                  • GetLastError.KERNEL32(?,00007FF69314590F,00000000,00007FF69314272E), ref: 00007FF693144C62
                                                                  • GetProcAddress.KERNEL32(?,00007FF69314590F,00000000,00007FF69314272E), ref: 00007FF693144C99
                                                                  • GetLastError.KERNEL32(?,00007FF69314590F,00000000,00007FF69314272E), ref: 00007FF693144CAB
                                                                  • GetProcAddress.KERNEL32(?,00007FF69314590F,00000000,00007FF69314272E), ref: 00007FF693144CC4
                                                                  • GetLastError.KERNEL32(?,00007FF69314590F,00000000,00007FF69314272E), ref: 00007FF693144CD6
                                                                  • GetProcAddress.KERNEL32(?,00007FF69314590F,00000000,00007FF69314272E), ref: 00007FF693144CEF
                                                                  • GetLastError.KERNEL32(?,00007FF69314590F,00000000,00007FF69314272E), ref: 00007FF693144D01
                                                                  • GetProcAddress.KERNEL32(?,00007FF69314590F,00000000,00007FF69314272E), ref: 00007FF693144D1D
                                                                  • GetLastError.KERNEL32(?,00007FF69314590F,00000000,00007FF69314272E), ref: 00007FF693144D2F
                                                                  • GetProcAddress.KERNEL32(?,00007FF69314590F,00000000,00007FF69314272E), ref: 00007FF693144D4B
                                                                  • GetLastError.KERNEL32(?,00007FF69314590F,00000000,00007FF69314272E), ref: 00007FF693144D5D
                                                                  • GetProcAddress.KERNEL32(?,00007FF69314590F,00000000,00007FF69314272E), ref: 00007FF693144D79
                                                                  • GetLastError.KERNEL32(?,00007FF69314590F,00000000,00007FF69314272E), ref: 00007FF693144D8B
                                                                  • GetProcAddress.KERNEL32(?,00007FF69314590F,00000000,00007FF69314272E), ref: 00007FF693144DA7
                                                                  • GetLastError.KERNEL32(?,00007FF69314590F,00000000,00007FF69314272E), ref: 00007FF693144DB9
                                                                  • GetProcAddress.KERNEL32(?,00007FF69314590F,00000000,00007FF69314272E), ref: 00007FF693144DD5
                                                                  • GetLastError.KERNEL32(?,00007FF69314590F,00000000,00007FF69314272E), ref: 00007FF693144DE7
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: AddressErrorLastProc
                                                                  • String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
                                                                  • API String ID: 199729137-653951865
                                                                  • Opcode ID: 91fe38e706475bc85e8e17d1603b2dd44d209342b91b11e5c33006422c226cfa
                                                                  • Instruction ID: 398af80f64d9943f7b18e0e4a2cfb30148419947c174b29fc558fb1187659b3d
                                                                  • Opcode Fuzzy Hash: 91fe38e706475bc85e8e17d1603b2dd44d209342b91b11e5c33006422c226cfa
                                                                  • Instruction Fuzzy Hash: 6622BE7490DF0791FA349BA5A85A17433ACFF4878DF8856B5D80EA2274EF3CB489C215
                                                                  Function 00007FF69316531C Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
                                                                  • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                                                  • API String ID: 808467561-2761157908
                                                                  • Opcode ID: d700f69ad9a83803b0d0e637264b1b7e22121a30603610bb88393cfb8a3bc4ed
                                                                  • Instruction ID: 7e6b897e7943f98c0acf0a8923683ac2a8fb978eadcad523129bbcd3ce94123f
                                                                  • Opcode Fuzzy Hash: d700f69ad9a83803b0d0e637264b1b7e22121a30603610bb88393cfb8a3bc4ed
                                                                  • Instruction Fuzzy Hash: A7B2E272E182828BE7348FA5D4467FD77A9FB5438CF505175DA0EA7AA4DF38A900CB40
                                                                  Function 00007FF693147800 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89fileCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
                                                                  • String ID: %s\*
                                                                  • API String ID: 1057558799-766152087
                                                                  • Opcode ID: 33e10a2293b6f66987fc751628de3762a02ba3a339ba911e57677f2f560f8a7f
                                                                  • Instruction ID: c3d673917fbb2bc94331624bdfec6445a66aafd36ac0190e0a3fbbcefce7d039
                                                                  • Opcode Fuzzy Hash: 33e10a2293b6f66987fc751628de3762a02ba3a339ba911e57677f2f560f8a7f
                                                                  • Instruction Fuzzy Hash: 57415731A0C94382EA309B65E44A1BD7369FB94768F5006B6D5ADE36F4DF3CD546C700
                                                                  Function 00007FF69314A26D Relevance: 12.0, Strings: 9, Instructions: 744COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
                                                                  • API String ID: 0-2665694366
                                                                  • Opcode ID: 4827148dd37d06b9a23a2cb7d22b3f776e5342dd5831b168843cb21776e0705c
                                                                  • Instruction ID: 928f720367852dc73a07a602330e4267cfecbaf222f99fd5a08e129b46ba0767
                                                                  • Opcode Fuzzy Hash: 4827148dd37d06b9a23a2cb7d22b3f776e5342dd5831b168843cb21776e0705c
                                                                  • Instruction Fuzzy Hash: F952F572A146A68BE7A48F14C49DB7E3BADFB44344F064179E64AA7790DF3CD840CB41
                                                                  Function 00007FF69314C6FC Relevance: 10.6, APIs: 7, Instructions: 71COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                  • String ID:
                                                                  • API String ID: 3140674995-0
                                                                  • Opcode ID: 89357c2c4ffda8ae13225540be7c458f51fcd4783b393db7419e501aec0a0031
                                                                  • Instruction ID: dffb818ab332a768ac9351cf52ed8604998c3c4cfcbbe88b84ba3f202e6b9133
                                                                  • Opcode Fuzzy Hash: 89357c2c4ffda8ae13225540be7c458f51fcd4783b393db7419e501aec0a0031
                                                                  • Instruction Fuzzy Hash: 79318176609B8186EB709FA1E8813ED7368FB84748F44403ADA4E97BA4DF7CC248C700
                                                                  Function 00007FF693166E70 Relevance: 9.3, APIs: 6, Instructions: 334timeCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • _get_daylight.LIBCMT ref: 00007FF693166EB5
                                                                    • Part of subcall function 00007FF693166808: _invalid_parameter_noinfo.LIBCMT ref: 00007FF69316681C
                                                                    • Part of subcall function 00007FF69315B464: RtlFreeHeap.NTDLL(?,?,?,00007FF693163F92,?,?,?,00007FF693163FCF,?,?,00000000,00007FF693164495,?,?,?,00007FF6931643C7), ref: 00007FF69315B47A
                                                                    • Part of subcall function 00007FF69315B464: GetLastError.KERNEL32(?,?,?,00007FF693163F92,?,?,?,00007FF693163FCF,?,?,00000000,00007FF693164495,?,?,?,00007FF6931643C7), ref: 00007FF69315B484
                                                                    • Part of subcall function 00007FF69315B844: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF69315B823,?,?,?,?,?,00007FF69315B70E), ref: 00007FF69315B84D
                                                                    • Part of subcall function 00007FF69315B844: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF69315B823,?,?,?,?,?,00007FF69315B70E), ref: 00007FF69315B872
                                                                  • _get_daylight.LIBCMT ref: 00007FF693166EA4
                                                                    • Part of subcall function 00007FF693166868: _invalid_parameter_noinfo.LIBCMT ref: 00007FF69316687C
                                                                  • _get_daylight.LIBCMT ref: 00007FF69316711A
                                                                  • _get_daylight.LIBCMT ref: 00007FF69316712B
                                                                  • _get_daylight.LIBCMT ref: 00007FF69316713C
                                                                  • GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF69316737C), ref: 00007FF693167163
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
                                                                  • String ID:
                                                                  • API String ID: 4070488512-0
                                                                  • Opcode ID: 1cc6d2bc0113d7e20a77d6be4757883c424c8a6b3909b765b0ec1a4afa43a119
                                                                  • Instruction ID: 8f3745a5f1254166948549ce50062fe5012344676bd1a68a749c5047ce236c94
                                                                  • Opcode Fuzzy Hash: 1cc6d2bc0113d7e20a77d6be4757883c424c8a6b3909b765b0ec1a4afa43a119
                                                                  • Instruction Fuzzy Hash: 38D1D136A0864286EB30DF66D8521B977A9FF84798F408176EA0DE77A6DF3CE441C340
                                                                  Function 00007FF69315B558 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                                                  • String ID:
                                                                  • API String ID: 1239891234-0
                                                                  • Opcode ID: 2c2a6f2487acec397f330098253e2a7329acffa396285c7b3dfee245a17751bc
                                                                  • Instruction ID: 9f5acbd250cad876fb52355c1c030a5a7e44de352e0ca220ced08d981df68596
                                                                  • Opcode Fuzzy Hash: 2c2a6f2487acec397f330098253e2a7329acffa396285c7b3dfee245a17751bc
                                                                  • Instruction Fuzzy Hash: ED318236608F8186DB70CF65E8412AE73A8FB88758F544176EA9D93BA8DF3CC145CB00
                                                                  Function 00007FF693162AE4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: FileFindFirst_invalid_parameter_noinfo
                                                                  • String ID:
                                                                  • API String ID: 2227656907-0
                                                                  • Opcode ID: ccac9e585c27fa031d1f88e05c20b38684cf4203d2ca8c6846fc05bcbc68a6e8
                                                                  • Instruction ID: 3eee9d7ccfa22d7eb6bccafa082fa3c9b63aff623378b58aaeec4a561bb58f41
                                                                  • Opcode Fuzzy Hash: ccac9e585c27fa031d1f88e05c20b38684cf4203d2ca8c6846fc05bcbc68a6e8
                                                                  • Instruction Fuzzy Hash: 0DB1B732B1869281EB709BA598062BD7399EB44BD8F445172DE5EA7BE5DF3CE442C300
                                                                  Function 00007FF6931670EC Relevance: 6.1, APIs: 4, Instructions: 143timeCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • _get_daylight.LIBCMT ref: 00007FF69316711A
                                                                    • Part of subcall function 00007FF693166868: _invalid_parameter_noinfo.LIBCMT ref: 00007FF69316687C
                                                                  • _get_daylight.LIBCMT ref: 00007FF69316712B
                                                                    • Part of subcall function 00007FF693166808: _invalid_parameter_noinfo.LIBCMT ref: 00007FF69316681C
                                                                  • _get_daylight.LIBCMT ref: 00007FF69316713C
                                                                    • Part of subcall function 00007FF693166838: _invalid_parameter_noinfo.LIBCMT ref: 00007FF69316684C
                                                                    • Part of subcall function 00007FF69315B464: RtlFreeHeap.NTDLL(?,?,?,00007FF693163F92,?,?,?,00007FF693163FCF,?,?,00000000,00007FF693164495,?,?,?,00007FF6931643C7), ref: 00007FF69315B47A
                                                                    • Part of subcall function 00007FF69315B464: GetLastError.KERNEL32(?,?,?,00007FF693163F92,?,?,?,00007FF693163FCF,?,?,00000000,00007FF693164495,?,?,?,00007FF6931643C7), ref: 00007FF69315B484
                                                                  • GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF69316737C), ref: 00007FF693167163
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
                                                                  • String ID:
                                                                  • API String ID: 3458911817-0
                                                                  • Opcode ID: fce0b41cc66c7972387442f4a259984a91ef9247f86000003104344bdc7b7ed6
                                                                  • Instruction ID: a05134316c2378ffb98389ff03b2e03ee0c8955c7829260cd17d8f5852ea9fb7
                                                                  • Opcode Fuzzy Hash: fce0b41cc66c7972387442f4a259984a91ef9247f86000003104344bdc7b7ed6
                                                                  • Instruction Fuzzy Hash: B2518336A0864286E730DF61D8825B97769FF88788F4051B9EA4DE37B6DF3CE4418740
                                                                  Function 00007FF69314C5E0 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                  • String ID:
                                                                  • API String ID: 2933794660-0
                                                                  • Opcode ID: d5122b7aff0e10d146bffe79506b726acaac58846df22bdc99709fd59aa8d240
                                                                  • Instruction ID: b364dd2a2d2a1ca82e1001c6a874bf099400c86898f249dae1b5caadf159b987
                                                                  • Opcode Fuzzy Hash: d5122b7aff0e10d146bffe79506b726acaac58846df22bdc99709fd59aa8d240
                                                                  • Instruction Fuzzy Hash: 26117C36B14F058AEB10CFA0E8462B833A8FB19758F040E35DA6D927B4DF7CD1548340
                                                                  Function 00007FF693164E80 Relevance: 4.8, APIs: 3, Instructions: 340COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: memcpy_s
                                                                  • String ID:
                                                                  • API String ID: 1502251526-0
                                                                  • Opcode ID: b41cb84a548d2e61bdeb7bb10330278f5fecde395d7a0ce6ff99175555b28b3c
                                                                  • Instruction ID: 0e5abe2504390090a11e0fe9f81356e35f22f400e130d263d29b46d4e25f527e
                                                                  • Opcode Fuzzy Hash: b41cb84a548d2e61bdeb7bb10330278f5fecde395d7a0ce6ff99175555b28b3c
                                                                  • Instruction Fuzzy Hash: 76C11572B1868687EB34CF99A04967AB7A5F788B88F448134DB4E93754DF3DE800CB40
                                                                  Function 00007FF693149A34 Relevance: 4.1, Strings: 3, Instructions: 398COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID: $header crc mismatch$unknown header flags set
                                                                  • API String ID: 0-1127688429
                                                                  • Opcode ID: b4bf022b898153f2a381bcd878a50a5d3c06b36ca84da26d2d0edcb3d1e551c0
                                                                  • Instruction ID: de6c4924a4b748aa1d1d438337b44605b805558b977275597f71cce0aedff9a2
                                                                  • Opcode Fuzzy Hash: b4bf022b898153f2a381bcd878a50a5d3c06b36ca84da26d2d0edcb3d1e551c0
                                                                  • Instruction Fuzzy Hash: 10F18272A183D54AE7B58F15C48DA3E7AEEEF44748F0645B8DA49A77A0CF38E940C740
                                                                  Function 00007FF69316A998 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: ExceptionRaise_clrfp
                                                                  • String ID:
                                                                  • API String ID: 15204871-0
                                                                  • Opcode ID: e29282b711dd5704c0e64fe7638cddbeeb7149a3015151b68882fd3146651568
                                                                  • Instruction ID: 228ef5895e5342a5887e29ca6d2bd2064d53cd7b4991fc8ee087b087e3272a6e
                                                                  • Opcode Fuzzy Hash: e29282b711dd5704c0e64fe7638cddbeeb7149a3015151b68882fd3146651568
                                                                  • Instruction Fuzzy Hash: 84B179B3A00B888BEB25CF29C8863687BA4F744B4CF198866DA5D837B4CF39D451C701
                                                                  Function 00007FF693154450 Relevance: 2.8, Strings: 2, Instructions: 350COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID: $
                                                                  • API String ID: 0-227171996
                                                                  • Opcode ID: 5ebab5a2817f928350dc9776a3da4b540f16bc97e78530f340af468d76ff9f5e
                                                                  • Instruction ID: f807608f048f5ce1ebbdfbe5757e9bac0ff22fed3b63231763f0b722cc83b725
                                                                  • Opcode Fuzzy Hash: 5ebab5a2817f928350dc9776a3da4b540f16bc97e78530f340af468d76ff9f5e
                                                                  • Instruction Fuzzy Hash: BCE1D336A1C64682EB788F29805217E33A8FF45B48F244275DA4EE77B4DF39E851C748
                                                                  Function 00007FF69314989B Relevance: 2.7, Strings: 2, Instructions: 216COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID: incorrect header check$invalid window size
                                                                  • API String ID: 0-900081337
                                                                  • Opcode ID: 8c4c8a6a705a7cf803fa5291bdc529627e531fe0bdcc095ab807ab19af6e2c49
                                                                  • Instruction ID: 7c91cafb01652eb9d31033789248f05f134ecd9a252b84fd3a5bda200c574f13
                                                                  • Opcode Fuzzy Hash: 8c4c8a6a705a7cf803fa5291bdc529627e531fe0bdcc095ab807ab19af6e2c49
                                                                  • Instruction Fuzzy Hash: 06918672A183C647E7B48A15C49DA3E3AADFF44358F114179DA4AA76A4DF38E540CB01
                                                                  Function 00007FF69315EFB8 Relevance: 2.6, Strings: 2, Instructions: 144COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID: e+000$gfff
                                                                  • API String ID: 0-3030954782
                                                                  • Opcode ID: ab39e04084c8b9065030c447a5361eb1aff85978d5a2f70618a83e2e92251626
                                                                  • Instruction ID: 3d7d27237e5f4adc1c6fcd2bf2fdaf13370530b34959dc6722518fec0d9ade0d
                                                                  • Opcode Fuzzy Hash: ab39e04084c8b9065030c447a5361eb1aff85978d5a2f70618a83e2e92251626
                                                                  • Instruction Fuzzy Hash: CA512423B187C586E7348B35D8427697B99E744B94F4882B1CAA8D7AE5CF3DD4458700
                                                                  Function 00007FF69315EB24 Relevance: 1.5, Strings: 1, Instructions: 254COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID: gfffffff
                                                                  • API String ID: 0-1523873471
                                                                  • Opcode ID: 1e22957b1159dd03df7ccd337d5a67203babfefd7ac1e182ea12ea91d3eef3d6
                                                                  • Instruction ID: 504a050e58866d176dace0b0ab305cf46d0616c2e8edaa5d145e42902cdbe12d
                                                                  • Opcode Fuzzy Hash: 1e22957b1159dd03df7ccd337d5a67203babfefd7ac1e182ea12ea91d3eef3d6
                                                                  • Instruction Fuzzy Hash: 05A16262E087C686EB31CF29A4017EA7B99EB60B84F008072DE8DD77A1DE3DE401D711
                                                                  Function 00007FF6931596D0 Relevance: 1.4, Strings: 1, Instructions: 177COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: _invalid_parameter_noinfo
                                                                  • String ID: TMP
                                                                  • API String ID: 3215553584-3125297090
                                                                  • Opcode ID: 8bb90b96481c3bc34baff152e4670fba6cb89323cf5fbd9ccfba4520d43ca801
                                                                  • Instruction ID: 063b9582cdd2a40a497975adaa3e212694b04362aeeead8032bdd20cee7caccc
                                                                  • Opcode Fuzzy Hash: 8bb90b96481c3bc34baff152e4670fba6cb89323cf5fbd9ccfba4520d43ca801
                                                                  • Instruction Fuzzy Hash: 9451AF11B0864641FA78AB27991357A729AEF45BC4F4880B5DE0EE77F6EE3CE4428701
                                                                  Function 00007FF6931646F0 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: HeapProcess
                                                                  • String ID:
                                                                  • API String ID: 54951025-0
                                                                  • Opcode ID: b79ea0c05b8e708bf2e7ff1fe6aa0946c24d08db99ce40c7e012d78a6a9acfe9
                                                                  • Instruction ID: b26f572abeb70b088632680ec2340a000c50a82568d3ea16ab7142d038e31f2c
                                                                  • Opcode Fuzzy Hash: b79ea0c05b8e708bf2e7ff1fe6aa0946c24d08db99ce40c7e012d78a6a9acfe9
                                                                  • Instruction Fuzzy Hash: 0FB09220E1BA02C6EA582B926C8321432B9FF48700F9540B8C00CA1330DE2C20A65700
                                                                  Function 00007FF693153F8C Relevance: .4, Instructions: 374COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: a25825d834791a15779abc5a96815a53d20fd0a8b1de7024d724f2c7a0ffd609
                                                                  • Instruction ID: 76b18670a3e8b8325f52bd0ffa84b689311e2c6d05fead0e3f02d2f676b27f34
                                                                  • Opcode Fuzzy Hash: a25825d834791a15779abc5a96815a53d20fd0a8b1de7024d724f2c7a0ffd609
                                                                  • Instruction Fuzzy Hash: B4E1AF26A0C24286EA788B25D14617F37A9FF54B44F248275CE0DE76F8CF39E851C748
                                                                  Function 00007FF693153750 Relevance: .4, Instructions: 351COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 92f5019cce735186dcbe47a7940729bb5e8d7af8c1d6157f075a5e7b95ae45a8
                                                                  • Instruction ID: 13c6b19c6502d14f91ca0f937d1d6d910fdb4cb64e78c09a8bddee1b8a749f2c
                                                                  • Opcode Fuzzy Hash: 92f5019cce735186dcbe47a7940729bb5e8d7af8c1d6157f075a5e7b95ae45a8
                                                                  • Instruction Fuzzy Hash: C1E1F172A0860286E7798B28C15637C37A9EB45B48F148AB5CE4DE72F9DF3DE841C740
                                                                  Function 00007FF693153B88 Relevance: .3, Instructions: 327COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 86da56c12cd563bcad921fbd71c05d3fa176844b52d15b5090a52c27ad8a5c54
                                                                  • Instruction ID: 08e683f3a6078f55ca83bcb1485133208037bf51e7cf931090cd673cf63ffd29
                                                                  • Opcode Fuzzy Hash: 86da56c12cd563bcad921fbd71c05d3fa176844b52d15b5090a52c27ad8a5c54
                                                                  • Instruction Fuzzy Hash: B9D1E322A0864686EB798F29844637D37A8EF05B58F144A76DE0EE76F4CF3DE851D340
                                                                  Function 00007FF693148DC0 Relevance: .3, Instructions: 287COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 8e0142d1de63ac36c46e431d0d75baaff102e1c1a7ac2c303afc5037c5988706
                                                                  • Instruction ID: bb3b050eba8e78bbafc5abc125d9ec617f35157bca60b3329d5001ffd7b09589
                                                                  • Opcode Fuzzy Hash: 8e0142d1de63ac36c46e431d0d75baaff102e1c1a7ac2c303afc5037c5988706
                                                                  • Instruction Fuzzy Hash: 82C1B8B22141E14BD299DB29E46A57B73E1F79838DBC4803ADF8B47B85CA3CE014D711
                                                                  Function 00007FF693152420 Relevance: .2, Instructions: 250COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: b5780ef2d000dcd486574e33efb2770a379a55a34775bc5a7b80e7b31bbd7158
                                                                  • Instruction ID: 0d190da726e4d3f2ce5496192909325d53f45642e6e367987f2fb8f2f275172f
                                                                  • Opcode Fuzzy Hash: b5780ef2d000dcd486574e33efb2770a379a55a34775bc5a7b80e7b31bbd7158
                                                                  • Instruction Fuzzy Hash: C5B19E73A1868586E775CF29C05227D3BA8EB5AB48F184175CE4EE73A5CF39E842C710
                                                                  Function 00007FF6931527B8 Relevance: .2, Instructions: 241COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 56ef1490d9aa7cb50fdbcb208ea1e35327a83dacbd264ffe23c56c6782292f60
                                                                  • Instruction ID: 11690cc2e95e166216832ec4c1f520a7779ccf6b000a51fc73b9203d7d1f253d
                                                                  • Opcode Fuzzy Hash: 56ef1490d9aa7cb50fdbcb208ea1e35327a83dacbd264ffe23c56c6782292f60
                                                                  • Instruction Fuzzy Hash: 4DB18E73A0879686E7758F39C05223C3BA8E749B48F281175CA4EE77A5CF79D842C741
                                                                  Function 00007FF69315F638 Relevance: .2, Instructions: 198COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 2a05c6059b1d422c1c0961fd67960772ff2ba502e6a05041136868912dff4d23
                                                                  • Instruction ID: ea4265f84ff9e0e57d0782476137cfdc9ef05ebfeb3c32e67248b8c09079835b
                                                                  • Opcode Fuzzy Hash: 2a05c6059b1d422c1c0961fd67960772ff2ba502e6a05041136868912dff4d23
                                                                  • Instruction Fuzzy Hash: B881E372A0C78186EB74CB29A48237A7794FB49794F144279DA9DD7BA9CF3DD4408B00
                                                                  Function 00007FF693167688 Relevance: .2, Instructions: 183COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: _invalid_parameter_noinfo
                                                                  • String ID:
                                                                  • API String ID: 3215553584-0
                                                                  • Opcode ID: eef01635753a3689cfd7199ced0fb7e0b5b43189aa21453eecf28f9410e22187
                                                                  • Instruction ID: 87a5929cdf245364a24d7cf342198482bbb2ef64c0e371157df97bf8787e9e98
                                                                  • Opcode Fuzzy Hash: eef01635753a3689cfd7199ced0fb7e0b5b43189aa21453eecf28f9410e22187
                                                                  • Instruction Fuzzy Hash: 1C61F332E1C28247F7758AA8844627D768DEF40768F1452B9DA2DE6AF1EE7DEC40C700
                                                                  Function 00007FF69315132C Relevance: .1, Instructions: 146COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
                                                                  • Instruction ID: a0dcbafcc9b939208629322b834b63be3a137f6be56353c996683a1d9f234b2a
                                                                  • Opcode Fuzzy Hash: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
                                                                  • Instruction Fuzzy Hash: 4F518233A2865186EB7A8B29C05527837A4EB55B68F245171CE4DE7BB4CF3AE843C740
                                                                  Function 00007FF69315173C Relevance: .1, Instructions: 146COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
                                                                  • Instruction ID: c0891330d14c2f8b97a919ceb58506e99e59fcc40ce86da76867e1eddc95d404
                                                                  • Opcode Fuzzy Hash: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
                                                                  • Instruction Fuzzy Hash: 35518636A18A5186EB398B29C05127833A5EB45B58F244271CE4DE77B4DF3AEC43C740
                                                                  Function 00007FF693150F1C Relevance: .1, Instructions: 146COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
                                                                  • Instruction ID: e68723964ec33ca964196e5a9d908765e53e0cf8049e0ce1b207d8d46754247b
                                                                  • Opcode Fuzzy Hash: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
                                                                  • Instruction Fuzzy Hash: 2B516376A1865186EB398B29C05123837A5EB49B68F244172DE4DE77B4CF3AEC53C780
                                                                  Function 00007FF693150D18 Relevance: .1, Instructions: 145COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 3b300af1d1946d5df55db44b3d4e0876ae34829a82d49cb6751e26c04e9c1898
                                                                  • Instruction ID: 924539b5a8e18950644b0b69517c6f6d53f68dc1da77fac3b04e82ff7fc0719b
                                                                  • Opcode Fuzzy Hash: 3b300af1d1946d5df55db44b3d4e0876ae34829a82d49cb6751e26c04e9c1898
                                                                  • Instruction Fuzzy Hash: F6518136A18A5186E7348B69C84133937A9EB46B58F344171CE4DE77B4CF3AF852C740
                                                                  Function 00007FF693151128 Relevance: .1, Instructions: 145COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 7c9c7dfd85d7e05c9dc9b7e40d932aad9843605f203f1a6a08d3cc10701c718b
                                                                  • Instruction ID: cabfdb75aa11b43081251961d26fc7351bfdfa64817684829af79766e2a8270c
                                                                  • Opcode Fuzzy Hash: 7c9c7dfd85d7e05c9dc9b7e40d932aad9843605f203f1a6a08d3cc10701c718b
                                                                  • Instruction Fuzzy Hash: 14517737A1865186EB7A8B29C08163937B4EB59B58F3441B1CE4DE77B5CF3AE842C740
                                                                  Function 00007FF693151538 Relevance: .1, Instructions: 145COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 7710b6301a9c53c0f35ccf6fc131232db227f89fb6367f1206a3fe51f4b04988
                                                                  • Instruction ID: da9d15602d14fc351778333724c7cc7ce4db299706887e4b2ac73f3098d3a571
                                                                  • Opcode Fuzzy Hash: 7710b6301a9c53c0f35ccf6fc131232db227f89fb6367f1206a3fe51f4b04988
                                                                  • Instruction Fuzzy Hash: CF519676A2965186EB3A8F29C04123837A5EB45B58F284171CE4DE77B4CF3AEC43C780
                                                                  Function 00007FF693156CF0 Relevance: .1, Instructions: 138COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
                                                                  • Instruction ID: 160e848d4a3fd60033ad7c0b2b5663c0c93d6d7a39d2979428c18fbec8809215
                                                                  • Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
                                                                  • Instruction Fuzzy Hash: E241D392C4A68A44E9B5CB184D066B43698DF22BA0F5836F0CCDDF33F7CD0E25968380
                                                                  Function 00007FF69315AE20 Relevance: .1, Instructions: 126COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: ErrorFreeHeapLast
                                                                  • String ID:
                                                                  • API String ID: 485612231-0
                                                                  • Opcode ID: 7a7ebbd17873febb15e29de35626f23177de76f7dba359f1eda69606ccc1bea3
                                                                  • Instruction ID: 4eb31373f6db2cb47cfca565741c6d3a6d953b7790c2cf34a1c112934a0fc02a
                                                                  • Opcode Fuzzy Hash: 7a7ebbd17873febb15e29de35626f23177de76f7dba359f1eda69606ccc1bea3
                                                                  • Instruction Fuzzy Hash: 4C41E272714A5982EF24CF6AD956169B3A5FB48FC4B199033EE0DE7B68DE3CD4428304
                                                                  Function 00007FF693159020 Relevance: .1, Instructions: 98COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 3b4b82ba6feb1f2c625fcdd7b78fc6310e7e433b3778e25011fb45a65c2c329c
                                                                  • Instruction ID: cac45097c499085ae3afac260d6885d77c051062b5c404cda1c6f3ddbe60c7ab
                                                                  • Opcode Fuzzy Hash: 3b4b82ba6feb1f2c625fcdd7b78fc6310e7e433b3778e25011fb45a65c2c329c
                                                                  • Instruction Fuzzy Hash: 81319732718B8282E7349F26684213D769DEF84BA0F145278EA5EE3BE6DF3CD4118704
                                                                  Function 00007FF69316A7E0 Relevance: .0, Instructions: 32COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 47026fad3db46e1691e12129f37de500b9ca6af24d2cbfa86880e77cbf706e66
                                                                  • Instruction ID: d55a470563bc5bd49c9a7fe4f9fed25cafdf4673444a9e4d79c7a3dde82c2120
                                                                  • Opcode Fuzzy Hash: 47026fad3db46e1691e12129f37de500b9ca6af24d2cbfa86880e77cbf706e66
                                                                  • Instruction Fuzzy Hash: 73F068717282958ADBA4CF29A4436297BF4F7083C4F908079D58DC3B14DB7C90618F04
                                                                  Function 00007FF69314C8A0 Relevance: .0, Instructions: 2COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 0095cffb8fe81db1077c877ec2d194bac0958fa6bcac770c2119ba444bc36b37
                                                                  • Instruction ID: ff711d164eb863ac4a90aa62b4c9d642bd5a267754b2d4559913769c62c48b21
                                                                  • Opcode Fuzzy Hash: 0095cffb8fe81db1077c877ec2d194bac0958fa6bcac770c2119ba444bc36b37
                                                                  • Instruction Fuzzy Hash: 35A00165908842E0F6649B41E9560203269FB54308B4000B6E01EA20B0EF2CA400C200
                                                                  Function 00007FF693146B00 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: AddressErrorLastProc
                                                                  • String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
                                                                  • API String ID: 199729137-3427451314
                                                                  • Opcode ID: 3ce57ac688b021c07c17bb9d18c3d2db368ff9ca427b7eb3b8bd4dc412038eb8
                                                                  • Instruction ID: 89556d00871e44f2ca63324cf155adaadf1ae85c2405c4a301b19850322201ae
                                                                  • Opcode Fuzzy Hash: 3ce57ac688b021c07c17bb9d18c3d2db368ff9ca427b7eb3b8bd4dc412038eb8
                                                                  • Instruction Fuzzy Hash: 1802B178A0DF0791FA359BA5B81A57433ADFF0874CB8815B5D80EA6274EF3CB54AC201
                                                                  Function 00007FF693147610 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                    • Part of subcall function 00007FF693148950: MultiByteToWideChar.KERNEL32(?,?,?,00007FF693143A04,00000000,00007FF693141965), ref: 00007FF693148989
                                                                  • ExpandEnvironmentStringsW.KERNEL32(00000000,00007FF693147CF7,FFFFFFFF,00000000,?,00007FF693143101), ref: 00007FF69314766C
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: ByteCharEnvironmentExpandMultiStringsWide
                                                                  • String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
                                                                  • API String ID: 2001182103-930877121
                                                                  • Opcode ID: c12f537dd095d990c73456ab9bcad2fdb505f4a02d1bedcb9a56ce5ba8a3e8b7
                                                                  • Instruction ID: 048c21ab801ef22a24af54cf92b7976c23c7d5e94eefb8457b2da13a413e5f26
                                                                  • Opcode Fuzzy Hash: c12f537dd095d990c73456ab9bcad2fdb505f4a02d1bedcb9a56ce5ba8a3e8b7
                                                                  • Instruction Fuzzy Hash: F651AC21B2D64251FB709B65D95B2B9725AEF44788F8400B2DA0EE36B5EF3CE5058740
                                                                  Function 00007FF693147500 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: LongWindow$BlockCreateErrorLastReasonShutdown
                                                                  • String ID: Needs to remove its temporary files.
                                                                  • API String ID: 3975851968-2863640275
                                                                  • Opcode ID: 44e53fe94581f3919e9549e222624ce8134aca65504236f29db41f4538cf5799
                                                                  • Instruction ID: b5e0a69f3d960a846c696f3437504b536dfe039cd19f0decee95a2e6dc813b7d
                                                                  • Opcode Fuzzy Hash: 44e53fe94581f3919e9549e222624ce8134aca65504236f29db41f4538cf5799
                                                                  • Instruction Fuzzy Hash: F021AC71B08A4283E7715B7AB54A1797359FF88B98F484170DE2DDB3F4DE2CD5858200
                                                                  Function 00007FF693157250 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 493COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: _invalid_parameter_noinfo
                                                                  • String ID: -$:$f$p$p
                                                                  • API String ID: 3215553584-2013873522
                                                                  • Opcode ID: 65d4a0ffdc8e7253b8e60b637b85ac8f97459ea152ba9c8238927d2e88e0f15e
                                                                  • Instruction ID: 4e68be168cf2da8587c7445dd3357f6702238f6e8c6f3a6e59e1c01d8949e083
                                                                  • Opcode Fuzzy Hash: 65d4a0ffdc8e7253b8e60b637b85ac8f97459ea152ba9c8238927d2e88e0f15e
                                                                  • Instruction Fuzzy Hash: B712A262E0D14387FB319B14E0476B9B6A9FB40750F844176E6DAE6AE4DF3CE490CB14
                                                                  Function 00007FF6931505A0 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: _invalid_parameter_noinfo
                                                                  • String ID: f$f$p$p$f
                                                                  • API String ID: 3215553584-1325933183
                                                                  • Opcode ID: fc8e2330ab6ced16bd3d959f6bc8057a9fc686b659d09149717256120edd57c1
                                                                  • Instruction ID: f99b9a407e770bfb227cb6a2aeae1b297b70757f5b275a67cfa5303838d642b1
                                                                  • Opcode Fuzzy Hash: fc8e2330ab6ced16bd3d959f6bc8057a9fc686b659d09149717256120edd57c1
                                                                  • Instruction Fuzzy Hash: 53129066A0C18386FB309F95D0567BA7299FB42754F884075E6CEE66F8DF7CE5808B00
                                                                  Function 00007FF693141030 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: CurrentProcess
                                                                  • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                  • API String ID: 2050909247-3659356012
                                                                  • Opcode ID: 90ddfbcc42bb3451993c4de3f3e143653a39952901b54e74db9d01b6065f2f65
                                                                  • Instruction ID: b7f6ef04f996eb87f3d5f2d7f504ca0428020646a7e0287ce86f51b97581a4b4
                                                                  • Opcode Fuzzy Hash: 90ddfbcc42bb3451993c4de3f3e143653a39952901b54e74db9d01b6065f2f65
                                                                  • Instruction Fuzzy Hash: 6C416332B0C69285EA24DB61980A6B97399FF44BC8F4444B2ED0DA77B6DF3CE5058740
                                                                  Function 00007FF693141450 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: CurrentProcess
                                                                  • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                  • API String ID: 2050909247-3659356012
                                                                  • Opcode ID: 748d4c9a6b12b97768435c181e52005edca2c40070bb14b44ac01c848a5bfe4a
                                                                  • Instruction ID: 082abb0964cfe673ffb3c9542cea481adf5fd83e95bc57d5c1abc75767c71f2f
                                                                  • Opcode Fuzzy Hash: 748d4c9a6b12b97768435c181e52005edca2c40070bb14b44ac01c848a5bfe4a
                                                                  • Instruction Fuzzy Hash: FA418F32A0C68285EB24DB61D4065F97399FF4979CF4444B2ED0DABBB5DE3CE5128700
                                                                  Function 00007FF69314DF98 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                                                  • String ID: csm$csm$csm
                                                                  • API String ID: 849930591-393685449
                                                                  • Opcode ID: 7d7d5a635fcd63c536a58b816f4712f1a96a9e43b0d550c3d6dd02e630e8922c
                                                                  • Instruction ID: 2a3e07ac35afeb0c43c7c36ddf8e9f9dfa0eb15dbc14a59a0187b78e22f3e18b
                                                                  • Opcode Fuzzy Hash: 7d7d5a635fcd63c536a58b816f4712f1a96a9e43b0d550c3d6dd02e630e8922c
                                                                  • Instruction Fuzzy Hash: A7D18E32B087418AEB309B65D44A3AD77A8FB4579CF141175EE8DA7BA6DF38E081C710
                                                                  Function 00007FF69315FF7C Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • FreeLibrary.KERNEL32(?,?,?,00007FF693160316,?,?,000002662C1E5BB8,00007FF69315BC5B,?,?,?,00007FF69315BB52,?,?,?,00007FF693156EFE), ref: 00007FF6931600F8
                                                                  • GetProcAddress.KERNEL32(?,?,?,00007FF693160316,?,?,000002662C1E5BB8,00007FF69315BC5B,?,?,?,00007FF69315BB52,?,?,?,00007FF693156EFE), ref: 00007FF693160104
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: AddressFreeLibraryProc
                                                                  • String ID: api-ms-$ext-ms-
                                                                  • API String ID: 3013587201-537541572
                                                                  • Opcode ID: d956f0b8ec152b18ca11aa0aed68125bebf2684d60339ba7369f52f17a1fcfe1
                                                                  • Instruction ID: b93712ad88b3b70a3ebbe33dcbd8bc67601bd84f1f4e87386f8e806ac41374fd
                                                                  • Opcode Fuzzy Hash: d956f0b8ec152b18ca11aa0aed68125bebf2684d60339ba7369f52f17a1fcfe1
                                                                  • Instruction Fuzzy Hash: 4D41FF32B1DE0281EA35CB56A8022B53299FF08BE8F094175DD0DE77B8EE7DE4458304
                                                                  Function 00007FF693142310 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 99windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF693142AC6,?,00007FF693142BC5), ref: 00007FF693142360
                                                                  • FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF693142AC6,?,00007FF693142BC5), ref: 00007FF69314241A
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: CurrentFormatMessageProcess
                                                                  • String ID: %ls$%ls: $<FormatMessageW failed.>$[PYI-%d:ERROR]
                                                                  • API String ID: 27993502-4247535189
                                                                  • Opcode ID: 92e20a795bf73765402ca9ec7783ee5ad9f8f927f89bd5dd19570627e0bc01fb
                                                                  • Instruction ID: bc944fb27399eaef5100139790e3b148c2169f17303213db97ed25858bfcc3bb
                                                                  • Opcode Fuzzy Hash: 92e20a795bf73765402ca9ec7783ee5ad9f8f927f89bd5dd19570627e0bc01fb
                                                                  • Instruction Fuzzy Hash: 1431D372B0CA4141E6309B65B81A6EA72A9FF84BD8F400175EF4DE3A69DE3CD547C700
                                                                  Function 00007FF69314D258 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • LoadLibraryExW.KERNEL32(?,?,?,00007FF69314D50A,?,?,?,00007FF69314D1FC,?,?,?,00007FF69314CDF9), ref: 00007FF69314D2DD
                                                                  • GetLastError.KERNEL32(?,?,?,00007FF69314D50A,?,?,?,00007FF69314D1FC,?,?,?,00007FF69314CDF9), ref: 00007FF69314D2EB
                                                                  • LoadLibraryExW.KERNEL32(?,?,?,00007FF69314D50A,?,?,?,00007FF69314D1FC,?,?,?,00007FF69314CDF9), ref: 00007FF69314D315
                                                                  • FreeLibrary.KERNEL32(?,?,?,00007FF69314D50A,?,?,?,00007FF69314D1FC,?,?,?,00007FF69314CDF9), ref: 00007FF69314D383
                                                                  • GetProcAddress.KERNEL32(?,?,?,00007FF69314D50A,?,?,?,00007FF69314D1FC,?,?,?,00007FF69314CDF9), ref: 00007FF69314D38F
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: Library$Load$AddressErrorFreeLastProc
                                                                  • String ID: api-ms-
                                                                  • API String ID: 2559590344-2084034818
                                                                  • Opcode ID: ec1d8984956c5f4cef63aabdc1ab3d005d502d88db624b4fbd9ceb099b80f4f4
                                                                  • Instruction ID: 33222bbb910e59154bc52e170114d866cf6ad613b3ac127f156109796b58357e
                                                                  • Opcode Fuzzy Hash: ec1d8984956c5f4cef63aabdc1ab3d005d502d88db624b4fbd9ceb099b80f4f4
                                                                  • Instruction Fuzzy Hash: 6F31D461B1AA4291EE31DB02A80667973DCFF49BA8F4A0575DD1DE73A1EF3CE4458310
                                                                  Function 00007FF6931457A0 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: CurrentProcess
                                                                  • String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
                                                                  • API String ID: 2050909247-2434346643
                                                                  • Opcode ID: 57f2e03855a98cc957638366e02885260eb86ee0512a8128b0f554b17f515a16
                                                                  • Instruction ID: 6a790a74f9424fb5c7ace94a44911699cbf214181b679d4ad414b3e07e75e522
                                                                  • Opcode Fuzzy Hash: 57f2e03855a98cc957638366e02885260eb86ee0512a8128b0f554b17f515a16
                                                                  • Instruction Fuzzy Hash: 7941B231A1CA8791EA31DB60E40A1E97319FF4478CF804172EA5DA32E6EF3CE615C340
                                                                  Function 00007FF69315C050 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: Value$ErrorLast
                                                                  • String ID:
                                                                  • API String ID: 2506987500-0
                                                                  • Opcode ID: 6cd12d297b2340e5ffa7c7392ce0e4cdced9a85fa0896577ca3510b685e0d80d
                                                                  • Instruction ID: 441b0339a277cae4520c99d42b56e87886efe99dcbbea2df0ab75603568e151c
                                                                  • Opcode Fuzzy Hash: 6cd12d297b2340e5ffa7c7392ce0e4cdced9a85fa0896577ca3510b685e0d80d
                                                                  • Instruction Fuzzy Hash: DA21502AA0C64642FAB46B715643179728ADF487B4F1447B8D83EF76F6DE6CF8418300
                                                                  Function 00007FF693168FDC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                                                  • String ID: CONOUT$
                                                                  • API String ID: 3230265001-3130406586
                                                                  • Opcode ID: 09a7ef29c2f791f79e4b414a588c98caae924e0a86b8d7fe5631f15f3a619b4d
                                                                  • Instruction ID: f78a607fb3db7e0606d8699d263cf248465896314785be37496b4b3901b3a23d
                                                                  • Opcode Fuzzy Hash: 09a7ef29c2f791f79e4b414a588c98caae924e0a86b8d7fe5631f15f3a619b4d
                                                                  • Instruction Fuzzy Hash: 7C116031B18A4186E7608B92E85632972A8FB88BE8F144274EA5DD77B4CF7CE504C744
                                                                  Function 00007FF6931479B0 Relevance: 9.1, APIs: 6, Instructions: 127COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetCurrentProcess.KERNEL32(FFFFFFFF,?,?,00000000,00007FF693148706), ref: 00007FF6931479E2
                                                                  • K32EnumProcessModules.KERNEL32(?,?,00000000,00007FF693148706), ref: 00007FF693147A39
                                                                    • Part of subcall function 00007FF693148950: MultiByteToWideChar.KERNEL32(?,?,?,00007FF693143A04,00000000,00007FF693141965), ref: 00007FF693148989
                                                                  • K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF693148706), ref: 00007FF693147AC8
                                                                  • K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF693148706), ref: 00007FF693147B34
                                                                  • FreeLibrary.KERNEL32(?,?,00000000,00007FF693148706), ref: 00007FF693147B45
                                                                  • FreeLibrary.KERNEL32(?,?,00000000,00007FF693148706), ref: 00007FF693147B5A
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
                                                                  • String ID:
                                                                  • API String ID: 3462794448-0
                                                                  • Opcode ID: b9b63f54144ba03940088346b196338d5c2960aef7cb953cd42f14819606a153
                                                                  • Instruction ID: 866e4826669661dc0f7a138aee3706c9dc032c9c89bc8a3bc996e7513bc177f5
                                                                  • Opcode Fuzzy Hash: b9b63f54144ba03940088346b196338d5c2960aef7cb953cd42f14819606a153
                                                                  • Instruction Fuzzy Hash: 1E41F262B1968242EA309F21A44A2AA739DFF84BC8F054071DF9DF37A9DE3CD541C700
                                                                  Function 00007FF69315C1C8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetLastError.KERNEL32(?,?,?,00007FF693155E51,?,?,?,?,00007FF69315B392,?,?,?,?,00007FF6931580CB), ref: 00007FF69315C1D7
                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF693155E51,?,?,?,?,00007FF69315B392,?,?,?,?,00007FF6931580CB), ref: 00007FF69315C20D
                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF693155E51,?,?,?,?,00007FF69315B392,?,?,?,?,00007FF6931580CB), ref: 00007FF69315C23A
                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF693155E51,?,?,?,?,00007FF69315B392,?,?,?,?,00007FF6931580CB), ref: 00007FF69315C24B
                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF693155E51,?,?,?,?,00007FF69315B392,?,?,?,?,00007FF6931580CB), ref: 00007FF69315C25C
                                                                  • SetLastError.KERNEL32(?,?,?,00007FF693155E51,?,?,?,?,00007FF69315B392,?,?,?,?,00007FF6931580CB), ref: 00007FF69315C277
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: Value$ErrorLast
                                                                  • String ID:
                                                                  • API String ID: 2506987500-0
                                                                  • Opcode ID: 297eb830bf51183a03152683679a33ac8e7e939d0b2a29d40b44e033b6affbc9
                                                                  • Instruction ID: 13dcb7ce75fc3b2824e152202f7cac0501fbba4af7831abc0d406345f9de2566
                                                                  • Opcode Fuzzy Hash: 297eb830bf51183a03152683679a33ac8e7e939d0b2a29d40b44e033b6affbc9
                                                                  • Instruction Fuzzy Hash: 05115E25A0C64282FAB4ABA15683139719ADF4C7B4F1447B8DC3FF66F6DE6CE8418300
                                                                  Function 00007FF69315A9C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: AddressFreeHandleLibraryModuleProc
                                                                  • String ID: CorExitProcess$mscoree.dll
                                                                  • API String ID: 4061214504-1276376045
                                                                  • Opcode ID: f90418b582b416691a14bbb2ae6c6b71f2096e7654ee2338269033ad2dc175a6
                                                                  • Instruction ID: e3d21088020094952072150452331c481c4bb9c7915c40c81941450928670669
                                                                  • Opcode Fuzzy Hash: f90418b582b416691a14bbb2ae6c6b71f2096e7654ee2338269033ad2dc175a6
                                                                  • Instruction Fuzzy Hash: 30F0F671B18A4281EB308B64E4463397324FF487A5F880279CA6EE62F4CF2CE044C300
                                                                  Function 00007FF69316A5D8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: _set_statfp
                                                                  • String ID:
                                                                  • API String ID: 1156100317-0
                                                                  • Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
                                                                  • Instruction ID: 1e3f71df128562c078159229641b178e4d554692b6e00c798a144de5a5e94819
                                                                  • Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
                                                                  • Instruction Fuzzy Hash: 0B1191B2E5CA1301FA7411A4D5533753058EF5837CF0456B4E96EE62F6CE2CA8514113
                                                                  Function 00007FF69315C290 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • FlsGetValue.KERNEL32(?,?,?,00007FF69315B4E7,?,?,00000000,00007FF69315B782,?,?,?,?,?,00007FF69315B70E), ref: 00007FF69315C2AF
                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF69315B4E7,?,?,00000000,00007FF69315B782,?,?,?,?,?,00007FF69315B70E), ref: 00007FF69315C2CE
                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF69315B4E7,?,?,00000000,00007FF69315B782,?,?,?,?,?,00007FF69315B70E), ref: 00007FF69315C2F6
                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF69315B4E7,?,?,00000000,00007FF69315B782,?,?,?,?,?,00007FF69315B70E), ref: 00007FF69315C307
                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF69315B4E7,?,?,00000000,00007FF69315B782,?,?,?,?,?,00007FF69315B70E), ref: 00007FF69315C318
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: Value
                                                                  • String ID:
                                                                  • API String ID: 3702945584-0
                                                                  • Opcode ID: 336e871d9fe7b9feb1d4e8714057d4483739f4a760c37d9f3dc9b8317e64e27b
                                                                  • Instruction ID: b7a02c5cbc0d598605c925edacd7ab93793b542af2b7d3f40ffd9c01df8107e5
                                                                  • Opcode Fuzzy Hash: 336e871d9fe7b9feb1d4e8714057d4483739f4a760c37d9f3dc9b8317e64e27b
                                                                  • Instruction Fuzzy Hash: CD117F21E0C64642FAB86B6595831793189DF587B4F4443B8E83EF67F6DE2CF8418300
                                                                  Function 00007FF69315C124 Relevance: 7.6, APIs: 5, Instructions: 50COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: Value
                                                                  • String ID:
                                                                  • API String ID: 3702945584-0
                                                                  • Opcode ID: 4d8455bc275ec880ad9f8951d6e4f70d9feb0184cd7bbcf1a18e1e455a1bd2fd
                                                                  • Instruction ID: ccf9116312d58fc39e7eba9bf3c3d8d6894f326fa471e41e6d21c330c6b3496c
                                                                  • Opcode Fuzzy Hash: 4d8455bc275ec880ad9f8951d6e4f70d9feb0184cd7bbcf1a18e1e455a1bd2fd
                                                                  • Instruction Fuzzy Hash: 8511F725E0C20782F9B8AB755893179318ACF44374F1857B8E93EFA2F6DD6CB8418740
                                                                  Function 00007FF6931485B0 Relevance: 7.5, APIs: 5, Instructions: 36sleepthreadCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: Window$Process$ConsoleCurrentShowSleepThread
                                                                  • String ID:
                                                                  • API String ID: 3908687701-0
                                                                  • Opcode ID: c4ce1bea477394a5bd7c29aaffed6a601c2f4b1d57d0592e327ceaa9095476a5
                                                                  • Instruction ID: 414ba723c6e54e64faa627485207b499afd26116dce8d5e87ba37ea79eda9f2a
                                                                  • Opcode Fuzzy Hash: c4ce1bea477394a5bd7c29aaffed6a601c2f4b1d57d0592e327ceaa9095476a5
                                                                  • Instruction Fuzzy Hash: 1C016230E1874282EA745B61B4890397268FF44BC8F045075D94FDB678DE3DD8418700
                                                                  Function 00007FF693156F60 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: _invalid_parameter_noinfo
                                                                  • String ID: verbose
                                                                  • API String ID: 3215553584-579935070
                                                                  • Opcode ID: 5742ae6ca51b03e9d6fd204cb41504e479b7e72b202bc53543779a715851f7d3
                                                                  • Instruction ID: df184a39e7d7d081678211c6274005a23bc121ca7d3cf2448a95de6369b5e9c5
                                                                  • Opcode Fuzzy Hash: 5742ae6ca51b03e9d6fd204cb41504e479b7e72b202bc53543779a715851f7d3
                                                                  • Instruction Fuzzy Hash: 0891CC32A08A4682E7318F25D85377D76E9EB05B94F848176DA5EE73E5DF3CE8428301
                                                                  Function 00007FF693160E38 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: _invalid_parameter_noinfo
                                                                  • String ID: UTF-16LEUNICODE$UTF-8$ccs
                                                                  • API String ID: 3215553584-1196891531
                                                                  • Opcode ID: 59f559b3b4a43374a67f10f227721a3fbc4a07d852e694dccd2ae9d3b54f0314
                                                                  • Instruction ID: d5d00c5dd8ae3161aa4651ed08f7bb8e1b137a815a4c35a886c5b20157abd5ff
                                                                  • Opcode Fuzzy Hash: 59f559b3b4a43374a67f10f227721a3fbc4a07d852e694dccd2ae9d3b54f0314
                                                                  • Instruction Fuzzy Hash: E181B132E0C65286FB784FAA811227D36ACEB11B4CF5580B5CA09F72B9CF3DE9418741
                                                                  Function 00007FF69314CBD8 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                                                                  • String ID: csm
                                                                  • API String ID: 2395640692-1018135373
                                                                  • Opcode ID: ab412f78eb90613ff4c98a1fac2d50a5770803065215d444c3ce453a3de23157
                                                                  • Instruction ID: 37b1991eed3c6e5f103a9c302b11a14eb47ff9a9040fb3c476459b5f7fcc2749
                                                                  • Opcode Fuzzy Hash: ab412f78eb90613ff4c98a1fac2d50a5770803065215d444c3ce453a3de23157
                                                                  • Instruction Fuzzy Hash: 8151C33AB196029ADB24CF15E449A793799FB44B9CF108171DA4E977A8EF3CE841C740
                                                                  Function 00007FF69314E468 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: CallEncodePointerTranslator
                                                                  • String ID: MOC$RCC
                                                                  • API String ID: 3544855599-2084237596
                                                                  • Opcode ID: 2d0d38728c8b81eb1afee087d1255ca92539906646f1d2432080e5defd871a42
                                                                  • Instruction ID: b2dd0d4619be4aaddf6f1fa245e705426258c333a8881a49908ee8aaa3b16f28
                                                                  • Opcode Fuzzy Hash: 2d0d38728c8b81eb1afee087d1255ca92539906646f1d2432080e5defd871a42
                                                                  • Instruction Fuzzy Hash: ED61C332A08BC585DB709F25E4453AAB7A4FB84788F044675EB9C67BA5DF7CE090CB00
                                                                  Function 00007FF69314E818 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                                                                  • String ID: csm$csm
                                                                  • API String ID: 3896166516-3733052814
                                                                  • Opcode ID: 881cb4ef47e13874d43f93ad661edca9df8e178c9ea1252ba64912ddd8f944cb
                                                                  • Instruction ID: c8d9c5bd7076ef1c6dc84421b4f5449362504a905a4cea744d455446a0efa8e6
                                                                  • Opcode Fuzzy Hash: 881cb4ef47e13874d43f93ad661edca9df8e178c9ea1252ba64912ddd8f944cb
                                                                  • Instruction Fuzzy Hash: F5519F32A083828AEB748F65D04A36877A8FB54B88F1451B5DA8CA7BE5CF3CE451C711
                                                                  Function 00007FF693147260 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • CreateDirectoryW.KERNEL32(00000000,?,00007FF6931428EC,FFFFFFFF,00000000,00007FF69314336A), ref: 00007FF693147372
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: CreateDirectory
                                                                  • String ID: %.*s$%s%c$\
                                                                  • API String ID: 4241100979-1685191245
                                                                  • Opcode ID: 8483aebf73e132e5a1e11bd86e0dae461c6ec9d36d7fd58fe1f5dbf943300de9
                                                                  • Instruction ID: dd454a1703bb300f0e7f73123c664cdbc13fb04fe3c360b6825296e4bd650977
                                                                  • Opcode Fuzzy Hash: 8483aebf73e132e5a1e11bd86e0dae461c6ec9d36d7fd58fe1f5dbf943300de9
                                                                  • Instruction Fuzzy Hash: C2310A2171DAC556EA319B20E4157EA735DEF84BE8F404670EEADA37E5DF2CD2058700
                                                                  Function 00007FF693142220 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 61COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetCurrentProcessId.KERNEL32(FFFFFFFF,00000000,00000000,?,00000000,00007FF69314866F), ref: 00007FF69314226E
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: CurrentProcess
                                                                  • String ID: %ls$WARNING$[PYI-%d:%ls]
                                                                  • API String ID: 2050909247-3372507544
                                                                  • Opcode ID: 92da2cbc5b979b0862b6cfd95371d042a7d5931ee882c49d5c626b31f152fc77
                                                                  • Instruction ID: 7c2379a245bbd7a1fa4c0859b064fd4ebdb2c65050b44d355387f47671b843d0
                                                                  • Opcode Fuzzy Hash: 92da2cbc5b979b0862b6cfd95371d042a7d5931ee882c49d5c626b31f152fc77
                                                                  • Instruction Fuzzy Hash: CE21D43271CB8251E6309BA1F8466EA7368FF847C8F405176EA8DA3A6ADF3CD115C740
                                                                  Function 00007FF69315D4A0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: FileWrite$ConsoleErrorLastOutput
                                                                  • String ID:
                                                                  • API String ID: 2718003287-0
                                                                  • Opcode ID: fabcd4fad7fa856dcf2e9951dc7cbf89ababb6e1d40fd4369e0489b0ae7d9f25
                                                                  • Instruction ID: b5b66af47de4ebcfdbe70332fec1963543d3867819a633eda10d9ed0dca34962
                                                                  • Opcode Fuzzy Hash: fabcd4fad7fa856dcf2e9951dc7cbf89ababb6e1d40fd4369e0489b0ae7d9f25
                                                                  • Instruction Fuzzy Hash: C6D10472B28A8189E720CF75D4412AC37B9FB447D8B544276CE5EE7BA9DE38E416C700
                                                                  Function 00007FF693160BFC Relevance: 6.2, APIs: 4, Instructions: 161COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: _get_daylight$_isindst
                                                                  • String ID:
                                                                  • API String ID: 4170891091-0
                                                                  • Opcode ID: 89e82a0bcb92f9a57c8ce538440e566bc748d838767a3902d6c6661200ebf515
                                                                  • Instruction ID: 10917e8bdc0af5ea803ea9f847196fa23d636b24a089f1c71f90cb882a4cb299
                                                                  • Opcode Fuzzy Hash: 89e82a0bcb92f9a57c8ce538440e566bc748d838767a3902d6c6661200ebf515
                                                                  • Instruction Fuzzy Hash: 6351B672F0821586EB34DFA49D566BC3769EB0035DF504275DD1EE2AF9DF38A8418700
                                                                  Function 00007FF693156738 Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: File$ErrorHandleInformationLastNamedPeekPipeType
                                                                  • String ID:
                                                                  • API String ID: 2780335769-0
                                                                  • Opcode ID: 77215611d5833cc4261aa3ce6efef3cbe316a0555a56b2abfd6bea145bf69a9d
                                                                  • Instruction ID: 6461cc39643d35f7de6c9c32deae70891b422ab6447ba6c0e209d84bfe4dde12
                                                                  • Opcode Fuzzy Hash: 77215611d5833cc4261aa3ce6efef3cbe316a0555a56b2abfd6bea145bf69a9d
                                                                  • Instruction Fuzzy Hash: 45517E22E087018AF720DFB1D4523BD37A9EB48B88F149579DE0DE76A9DF38D4918780
                                                                  Function 00007FF693166D8C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: _get_daylight$_invalid_parameter_noinfo
                                                                  • String ID: ?
                                                                  • API String ID: 1286766494-1684325040
                                                                  • Opcode ID: 44877219fa58a3c80076740d489941753dcdf7d4d18713102933f3384318ca38
                                                                  • Instruction ID: 33e5ec1b2f9e5451b5b502af857315931ce9dda28960b3f95c25fa257de91c1b
                                                                  • Opcode Fuzzy Hash: 44877219fa58a3c80076740d489941753dcdf7d4d18713102933f3384318ca38
                                                                  • Instruction Fuzzy Hash: 07410532A0878246FB34DBA5D40237E76A8EB90BA8F144275EE5C96AF5DF3CD491C700
                                                                  Function 00007FF693159F50 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • _invalid_parameter_noinfo.LIBCMT ref: 00007FF693159F82
                                                                    • Part of subcall function 00007FF69315B464: RtlFreeHeap.NTDLL(?,?,?,00007FF693163F92,?,?,?,00007FF693163FCF,?,?,00000000,00007FF693164495,?,?,?,00007FF6931643C7), ref: 00007FF69315B47A
                                                                    • Part of subcall function 00007FF69315B464: GetLastError.KERNEL32(?,?,?,00007FF693163F92,?,?,?,00007FF693163FCF,?,?,00000000,00007FF693164495,?,?,?,00007FF6931643C7), ref: 00007FF69315B484
                                                                  • GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF69314C165), ref: 00007FF693159FA0
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
                                                                  • String ID: C:\Users\user\Desktop\lock.exe
                                                                  • API String ID: 3580290477-1614551167
                                                                  • Opcode ID: 2a2f06ea51d58fd39cad35a47b9855af257a0ebd26d3c321afc8fcfaab6f6b1a
                                                                  • Instruction ID: e6a7dcdfcd44276b89d00964c247ded2568647f8fa568066e6f146fbc804462f
                                                                  • Opcode Fuzzy Hash: 2a2f06ea51d58fd39cad35a47b9855af257a0ebd26d3c321afc8fcfaab6f6b1a
                                                                  • Instruction Fuzzy Hash: 37418032A08B1286EB35DF21A4420BD7799FB447C4F444076EA4ED7BA6DF3DE4818305
                                                                  Function 00007FF69315DB38 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: ErrorFileLastWrite
                                                                  • String ID: U
                                                                  • API String ID: 442123175-4171548499
                                                                  • Opcode ID: 57f6403a17afa6857eb93518903eebf05678db2d18f563f749b6ba14b42682ba
                                                                  • Instruction ID: 74ed69398f7f25342da09cfa86783f98a1a817f31e3faee638e71c3efc2ca626
                                                                  • Opcode Fuzzy Hash: 57f6403a17afa6857eb93518903eebf05678db2d18f563f749b6ba14b42682ba
                                                                  • Instruction Fuzzy Hash: D541B272B29A8181EB308F25E4453AA77A9FB88794F514035EE8ED77A8DF7CD441C700
                                                                  Function 00007FF693142020 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 78COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF693141B4A), ref: 00007FF693142070
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: CurrentProcess
                                                                  • String ID: %s: %s$[PYI-%d:ERROR]
                                                                  • API String ID: 2050909247-3704582800
                                                                  • Opcode ID: a5f084cc36529dd82358bb6d3c03fbfc020d3d736b3f3fde6876dd26524326fa
                                                                  • Instruction ID: a7c88b44b2597beb154a543b077c69609393e782d5e8b8f43034a8d9162104c7
                                                                  • Opcode Fuzzy Hash: a5f084cc36529dd82358bb6d3c03fbfc020d3d736b3f3fde6876dd26524326fa
                                                                  • Instruction Fuzzy Hash: AF21E572B1868156E7309761BC466E67298FF88BD8F404171FE8DE7B6ADE3CD156C200
                                                                  Function 00007FF693160828 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: CurrentDirectory
                                                                  • String ID: :
                                                                  • API String ID: 1611563598-336475711
                                                                  • Opcode ID: e405b3d95a77a686cd9e65060fb5efdbb8b04b637a4feec6827f9fe163836890
                                                                  • Instruction ID: f0c116dc14797d4415f2ca1b463c4bc6994aef7cb20f59443fb88d63df3477b8
                                                                  • Opcode Fuzzy Hash: e405b3d95a77a686cd9e65060fb5efdbb8b04b637a4feec6827f9fe163836890
                                                                  • Instruction Fuzzy Hash: 87219172E0C68181FB30DB15D44626D73A9FB88B88F858075D68DA36A9DF7CE985C780
                                                                  Function 00007FF693142140 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetCurrentProcessId.KERNEL32(00000000,?,?,?,00000000,00007FF6931428DA,FFFFFFFF,00000000,00007FF69314336A), ref: 00007FF69314218E
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: CurrentProcess
                                                                  • String ID: WARNING$[PYI-%d:%s]
                                                                  • API String ID: 2050909247-3752221249
                                                                  • Opcode ID: 28628bd70d5a97629098dcd42eabd330bee057474c06a66384895197b474a4b9
                                                                  • Instruction ID: 619c7c1ec060980ed7ec34b76f219ddf9aa124df46ec751f5303c031aa994ac4
                                                                  • Opcode Fuzzy Hash: 28628bd70d5a97629098dcd42eabd330bee057474c06a66384895197b474a4b9
                                                                  • Instruction Fuzzy Hash: 52119032618B8541E6309B61F8866EA7398FF887C8F405175FA8DA3B69DF7CD1558700
                                                                  Function 00007FF693141E50 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF693141B79), ref: 00007FF693141E9E
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: CurrentProcess
                                                                  • String ID: ERROR$[PYI-%d:%s]
                                                                  • API String ID: 2050909247-3005936843
                                                                  • Opcode ID: c1c0bec23ccac853a0e083361079492e25c9a947d7081d13b76ea5259852d608
                                                                  • Instruction ID: fd9247974a77ac9731430b06812d649da34d248a0faaaee44d5084273c7975c7
                                                                  • Opcode Fuzzy Hash: c1c0bec23ccac853a0e083361079492e25c9a947d7081d13b76ea5259852d608
                                                                  • Instruction Fuzzy Hash: B011903261CB8541E6309B61F8866EA73A8FF887C8F405175FA8DA3B69DE7CD1558700
                                                                  Function 00007FF69314F2D8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: ExceptionFileHeaderRaise
                                                                  • String ID: csm
                                                                  • API String ID: 2573137834-1018135373
                                                                  • Opcode ID: 778d4a5eeee770603d02c5501bef52114850414878b0bee781498c4a1570bacf
                                                                  • Instruction ID: b4dd1083252419c39d0199c0f014917a6e017304c82a45883c02f90b4fff95a1
                                                                  • Opcode Fuzzy Hash: 778d4a5eeee770603d02c5501bef52114850414878b0bee781498c4a1570bacf
                                                                  • Instruction Fuzzy Hash: 4B113032618B8182EB618F15F544269B7E4FB88B88F584274DE8D57764EF3CD551C700
                                                                  Function 00007FF6931619AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.3534955916.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000000.00000002.3534908575.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535010649.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535057326.00007FF693184000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.3535112937.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: DriveType_invalid_parameter_noinfo
                                                                  • String ID: :
                                                                  • API String ID: 2595371189-336475711
                                                                  • Opcode ID: a21020f9989eba13c36801fee87724dcdfb53302495b3b0e02d80308072ceaa1
                                                                  • Instruction ID: f9720a2541d10c28f0dcb6447abbf68676e91fe035f3fa5cd513dae2abf3b642
                                                                  • Opcode Fuzzy Hash: a21020f9989eba13c36801fee87724dcdfb53302495b3b0e02d80308072ceaa1
                                                                  • Instruction Fuzzy Hash: 2F017C32A1C64286E734ABA0946327E72A8EF4874CF801075D64EE26A5DF2CE544CB14

                                                                  Execution Graph

                                                                  Execution Coverage:4.4%
                                                                  Dynamic/Decrypted Code Coverage:0%
                                                                  Signature Coverage:0%
                                                                  Total number of Nodes:698
                                                                  Total number of Limit Nodes:10
                                                                  execution_graph 23857 7ff69314ea58 37 API calls __std_exception_copy 23824 7ffda4333c5f 21 API calls 4 library calls 23795 7ff69315d460 12 API calls 23797 7ffda43350b0 21 API calls __unDName 23858 7ff693149f43 12 API calls 23826 7ffda43311c0 13 API calls __CxxDetectRethrow 23827 7ff693161b38 77 API calls 4 library calls 23800 7ff69314ec4a 55 API calls 2 library calls 23801 7ffda433e4d0 15 API calls __CxxDetectRethrow 23864 7ff69316be53 LeaveCriticalSection _fread_nolock 23832 7ffda4331160 14 API calls 2 library calls 23802 7ff69315a899 57 API calls 23805 7ff69314c8b0 54 API calls 23834 7ffda433dd80 RtlUnwind __except_validate_jump_buffer 23868 7ffda4335280 9 API calls __vcrt_getptd_noinit 23717 7ff693142480 23718 7ff693142490 23717->23718 23719 7ff6931424cb 23718->23719 23720 7ff6931424e1 23718->23720 23738 7ff693141e50 81 API calls _log10_special 23719->23738 23722 7ff693142501 23720->23722 23733 7ff693142517 __std_exception_copy 23720->23733 23739 7ff693141e50 81 API calls _log10_special 23722->23739 23723 7ff69314bb10 _log10_special 8 API calls 23725 7ff69314269a 23723->23725 23726 7ff6931424d7 23726->23723 23727 7ff693141450 114 API calls 23727->23733 23728 7ff693142706 23743 7ff693141e50 81 API calls _log10_special 23728->23743 23730 7ff693141c60 49 API calls 23730->23733 23731 7ff6931426f0 23742 7ff693141e50 81 API calls _log10_special 23731->23742 23733->23726 23733->23727 23733->23728 23733->23730 23733->23731 23734 7ff6931426ca 23733->23734 23736 7ff6931426a7 23733->23736 23741 7ff693141e50 81 API calls _log10_special 23734->23741 23740 7ff693141e50 81 API calls _log10_special 23736->23740 23738->23726 23739->23726 23740->23726 23741->23726 23742->23726 23743->23726 23869 7ffda4333288 free 23897 7ff693147980 Sleep 23898 7ffda4332b88 43 API calls 5 library calls 23835 7ff69314c380 GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter 23870 7ff693156280 76 API calls __free_lconv_num 23871 7ffda433f618 21 API calls _DllMainCRTStartup 23872 7ffda43339c3 15 API calls 5 library calls 23873 7ff693168e90 65 API calls 23836 7ffda4341e20 14 API calls __CxxDetectRethrow 23837 7ffda4331220 terminate 23874 7ffda4335320 14 API calls __CxxDetectRethrow 23840 7ff693145fe0 49 API calls _log10_special 23744 7ff6931565e4 23745 7ff69315661b 23744->23745 23746 7ff6931565fe 23744->23746 23745->23746 23747 7ff69315662e CreateFileW 23745->23747 23769 7ff693155e28 11 API calls _get_daylight 23746->23769 23749 7ff693156698 23747->23749 23750 7ff693156662 23747->23750 23773 7ff693156bc0 46 API calls 3 library calls 23749->23773 23772 7ff693156738 59 API calls 3 library calls 23750->23772 23751 7ff693156603 23770 7ff693155e48 11 API calls _get_daylight 23751->23770 23755 7ff693156670 23758 7ff69315668d CloseHandle 23755->23758 23759 7ff693156677 CloseHandle 23755->23759 23756 7ff69315669d 23760 7ff6931566cc 23756->23760 23761 7ff6931566a1 23756->23761 23757 7ff69315660b 23771 7ff69315b824 37 API calls _invalid_parameter_noinfo 23757->23771 23764 7ff693156616 23758->23764 23759->23764 23775 7ff693156980 51 API calls 23760->23775 23774 7ff693155dbc 11 API calls 2 library calls 23761->23774 23766 7ff6931566d9 23776 7ff693156abc 21 API calls _fread_nolock 23766->23776 23768 7ff6931566ab 23768->23764 23769->23751 23770->23757 23771->23764 23772->23755 23773->23756 23774->23768 23775->23766 23776->23768 23876 7ff693162ae4 44 API calls 5 library calls 23900 7ff69314c1e0 38 API calls 2 library calls 23777 7ff69315d0e0 23778 7ff69315d110 23777->23778 23781 7ff69315cf14 23778->23781 23780 7ff69315d129 23782 7ff69315cf3d 23781->23782 23783 7ff69315cf6b 23781->23783 23782->23780 23784 7ff69315cf84 23783->23784 23786 7ff69315cfdb 23783->23786 23793 7ff69315b758 37 API calls 2 library calls 23784->23793 23792 7ff69315934c EnterCriticalSection 23786->23792 23788 7ff69315cfe2 23789 7ff69315d034 _fread_nolock 39 API calls 23788->23789 23790 7ff69315cff9 23788->23790 23789->23790 23791 7ff693159434 _fread_nolock LeaveCriticalSection 23790->23791 23791->23782 23793->23782 23841 7ffda4334e2f RtlPcToFileHeader RtlPcToFileHeader RaiseException 23901 7ff69314cdf0 10 API calls 2 library calls 23877 7ff6931646f0 GetProcessHeap 23902 7ffda4335040 InterlockedFlushSList free 23845 7ff69314cfb8 45 API calls 23809 7ff6931460c0 10 API calls 23846 7ff693168fc0 CloseHandle 23880 7ffda4331749 abort 23810 7ffda433f558 38 API calls __CxxDetectRethrow 23811 7ff6931604d0 FreeLibrary 23812 7ff69315acd0 11 API calls 23882 7ff6931626d0 55 API calls 3 library calls 23813 7ffda43334e0 15 API calls 4 library calls 23849 7ff69314e818 59 API calls 5 library calls 23815 7ffda4334cea RtlPcToFileHeader RtlPcToFileHeader RtlPcToFileHeader RaiseException 23816 7ff693162920 74 API calls 2 library calls 23906 7ffda43333ea 15 API calls 2 library calls 23883 7ff69314c32a GetModuleHandleW _CallSETranslator 23884 7ff69316af2c 55 API calls _CallSETranslator 23885 7ffda43332f0 14 API calls 4 library calls 23886 7ffda43342f0 22 API calls 4 library calls 23850 7ffda43331f8 malloc strcpy_s free 23819 7ffda43408fb RtlUnwindEx 22860 7ff69314c1fc 22881 7ff69314c3dc 22860->22881 22863 7ff69314c21d __scrt_acquire_startup_lock 22866 7ff69314c35d 22863->22866 22871 7ff69314c23b __scrt_release_startup_lock 22863->22871 22864 7ff69314c353 23042 7ff69314c6fc 7 API calls 2 library calls 22864->23042 23043 7ff69314c6fc 7 API calls 2 library calls 22866->23043 22868 7ff69314c260 22869 7ff69314c368 _CallSETranslator 22870 7ff69314c2e6 22889 7ff69315a6b8 22870->22889 22871->22868 22871->22870 23039 7ff69315aa64 45 API calls 22871->23039 22874 7ff69314c2eb 22895 7ff693141000 22874->22895 22878 7ff69314c30f 22878->22869 23041 7ff69314c560 7 API calls 22878->23041 22880 7ff69314c326 22880->22868 22882 7ff69314c3e4 22881->22882 22883 7ff69314c3f0 __scrt_dllmain_crt_thread_attach 22882->22883 22884 7ff69314c3fd 22883->22884 22887 7ff69314c215 22883->22887 23044 7ff69315b30c 22884->23044 22887->22863 22887->22864 22890 7ff69315a6c8 22889->22890 22893 7ff69315a6dd 22889->22893 22890->22893 23061 7ff69315a148 40 API calls __free_lconv_num 22890->23061 22892 7ff69315a6e6 22892->22893 23062 7ff69315a508 12 API calls 3 library calls 22892->23062 22893->22874 22896 7ff693142b80 22895->22896 23063 7ff6931563c0 22896->23063 22898 7ff693142bbc 23070 7ff693142a70 22898->23070 22905 7ff693142bfd 23169 7ff693141c60 22905->23169 22906 7ff693142cdb 23174 7ff6931439d0 22906->23174 22910 7ff693142c1c 23142 7ff693147e70 22910->23142 22911 7ff693142d2a 23197 7ff693141e50 81 API calls _log10_special 22911->23197 22915 7ff693142c4f 22922 7ff693142c7b __std_exception_copy 22915->22922 23173 7ff693147fe0 40 API calls __std_exception_copy 22915->23173 22916 7ff693142d1d 22917 7ff693142d45 22916->22917 22918 7ff693142d22 22916->22918 22921 7ff693141c60 49 API calls 22917->22921 23193 7ff69314f5a4 22918->23193 22923 7ff693142d64 22921->22923 22924 7ff693147e70 14 API calls 22922->22924 22932 7ff693142c9e __std_exception_copy 22922->22932 22927 7ff693141930 115 API calls 22923->22927 22924->22932 22926 7ff693142dcc 23200 7ff693147fe0 40 API calls __std_exception_copy 22926->23200 22929 7ff693142d8e 22927->22929 22929->22910 22931 7ff693142d9e 22929->22931 22930 7ff693142dd8 23201 7ff693147fe0 40 API calls __std_exception_copy 22930->23201 23198 7ff693141e50 81 API calls _log10_special 22931->23198 22937 7ff693142cce __std_exception_copy 22932->22937 23199 7ff693147f80 40 API calls __std_exception_copy 22932->23199 22935 7ff693142de4 23202 7ff693147fe0 40 API calls __std_exception_copy 22935->23202 22938 7ff693147e70 14 API calls 22937->22938 22939 7ff693142e04 22938->22939 22940 7ff693142ef9 22939->22940 22941 7ff693142e29 __std_exception_copy 22939->22941 23204 7ff693141e50 81 API calls _log10_special 22940->23204 22953 7ff693142e6c 22941->22953 23203 7ff693147f80 40 API calls __std_exception_copy 22941->23203 22944 7ff69314303a 22948 7ff693147e70 14 API calls 22944->22948 22945 7ff693143033 23205 7ff693148510 GetConsoleWindow GetCurrentProcessId GetWindowThreadProcessId ShowWindow Sleep 22945->23205 22947 7ff693143038 22947->22944 22949 7ff69314304f __std_exception_copy 22948->22949 22950 7ff693143187 22949->22950 22951 7ff69314308a 22949->22951 23219 7ff6931438f0 49 API calls 22950->23219 22954 7ff69314311a 22951->22954 22955 7ff693143094 22951->22955 22953->22944 22953->22945 22956 7ff693147e70 14 API calls 22954->22956 23206 7ff6931485c0 88 API calls _log10_special 22955->23206 22960 7ff693143126 22956->22960 22957 7ff693143195 22961 7ff6931431b7 22957->22961 22962 7ff6931431ab 22957->22962 22959 7ff693143099 22963 7ff6931430f9 22959->22963 22964 7ff6931430a5 22959->22964 22960->22964 22967 7ff693143133 22960->22967 22966 7ff693141c60 49 API calls 22961->22966 23220 7ff693143a40 22962->23220 23217 7ff693147ca0 113 API calls 2 library calls 22963->23217 23207 7ff693141e50 81 API calls _log10_special 22964->23207 22978 7ff693143171 __std_exception_copy 22966->22978 22970 7ff693141c60 49 API calls 22967->22970 22973 7ff693143151 22970->22973 22971 7ff69314320a 23155 7ff693148950 22971->23155 22972 7ff693143101 22975 7ff69314310e 22972->22975 22976 7ff693143105 22972->22976 22977 7ff693143158 22973->22977 22973->22978 22975->22978 22976->22964 23218 7ff693141e50 81 API calls _log10_special 22977->23218 22978->22971 22979 7ff6931431ed SetDllDirectoryW LoadLibraryExW 22978->22979 22979->22971 22980 7ff69314321d SetDllDirectoryW 22983 7ff693143250 22980->22983 23029 7ff6931432a1 22980->23029 22985 7ff693147e70 14 API calls 22983->22985 22984 7ff693142bc9 __std_exception_copy 23208 7ff69314bb10 22984->23208 22993 7ff69314325c __std_exception_copy 22985->22993 22986 7ff693143433 22987 7ff69314343e 22986->22987 22994 7ff693143445 22986->22994 23233 7ff693148510 GetConsoleWindow GetCurrentProcessId GetWindowThreadProcessId ShowWindow Sleep 22987->23233 22988 7ff693143362 23231 7ff693142780 119 API calls 2 library calls 22988->23231 22991 7ff693143443 22991->22994 22992 7ff69314336a 22992->22984 23232 7ff693148590 LocalFree 22992->23232 22996 7ff693143339 22993->22996 23000 7ff693143295 22993->23000 23160 7ff693142720 22994->23160 23230 7ff693147f80 40 API calls __std_exception_copy 22996->23230 23000->23029 23223 7ff693146200 87 API calls _get_daylight 23000->23223 23007 7ff693143468 23235 7ff693146400 FreeLibrary 23007->23235 23011 7ff6931432b3 23224 7ff693146780 115 API calls 2 library calls 23011->23224 23012 7ff693143474 23016 7ff6931432c8 23019 7ff6931432e9 23016->23019 23031 7ff6931432cc 23016->23031 23225 7ff693146240 118 API calls _log10_special 23016->23225 23019->23031 23226 7ff6931465f0 150 API calls 23019->23226 23024 7ff693143327 23229 7ff693146400 FreeLibrary 23024->23229 23025 7ff6931432fe 23025->23031 23227 7ff693146930 82 API calls 23025->23227 23029->22986 23029->22988 23031->23029 23228 7ff693142140 81 API calls _log10_special 23031->23228 23039->22870 23040 7ff69314c84c GetModuleHandleW 23040->22878 23041->22880 23042->22866 23043->22869 23045 7ff69316471c 23044->23045 23046 7ff69314c402 23045->23046 23049 7ff69315d420 23045->23049 23046->22887 23048 7ff69314ce18 7 API calls 2 library calls 23046->23048 23048->22887 23060 7ff693161548 EnterCriticalSection 23049->23060 23051 7ff69315d430 23052 7ff6931592a4 43 API calls 23051->23052 23053 7ff69315d439 23052->23053 23054 7ff69315d228 45 API calls 23053->23054 23059 7ff69315d447 23053->23059 23056 7ff69315d442 23054->23056 23055 7ff6931615a8 _isindst LeaveCriticalSection 23057 7ff69315d453 23055->23057 23058 7ff69315d318 GetStdHandle GetFileType 23056->23058 23057->23045 23058->23059 23059->23055 23061->22892 23062->22893 23065 7ff6931606f0 23063->23065 23066 7ff693160796 23065->23066 23067 7ff693160743 23065->23067 23237 7ff6931605c8 71 API calls _fread_nolock 23066->23237 23236 7ff69315b758 37 API calls 2 library calls 23067->23236 23069 7ff69316076c 23069->22898 23238 7ff69314be10 23070->23238 23073 7ff693142aab GetLastError 23245 7ff693142310 80 API calls _log10_special 23073->23245 23074 7ff693142ad0 23240 7ff693148840 FindFirstFileExW 23074->23240 23077 7ff693142ac6 23081 7ff69314bb10 _log10_special 8 API calls 23077->23081 23079 7ff693142b3d 23248 7ff693148a00 WideCharToMultiByte WideCharToMultiByte __std_exception_copy 23079->23248 23080 7ff693142ae3 23246 7ff6931488c0 CreateFileW GetFinalPathNameByHandleW CloseHandle 23080->23246 23084 7ff693142b75 23081->23084 23084->22984 23092 7ff693141930 23084->23092 23085 7ff693142af0 23087 7ff693142b0c __vcrt_FlsAlloc 23085->23087 23088 7ff693142af4 23085->23088 23086 7ff693142b4b 23086->23077 23249 7ff693141f30 78 API calls _log10_special 23086->23249 23087->23079 23247 7ff693141f30 78 API calls _log10_special 23088->23247 23091 7ff693142b05 23091->23077 23093 7ff6931439d0 108 API calls 23092->23093 23094 7ff693141965 23093->23094 23096 7ff6931473d0 83 API calls 23094->23096 23102 7ff693141c23 23094->23102 23095 7ff69314bb10 _log10_special 8 API calls 23097 7ff693141c3e 23095->23097 23098 7ff6931419ab 23096->23098 23097->22905 23097->22906 23141 7ff6931419e3 23098->23141 23250 7ff69314fc2c 23098->23250 23100 7ff69314f5a4 74 API calls 23100->23102 23101 7ff6931419c5 23103 7ff6931419c9 23101->23103 23104 7ff6931419e8 23101->23104 23102->23095 23257 7ff693155e48 11 API calls _get_daylight 23103->23257 23254 7ff69314f8f4 23104->23254 23107 7ff6931419ce 23258 7ff693142020 87 API calls _log10_special 23107->23258 23110 7ff693141a06 23259 7ff693155e48 11 API calls _get_daylight 23110->23259 23111 7ff693141a25 23114 7ff693141a3c 23111->23114 23115 7ff693141a5b 23111->23115 23113 7ff693141a0b 23260 7ff693142020 87 API calls _log10_special 23113->23260 23261 7ff693155e48 11 API calls _get_daylight 23114->23261 23118 7ff693141c60 49 API calls 23115->23118 23120 7ff693141a72 23118->23120 23119 7ff693141a41 23262 7ff693142020 87 API calls _log10_special 23119->23262 23122 7ff693141c60 49 API calls 23120->23122 23123 7ff693141abd 23122->23123 23124 7ff69314fc2c 73 API calls 23123->23124 23125 7ff693141ae1 23124->23125 23126 7ff693141af6 23125->23126 23127 7ff693141b15 23125->23127 23263 7ff693155e48 11 API calls _get_daylight 23126->23263 23129 7ff69314f8f4 _fread_nolock 53 API calls 23127->23129 23131 7ff693141b2a 23129->23131 23130 7ff693141afb 23264 7ff693142020 87 API calls _log10_special 23130->23264 23133 7ff693141b30 23131->23133 23134 7ff693141b4f 23131->23134 23265 7ff693155e48 11 API calls _get_daylight 23133->23265 23267 7ff69314f668 37 API calls 2 library calls 23134->23267 23137 7ff693141b69 23137->23141 23268 7ff693141e50 81 API calls _log10_special 23137->23268 23138 7ff693141b35 23266 7ff693142020 87 API calls _log10_special 23138->23266 23141->23100 23143 7ff693147e7a 23142->23143 23144 7ff693148950 2 API calls 23143->23144 23145 7ff693147e99 GetEnvironmentVariableW 23144->23145 23146 7ff693147eb6 ExpandEnvironmentStringsW 23145->23146 23147 7ff693147f02 23145->23147 23146->23147 23149 7ff693147ed8 23146->23149 23148 7ff69314bb10 _log10_special 8 API calls 23147->23148 23150 7ff693147f14 23148->23150 23298 7ff693148a00 WideCharToMultiByte WideCharToMultiByte __std_exception_copy 23149->23298 23150->22915 23152 7ff693147eea 23153 7ff69314bb10 _log10_special 8 API calls 23152->23153 23154 7ff693147efa 23153->23154 23154->22915 23156 7ff693148972 MultiByteToWideChar 23155->23156 23157 7ff693148996 23155->23157 23156->23157 23159 7ff6931489ac __std_exception_copy 23156->23159 23158 7ff6931489b3 MultiByteToWideChar 23157->23158 23157->23159 23158->23159 23159->22980 23299 7ff6931457a0 23160->23299 23164 7ff693142741 23168 7ff693142759 23164->23168 23367 7ff693145490 23164->23367 23166 7ff69314274d 23166->23168 23376 7ff693145620 81 API calls 23166->23376 23234 7ff693142a30 FreeLibrary 23168->23234 23170 7ff693141c85 23169->23170 23496 7ff6931558c4 23170->23496 23173->22922 23175 7ff6931439dc 23174->23175 23176 7ff693148950 2 API calls 23175->23176 23177 7ff693143a04 23176->23177 23178 7ff693148950 2 API calls 23177->23178 23179 7ff693143a17 23178->23179 23519 7ff693156f54 23179->23519 23182 7ff69314bb10 _log10_special 8 API calls 23183 7ff693142ceb 23182->23183 23183->22911 23184 7ff6931473d0 23183->23184 23185 7ff6931473f4 23184->23185 23186 7ff69314fc2c 73 API calls 23185->23186 23191 7ff6931474cb __std_exception_copy 23185->23191 23187 7ff693147410 23186->23187 23187->23191 23687 7ff693158804 23187->23687 23189 7ff69314fc2c 73 API calls 23192 7ff693147425 23189->23192 23190 7ff69314f8f4 _fread_nolock 53 API calls 23190->23192 23191->22916 23192->23189 23192->23190 23192->23191 23194 7ff69314f5d4 23193->23194 23703 7ff69314f380 23194->23703 23196 7ff69314f5ed 23196->22911 23197->22984 23198->22984 23199->22926 23200->22930 23201->22935 23202->22937 23203->22953 23204->22984 23205->22947 23206->22959 23207->22984 23209 7ff69314bb19 23208->23209 23210 7ff69314bea0 IsProcessorFeaturePresent 23209->23210 23211 7ff6931430ec 23209->23211 23212 7ff69314beb8 23210->23212 23211->23040 23715 7ff69314c098 RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 23212->23715 23214 7ff69314becb 23716 7ff69314be60 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 23214->23716 23217->22972 23218->22984 23219->22957 23221 7ff693141c60 49 API calls 23220->23221 23222 7ff693143a70 23221->23222 23222->22978 23223->23011 23224->23016 23225->23019 23226->23025 23227->23031 23228->23024 23229->23029 23230->23029 23231->22992 23233->22991 23234->23007 23235->23012 23236->23069 23237->23069 23239 7ff693142a7c GetModuleFileNameW 23238->23239 23239->23073 23239->23074 23241 7ff69314887f FindClose 23240->23241 23242 7ff693148892 23240->23242 23241->23242 23243 7ff69314bb10 _log10_special 8 API calls 23242->23243 23244 7ff693142ada 23243->23244 23244->23079 23244->23080 23245->23077 23246->23085 23247->23091 23248->23086 23249->23077 23251 7ff69314fc5c 23250->23251 23269 7ff69314f9bc 23251->23269 23253 7ff69314fc75 23253->23101 23282 7ff69314f914 23254->23282 23257->23107 23258->23141 23259->23113 23260->23141 23261->23119 23262->23141 23263->23130 23264->23141 23265->23138 23266->23141 23267->23137 23268->23141 23270 7ff69314fa26 23269->23270 23271 7ff69314f9e6 23269->23271 23270->23271 23273 7ff69314fa32 23270->23273 23281 7ff69315b758 37 API calls 2 library calls 23271->23281 23280 7ff6931562dc EnterCriticalSection 23273->23280 23274 7ff69314fa0d 23274->23253 23276 7ff69314fa37 23277 7ff69314fb40 71 API calls 23276->23277 23278 7ff69314fa49 23277->23278 23279 7ff6931562e8 _fread_nolock LeaveCriticalSection 23278->23279 23279->23274 23281->23274 23283 7ff693141a00 23282->23283 23284 7ff69314f93e 23282->23284 23283->23110 23283->23111 23284->23283 23285 7ff69314f98a 23284->23285 23286 7ff69314f94d memcpy_s 23284->23286 23295 7ff6931562dc EnterCriticalSection 23285->23295 23296 7ff693155e48 11 API calls _get_daylight 23286->23296 23288 7ff69314f992 23290 7ff69314f694 _fread_nolock 51 API calls 23288->23290 23292 7ff69314f9a9 23290->23292 23291 7ff69314f962 23297 7ff69315b824 37 API calls _invalid_parameter_noinfo 23291->23297 23294 7ff6931562e8 _fread_nolock LeaveCriticalSection 23292->23294 23294->23283 23296->23291 23297->23283 23298->23152 23300 7ff6931457b5 23299->23300 23301 7ff693141c60 49 API calls 23300->23301 23302 7ff6931457f1 23301->23302 23303 7ff69314581d 23302->23303 23304 7ff6931457fa 23302->23304 23306 7ff693143a40 49 API calls 23303->23306 23387 7ff693141e50 81 API calls _log10_special 23304->23387 23307 7ff693145835 23306->23307 23308 7ff693145853 23307->23308 23388 7ff693141e50 81 API calls _log10_special 23307->23388 23377 7ff693143970 23308->23377 23311 7ff69314bb10 _log10_special 8 API calls 23313 7ff69314272e 23311->23313 23313->23168 23330 7ff693145940 23313->23330 23314 7ff69314586b 23316 7ff693143a40 49 API calls 23314->23316 23315 7ff6931484c0 3 API calls 23315->23314 23317 7ff693145884 23316->23317 23318 7ff6931458a9 23317->23318 23319 7ff693145889 23317->23319 23383 7ff6931484c0 23318->23383 23389 7ff693141e50 81 API calls _log10_special 23319->23389 23322 7ff6931458b6 23323 7ff693145901 23322->23323 23324 7ff6931458c2 23322->23324 23391 7ff693144c40 166 API calls 23323->23391 23325 7ff693148950 2 API calls 23324->23325 23327 7ff6931458da GetLastError 23325->23327 23390 7ff693142310 80 API calls _log10_special 23327->23390 23329 7ff693145813 23329->23311 23392 7ff693144810 23330->23392 23332 7ff693145966 23333 7ff69314597f 23332->23333 23334 7ff69314596e 23332->23334 23399 7ff6931440a0 23333->23399 23417 7ff693141e50 81 API calls _log10_special 23334->23417 23338 7ff69314599c 23342 7ff6931459ac 23338->23342 23344 7ff6931459bd 23338->23344 23339 7ff69314598b 23418 7ff693141e50 81 API calls _log10_special 23339->23418 23341 7ff69314597a 23341->23164 23419 7ff693141e50 81 API calls _log10_special 23342->23419 23345 7ff6931459ed 23344->23345 23346 7ff6931459dc 23344->23346 23348 7ff693145a0d 23345->23348 23349 7ff6931459fc 23345->23349 23420 7ff693141e50 81 API calls _log10_special 23346->23420 23403 7ff693144160 23348->23403 23421 7ff693141e50 81 API calls _log10_special 23349->23421 23353 7ff693145a2d 23356 7ff693145a4d 23353->23356 23357 7ff693145a3c 23353->23357 23354 7ff693145a1c 23422 7ff693141e50 81 API calls _log10_special 23354->23422 23359 7ff693145a5f 23356->23359 23361 7ff693145a70 23356->23361 23423 7ff693141e50 81 API calls _log10_special 23357->23423 23424 7ff693141e50 81 API calls _log10_special 23359->23424 23363 7ff693145a9a 23361->23363 23425 7ff6931581ec 73 API calls 23361->23425 23363->23341 23427 7ff693141e50 81 API calls _log10_special 23363->23427 23364 7ff693145a88 23426 7ff6931581ec 73 API calls 23364->23426 23368 7ff6931454b0 23367->23368 23368->23368 23369 7ff6931454d9 23368->23369 23372 7ff6931454f0 __std_exception_copy 23368->23372 23459 7ff693141e50 81 API calls _log10_special 23369->23459 23371 7ff6931454e5 23371->23166 23374 7ff693141e50 81 API calls 23372->23374 23375 7ff6931455fb 23372->23375 23429 7ff693141450 23372->23429 23374->23372 23375->23166 23376->23168 23378 7ff69314397a 23377->23378 23379 7ff693148950 2 API calls 23378->23379 23380 7ff69314399f 23379->23380 23381 7ff69314bb10 _log10_special 8 API calls 23380->23381 23382 7ff6931439c7 23381->23382 23382->23314 23382->23315 23384 7ff693148950 2 API calls 23383->23384 23385 7ff6931484d4 LoadLibraryExW 23384->23385 23386 7ff6931484f3 __std_exception_copy 23385->23386 23386->23322 23387->23329 23388->23308 23389->23329 23390->23329 23391->23329 23394 7ff69314483c 23392->23394 23393 7ff693144844 23393->23332 23394->23393 23397 7ff6931449e4 23394->23397 23428 7ff693157a64 48 API calls 23394->23428 23395 7ff693144ba7 __std_exception_copy 23395->23332 23396 7ff693143be0 47 API calls 23396->23397 23397->23395 23397->23396 23400 7ff6931440d0 23399->23400 23401 7ff69314bb10 _log10_special 8 API calls 23400->23401 23402 7ff69314413a 23401->23402 23402->23338 23402->23339 23404 7ff693144175 23403->23404 23405 7ff693141c60 49 API calls 23404->23405 23406 7ff6931441c1 23405->23406 23407 7ff693141c60 49 API calls 23406->23407 23416 7ff693144243 __std_exception_copy 23406->23416 23409 7ff693144200 23407->23409 23408 7ff69314bb10 _log10_special 8 API calls 23410 7ff69314428e 23408->23410 23411 7ff693148950 2 API calls 23409->23411 23409->23416 23410->23353 23410->23354 23412 7ff693144216 23411->23412 23413 7ff693148950 2 API calls 23412->23413 23414 7ff69314422d 23413->23414 23415 7ff693148950 2 API calls 23414->23415 23415->23416 23416->23408 23417->23341 23418->23341 23419->23341 23420->23341 23421->23341 23422->23341 23423->23341 23424->23341 23425->23364 23426->23363 23427->23341 23428->23394 23430 7ff6931439d0 108 API calls 23429->23430 23431 7ff693141473 23430->23431 23432 7ff69314149c 23431->23432 23433 7ff69314147b 23431->23433 23435 7ff69314fc2c 73 API calls 23432->23435 23482 7ff693141e50 81 API calls _log10_special 23433->23482 23437 7ff6931414b1 23435->23437 23436 7ff69314148b 23436->23372 23438 7ff6931414d8 23437->23438 23439 7ff6931414b5 23437->23439 23443 7ff6931414e8 23438->23443 23444 7ff693141512 23438->23444 23483 7ff693155e48 11 API calls _get_daylight 23439->23483 23441 7ff6931414ba 23484 7ff693142020 87 API calls _log10_special 23441->23484 23485 7ff693155e48 11 API calls _get_daylight 23443->23485 23446 7ff693141518 23444->23446 23454 7ff69314152b 23444->23454 23460 7ff6931411f0 23446->23460 23447 7ff6931414f0 23486 7ff693142020 87 API calls _log10_special 23447->23486 23450 7ff69314f5a4 74 API calls 23453 7ff6931415a4 23450->23453 23451 7ff6931414d3 __std_exception_copy 23451->23450 23452 7ff69314f8f4 _fread_nolock 53 API calls 23452->23454 23453->23372 23454->23451 23454->23452 23455 7ff6931415b6 23454->23455 23487 7ff693155e48 11 API calls _get_daylight 23455->23487 23457 7ff6931415bb 23488 7ff693142020 87 API calls _log10_special 23457->23488 23459->23371 23461 7ff693141248 23460->23461 23462 7ff693141277 23461->23462 23463 7ff69314124f 23461->23463 23466 7ff693141291 23462->23466 23467 7ff6931412b4 23462->23467 23489 7ff693141e50 81 API calls _log10_special 23463->23489 23465 7ff693141262 23465->23451 23490 7ff693155e48 11 API calls _get_daylight 23466->23490 23471 7ff6931412c6 23467->23471 23480 7ff6931412e9 memcpy_s 23467->23480 23469 7ff693141296 23491 7ff693142020 87 API calls _log10_special 23469->23491 23492 7ff693155e48 11 API calls _get_daylight 23471->23492 23473 7ff6931412cb 23493 7ff693142020 87 API calls _log10_special 23473->23493 23474 7ff69314f8f4 _fread_nolock 53 API calls 23474->23480 23476 7ff6931412af __std_exception_copy 23476->23451 23477 7ff6931413af 23495 7ff693141e50 81 API calls _log10_special 23477->23495 23480->23474 23480->23476 23480->23477 23481 7ff69314f668 37 API calls 23480->23481 23494 7ff693150034 76 API calls 23480->23494 23481->23480 23482->23436 23483->23441 23484->23451 23485->23447 23486->23451 23487->23457 23488->23451 23489->23465 23490->23469 23491->23476 23492->23473 23493->23476 23494->23480 23495->23476 23498 7ff69315591e 23496->23498 23497 7ff693155943 23514 7ff69315b758 37 API calls 2 library calls 23497->23514 23498->23497 23500 7ff69315597f 23498->23500 23515 7ff6931527b8 49 API calls _invalid_parameter_noinfo 23500->23515 23502 7ff69315596d 23505 7ff69314bb10 _log10_special 8 API calls 23502->23505 23503 7ff693155a5c 23518 7ff69315b464 11 API calls 2 library calls 23503->23518 23507 7ff693141ca8 23505->23507 23506 7ff693155a16 23506->23503 23508 7ff693155a80 23506->23508 23509 7ff693155a31 23506->23509 23510 7ff693155a28 23506->23510 23507->22910 23508->23503 23511 7ff693155a8a 23508->23511 23516 7ff69315b464 11 API calls 2 library calls 23509->23516 23510->23503 23510->23509 23517 7ff69315b464 11 API calls 2 library calls 23511->23517 23514->23502 23515->23506 23516->23502 23517->23502 23518->23502 23522 7ff693156e88 23519->23522 23520 7ff693156eae 23550 7ff693155e48 11 API calls _get_daylight 23520->23550 23522->23520 23524 7ff693156ee1 23522->23524 23523 7ff693156eb3 23551 7ff69315b824 37 API calls _invalid_parameter_noinfo 23523->23551 23526 7ff693156ee7 23524->23526 23527 7ff693156ef4 23524->23527 23552 7ff693155e48 11 API calls _get_daylight 23526->23552 23538 7ff69315bb30 23527->23538 23529 7ff693143a26 23529->23182 23532 7ff693156f08 23553 7ff693155e48 11 API calls _get_daylight 23532->23553 23533 7ff693156f15 23545 7ff69316113c 23533->23545 23536 7ff693156f28 23554 7ff6931562e8 LeaveCriticalSection 23536->23554 23555 7ff693161548 EnterCriticalSection 23538->23555 23540 7ff69315bb47 23541 7ff69315bba4 19 API calls 23540->23541 23542 7ff69315bb52 23541->23542 23543 7ff6931615a8 _isindst LeaveCriticalSection 23542->23543 23544 7ff693156efe 23543->23544 23544->23532 23544->23533 23556 7ff693160e38 23545->23556 23548 7ff693161196 23548->23536 23550->23523 23551->23529 23552->23529 23553->23529 23561 7ff693160e73 __vcrt_FlsAlloc 23556->23561 23558 7ff693161111 23575 7ff69315b824 37 API calls _invalid_parameter_noinfo 23558->23575 23560 7ff693161043 23560->23548 23568 7ff693167fc4 23560->23568 23566 7ff69316103a 23561->23566 23571 7ff693158978 51 API calls 3 library calls 23561->23571 23563 7ff6931610a5 23563->23566 23572 7ff693158978 51 API calls 3 library calls 23563->23572 23565 7ff6931610c4 23565->23566 23573 7ff693158978 51 API calls 3 library calls 23565->23573 23566->23560 23574 7ff693155e48 11 API calls _get_daylight 23566->23574 23576 7ff6931675c4 23568->23576 23571->23563 23572->23565 23573->23566 23574->23558 23575->23560 23577 7ff6931675db 23576->23577 23579 7ff6931675f9 23576->23579 23630 7ff693155e48 11 API calls _get_daylight 23577->23630 23579->23577 23581 7ff693167615 23579->23581 23580 7ff6931675e0 23631 7ff69315b824 37 API calls _invalid_parameter_noinfo 23580->23631 23587 7ff693167bd4 23581->23587 23585 7ff6931675ec 23585->23548 23633 7ff693167908 23587->23633 23590 7ff693167c49 23665 7ff693155e28 11 API calls _get_daylight 23590->23665 23591 7ff693167c61 23653 7ff69315945c 23591->23653 23604 7ff693167640 23604->23585 23632 7ff693159434 LeaveCriticalSection 23604->23632 23611 7ff693167c4e 23666 7ff693155e48 11 API calls _get_daylight 23611->23666 23630->23580 23631->23585 23634 7ff693167934 23633->23634 23642 7ff69316794e 23633->23642 23634->23642 23678 7ff693155e48 11 API calls _get_daylight 23634->23678 23636 7ff693167943 23679 7ff69315b824 37 API calls _invalid_parameter_noinfo 23636->23679 23638 7ff693167a1d 23651 7ff693167a7a 23638->23651 23684 7ff69315aab0 37 API calls 2 library calls 23638->23684 23639 7ff6931679cc 23639->23638 23682 7ff693155e48 11 API calls _get_daylight 23639->23682 23642->23639 23680 7ff693155e48 11 API calls _get_daylight 23642->23680 23643 7ff693167a76 23646 7ff693167af8 23643->23646 23643->23651 23644 7ff693167a12 23683 7ff69315b824 37 API calls _invalid_parameter_noinfo 23644->23683 23685 7ff69315b844 17 API calls _CallSETranslator 23646->23685 23648 7ff6931679c1 23681 7ff69315b824 37 API calls _invalid_parameter_noinfo 23648->23681 23651->23590 23651->23591 23686 7ff693161548 EnterCriticalSection 23653->23686 23665->23611 23666->23604 23678->23636 23679->23642 23680->23648 23681->23639 23682->23644 23683->23638 23684->23643 23688 7ff693158834 23687->23688 23691 7ff693158310 23688->23691 23690 7ff69315884d 23690->23192 23692 7ff69315832b 23691->23692 23693 7ff69315835a 23691->23693 23702 7ff69315b758 37 API calls 2 library calls 23692->23702 23701 7ff6931562dc EnterCriticalSection 23693->23701 23696 7ff69315835f 23697 7ff69315837c 38 API calls 23696->23697 23698 7ff69315836b 23697->23698 23699 7ff6931562e8 _fread_nolock LeaveCriticalSection 23698->23699 23700 7ff69315834b 23699->23700 23700->23690 23702->23700 23704 7ff69314f39b 23703->23704 23705 7ff69314f3c9 23703->23705 23714 7ff69315b758 37 API calls 2 library calls 23704->23714 23712 7ff69314f3bb 23705->23712 23713 7ff6931562dc EnterCriticalSection 23705->23713 23708 7ff69314f3e0 23709 7ff69314f3fc 72 API calls 23708->23709 23710 7ff69314f3ec 23709->23710 23711 7ff6931562e8 _fread_nolock LeaveCriticalSection 23710->23711 23711->23712 23712->23196 23714->23712 23715->23214 23852 7ff693160bfc 55 API calls 3 library calls 23889 7ff6931442f6 MultiByteToWideChar MultiByteToWideChar 23820 7ff693147500 112 API calls 23821 7ff693161500 7 API calls 23822 7ff69314c110 57 API calls 2 library calls 23853 7ff69315ac10 GetCommandLineA GetCommandLineW

                                                                  Executed Functions

                                                                  Function 00007FF693167BD4 Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON
                                                                  Download Yara Rule

                                                                  Control-flow Graph

                                                                  • Executed
                                                                  • Not Executed
                                                                  control_flow_graph 473 7ff693167bd4-7ff693167c47 call 7ff693167908 476 7ff693167c49-7ff693167c52 call 7ff693155e28 473->476 477 7ff693167c61-7ff693167c6b call 7ff69315945c 473->477 484 7ff693167c55-7ff693167c5c call 7ff693155e48 476->484 482 7ff693167c6d-7ff693167c84 call 7ff693155e28 call 7ff693155e48 477->482 483 7ff693167c86-7ff693167cef CreateFileW 477->483 482->484 486 7ff693167d6c-7ff693167d77 GetFileType 483->486 487 7ff693167cf1-7ff693167cf7 483->487 495 7ff693167fa2-7ff693167fc2 484->495 489 7ff693167dca-7ff693167dd1 486->489 490 7ff693167d79-7ff693167db4 GetLastError call 7ff693155dbc CloseHandle 486->490 492 7ff693167d39-7ff693167d67 GetLastError call 7ff693155dbc 487->492 493 7ff693167cf9-7ff693167cfd 487->493 498 7ff693167dd9-7ff693167ddc 489->498 499 7ff693167dd3-7ff693167dd7 489->499 490->484 507 7ff693167dba-7ff693167dc5 call 7ff693155e48 490->507 492->484 493->492 500 7ff693167cff-7ff693167d37 CreateFileW 493->500 504 7ff693167de2-7ff693167e37 call 7ff693159374 498->504 505 7ff693167dde 498->505 499->504 500->486 500->492 512 7ff693167e56-7ff693167e87 call 7ff693167688 504->512 513 7ff693167e39-7ff693167e45 call 7ff693167b10 504->513 505->504 507->484 519 7ff693167e8d-7ff693167ecf 512->519 520 7ff693167e89-7ff693167e8b 512->520 513->512 518 7ff693167e47 513->518 521 7ff693167e49-7ff693167e51 call 7ff69315b9c8 518->521 522 7ff693167ef1-7ff693167efc 519->522 523 7ff693167ed1-7ff693167ed5 519->523 520->521 521->495 526 7ff693167f02-7ff693167f06 522->526 527 7ff693167fa0 522->527 523->522 525 7ff693167ed7-7ff693167eec 523->525 525->522 526->527 529 7ff693167f0c-7ff693167f51 CloseHandle CreateFileW 526->529 527->495 530 7ff693167f86-7ff693167f9b 529->530 531 7ff693167f53-7ff693167f81 GetLastError call 7ff693155dbc call 7ff69315959c 529->531 530->527 531->530
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
                                                                  • String ID:
                                                                  • API String ID: 1617910340-0
                                                                  • Opcode ID: f7d25cc6398c99507331e2d119a18c280b6cb5988aed80ed714a7f2df808d279
                                                                  • Instruction ID: 077b25b95e42195b28537942c698ecefb1e223a6f71adecb85019c737f3eb948
                                                                  • Opcode Fuzzy Hash: f7d25cc6398c99507331e2d119a18c280b6cb5988aed80ed714a7f2df808d279
                                                                  • Instruction Fuzzy Hash: 84C1C433B28A4286EB20CFA5D4925BC3769F749BA8B011275DF2EA77A5DF38D455C300
                                                                  Function 00007FF693148840 Relevance: 3.0, APIs: 2, Instructions: 29COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: Find$CloseFileFirst
                                                                  • String ID:
                                                                  • API String ID: 2295610775-0
                                                                  • Opcode ID: c8bb1e00aee5117eaed99adb2432ba14ac7573cdfbb2fa81c580c042f8a510df
                                                                  • Instruction ID: 9db1f774c6f5699fd3a66dc43ce68198395d57899684be8547f387f3364b13f5
                                                                  • Opcode Fuzzy Hash: c8bb1e00aee5117eaed99adb2432ba14ac7573cdfbb2fa81c580c042f8a510df
                                                                  • Instruction Fuzzy Hash: 8BF0C832A1864286F7B08B60B44A3667394FB8436CF004336DA6E536E4CF3CD4098B00
                                                                  Function 00007FF693141000 Relevance: 61.8, APIs: 3, Strings: 32, Instructions: 527COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: ErrorFileLastModuleName
                                                                  • String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$hide-early$hide-late$minimize-early$minimize-late$pkg$pyi-contents-directory$pyi-hide-console$pyi-python-flag$pyi-runtime-tmpdir
                                                                  • API String ID: 2776309574-3325264605
                                                                  • Opcode ID: 8003e51332098fc3d087e628d6b38fac2f47f9f0aff8c5ec283e54e7f5b35d36
                                                                  • Instruction ID: 06020492402d739e1013ea8a8b6d4636c2749ae603f9c99ad1de84d2290c77bc
                                                                  • Opcode Fuzzy Hash: 8003e51332098fc3d087e628d6b38fac2f47f9f0aff8c5ec283e54e7f5b35d36
                                                                  • Instruction Fuzzy Hash: A542A021A0C68291FB359B21E41B2F97659EF54788F8444B2DA9EE32F6EF2CE555C300
                                                                  Function 00007FF693141930 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184COMMON
                                                                  Download Yara Rule

                                                                  Control-flow Graph

                                                                  • Executed
                                                                  • Not Executed
                                                                  control_flow_graph 295 7ff693141930-7ff69314196b call 7ff6931439d0 298 7ff693141971-7ff6931419b1 call 7ff6931473d0 295->298 299 7ff693141c2e-7ff693141c52 call 7ff69314bb10 295->299 304 7ff6931419b7-7ff6931419c7 call 7ff69314fc2c 298->304 305 7ff693141c1b-7ff693141c1e call 7ff69314f5a4 298->305 310 7ff6931419c9-7ff6931419e3 call 7ff693155e48 call 7ff693142020 304->310 311 7ff6931419e8-7ff693141a04 call 7ff69314f8f4 304->311 309 7ff693141c23-7ff693141c2b 305->309 309->299 310->305 317 7ff693141a06-7ff693141a20 call 7ff693155e48 call 7ff693142020 311->317 318 7ff693141a25-7ff693141a3a call 7ff693155e68 311->318 317->305 324 7ff693141a3c-7ff693141a56 call 7ff693155e48 call 7ff693142020 318->324 325 7ff693141a5b-7ff693141adc call 7ff693141c60 * 2 call 7ff69314fc2c 318->325 324->305 337 7ff693141ae1-7ff693141af4 call 7ff693155e84 325->337 340 7ff693141af6-7ff693141b10 call 7ff693155e48 call 7ff693142020 337->340 341 7ff693141b15-7ff693141b2e call 7ff69314f8f4 337->341 340->305 347 7ff693141b30-7ff693141b4a call 7ff693155e48 call 7ff693142020 341->347 348 7ff693141b4f-7ff693141b6b call 7ff69314f668 341->348 347->305 354 7ff693141b6d-7ff693141b79 call 7ff693141e50 348->354 355 7ff693141b7e-7ff693141b8c 348->355 354->305 355->305 358 7ff693141b92-7ff693141b99 355->358 361 7ff693141ba1-7ff693141ba7 358->361 362 7ff693141ba9-7ff693141bb6 361->362 363 7ff693141bc0-7ff693141bcf 361->363 364 7ff693141bd1-7ff693141bda 362->364 363->363 363->364 365 7ff693141bdc-7ff693141bdf 364->365 366 7ff693141bef 364->366 365->366 367 7ff693141be1-7ff693141be4 365->367 368 7ff693141bf1-7ff693141c04 366->368 367->366 371 7ff693141be6-7ff693141be9 367->371 369 7ff693141c06 368->369 370 7ff693141c0d-7ff693141c19 368->370 369->370 370->305 370->361 371->366 372 7ff693141beb-7ff693141bed 371->372 372->368
                                                                  APIs
                                                                    • Part of subcall function 00007FF6931473D0: _fread_nolock.LIBCMT ref: 00007FF69314747A
                                                                  • _fread_nolock.LIBCMT ref: 00007FF6931419FB
                                                                    • Part of subcall function 00007FF693142020: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF693141B4A), ref: 00007FF693142070
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: _fread_nolock$CurrentProcess
                                                                  • String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
                                                                  • API String ID: 2397952137-3497178890
                                                                  • Opcode ID: f0e4dad6824781d39599ac494fa8e13f6c95adccbb4d4460a9139922807186eb
                                                                  • Instruction ID: 5f17ad28f35fd355e00d93dc9d84fa68d340ecc8a0f5384b3d6b6ecd18aa1525
                                                                  • Opcode Fuzzy Hash: f0e4dad6824781d39599ac494fa8e13f6c95adccbb4d4460a9139922807186eb
                                                                  • Instruction Fuzzy Hash: 95818331A0C68685EB34DB64D44B2F973A9FF48788F448076D98DE77A5DE3CE5858B00
                                                                  Function 00007FF693141450 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107COMMON
                                                                  Download Yara Rule

                                                                  Control-flow Graph

                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: CurrentProcess
                                                                  • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                  • API String ID: 2050909247-3659356012
                                                                  • Opcode ID: 1cbbf0c9e35d5c8327337db99d93bd7b5d055fa8e2d224a3966b279cac78dd89
                                                                  • Instruction ID: 082abb0964cfe673ffb3c9542cea481adf5fd83e95bc57d5c1abc75767c71f2f
                                                                  • Opcode Fuzzy Hash: 1cbbf0c9e35d5c8327337db99d93bd7b5d055fa8e2d224a3966b279cac78dd89
                                                                  • Instruction Fuzzy Hash: FA418F32A0C68285EB24DB61D4065F97399FF4979CF4444B2ED0DABBB5DE3CE5128700
                                                                  Function 00007FF6931411F0 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158COMMON
                                                                  Download Yara Rule

                                                                  Control-flow Graph

                                                                  • Executed
                                                                  • Not Executed
                                                                  control_flow_graph 536 7ff6931411f0-7ff69314124d call 7ff69314b340 539 7ff693141277-7ff69314128f call 7ff693155e84 536->539 540 7ff69314124f-7ff693141276 call 7ff693141e50 536->540 545 7ff693141291-7ff6931412af call 7ff693155e48 call 7ff693142020 539->545 546 7ff6931412b4-7ff6931412c4 call 7ff693155e84 539->546 559 7ff693141419-7ff69314144d call 7ff69314b020 call 7ff693155e70 * 2 545->559 552 7ff6931412e9-7ff6931412fb 546->552 553 7ff6931412c6-7ff6931412e4 call 7ff693155e48 call 7ff693142020 546->553 554 7ff693141300-7ff69314131d call 7ff69314f8f4 552->554 553->559 562 7ff693141322-7ff693141325 554->562 565 7ff69314132b-7ff693141335 call 7ff69314f668 562->565 566 7ff693141411 562->566 565->566 572 7ff69314133b-7ff693141347 565->572 566->559 574 7ff693141350-7ff693141378 call 7ff693149780 572->574 577 7ff6931413f6-7ff69314140c call 7ff693141e50 574->577 578 7ff69314137a-7ff69314137d 574->578 577->566 580 7ff6931413f1 578->580 581 7ff69314137f-7ff693141389 578->581 580->577 582 7ff69314138b-7ff6931413a1 call 7ff693150034 581->582 583 7ff6931413b4-7ff6931413b7 581->583 590 7ff6931413af-7ff6931413b2 582->590 591 7ff6931413a3-7ff6931413ad call 7ff69314f668 582->591 585 7ff6931413b9-7ff6931413c7 call 7ff69316b0a0 583->585 586 7ff6931413ca-7ff6931413cf 583->586 585->586 586->574 589 7ff6931413d5-7ff6931413d8 586->589 593 7ff6931413ec-7ff6931413ef 589->593 594 7ff6931413da-7ff6931413dd 589->594 590->577 591->586 591->590 593->566 594->577 596 7ff6931413df-7ff6931413e7 594->596 596->554
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: CurrentProcess
                                                                  • String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
                                                                  • API String ID: 2050909247-2813020118
                                                                  • Opcode ID: 8a0332b0341f50a67e73ec307c9098d338b417508224822c74ba95814737376c
                                                                  • Instruction ID: caecc180995c88a2868fbd3dd990bd472585de48f401d466723112b343aff536
                                                                  • Opcode Fuzzy Hash: 8a0332b0341f50a67e73ec307c9098d338b417508224822c74ba95814737376c
                                                                  • Instruction Fuzzy Hash: 2C51F332A0C68281EA34AB62A4563BA7299FF84798F444175ED4DE77F6EF3CE445C700
                                                                  Function 00007FF693142A70 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61COMMON
                                                                  Download Yara Rule

                                                                  Control-flow Graph

                                                                  APIs
                                                                  • GetModuleFileNameW.KERNEL32(?,00007FF693142BC5), ref: 00007FF693142AA1
                                                                  • GetLastError.KERNEL32(?,00007FF693142BC5), ref: 00007FF693142AAB
                                                                    • Part of subcall function 00007FF693142310: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF693142AC6,?,00007FF693142BC5), ref: 00007FF693142360
                                                                    • Part of subcall function 00007FF693142310: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF693142AC6,?,00007FF693142BC5), ref: 00007FF69314241A
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: CurrentErrorFileFormatLastMessageModuleNameProcess
                                                                  • String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
                                                                  • API String ID: 4002088556-2863816727
                                                                  • Opcode ID: 093d1e49c6a3f32bbd7db28c580ca23961d52f0e240546522d41da137270d6a4
                                                                  • Instruction ID: 4d5730ae485ed87d6c43098b5b27c280b6b54bc9e91a45e0f36d06a19ce1fda6
                                                                  • Opcode Fuzzy Hash: 093d1e49c6a3f32bbd7db28c580ca23961d52f0e240546522d41da137270d6a4
                                                                  • Instruction Fuzzy Hash: C6218661B1C64281FB309B24E81B3B67259FF5838CF8042B6E55DE75F5EE2CE5458304
                                                                  Function 00007FF69315C95C Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE
                                                                  Download Yara Rule

                                                                  Control-flow Graph

                                                                  • Executed
                                                                  • Not Executed
                                                                  control_flow_graph 697 7ff69315c95c-7ff69315c982 698 7ff69315c99d-7ff69315c9a1 697->698 699 7ff69315c984-7ff69315c998 call 7ff693155e28 call 7ff693155e48 697->699 700 7ff69315cd77-7ff69315cd83 call 7ff693155e28 call 7ff693155e48 698->700 701 7ff69315c9a7-7ff69315c9ae 698->701 713 7ff69315cd8e 699->713 720 7ff69315cd89 call 7ff69315b824 700->720 701->700 704 7ff69315c9b4-7ff69315c9e2 701->704 704->700 707 7ff69315c9e8-7ff69315c9ef 704->707 710 7ff69315ca08-7ff69315ca0b 707->710 711 7ff69315c9f1-7ff69315ca03 call 7ff693155e28 call 7ff693155e48 707->711 716 7ff69315cd73-7ff69315cd75 710->716 717 7ff69315ca11-7ff69315ca17 710->717 711->720 718 7ff69315cd91-7ff69315cda8 713->718 716->718 717->716 721 7ff69315ca1d-7ff69315ca20 717->721 720->713 721->711 724 7ff69315ca22-7ff69315ca47 721->724 725 7ff69315ca7a-7ff69315ca81 724->725 726 7ff69315ca49-7ff69315ca4b 724->726 730 7ff69315ca56-7ff69315ca6d call 7ff693155e28 call 7ff693155e48 call 7ff69315b824 725->730 731 7ff69315ca83-7ff69315ca8f call 7ff69315e6c4 725->731 728 7ff69315ca4d-7ff69315ca54 726->728 729 7ff69315ca72-7ff69315ca78 726->729 728->729 728->730 733 7ff69315caf8-7ff69315cb0f 729->733 762 7ff69315cc00 730->762 738 7ff69315ca94-7ff69315caab call 7ff69315b464 * 2 731->738 736 7ff69315cb8a-7ff69315cb94 call 7ff693164b8c 733->736 737 7ff69315cb11-7ff69315cb19 733->737 749 7ff69315cb9a-7ff69315cbaf 736->749 750 7ff69315cc1e 736->750 737->736 741 7ff69315cb1b-7ff69315cb1d 737->741 758 7ff69315caad-7ff69315cac3 call 7ff693155e48 call 7ff693155e28 738->758 759 7ff69315cac8-7ff69315caf3 call 7ff69315d184 738->759 741->736 745 7ff69315cb1f-7ff69315cb35 741->745 745->736 751 7ff69315cb37-7ff69315cb43 745->751 749->750 755 7ff69315cbb1-7ff69315cbc3 GetConsoleMode 749->755 753 7ff69315cc23-7ff69315cc43 ReadFile 750->753 751->736 756 7ff69315cb45-7ff69315cb47 751->756 760 7ff69315cd3d-7ff69315cd46 GetLastError 753->760 761 7ff69315cc49-7ff69315cc51 753->761 755->750 763 7ff69315cbc5-7ff69315cbcd 755->763 756->736 757 7ff69315cb49-7ff69315cb61 756->757 757->736 764 7ff69315cb63-7ff69315cb6f 757->764 758->762 759->733 769 7ff69315cd48-7ff69315cd5e call 7ff693155e48 call 7ff693155e28 760->769 770 7ff69315cd63-7ff69315cd66 760->770 761->760 766 7ff69315cc57 761->766 771 7ff69315cc03-7ff69315cc0d call 7ff69315b464 762->771 763->753 768 7ff69315cbcf-7ff69315cbf1 ReadConsoleW 763->768 764->736 773 7ff69315cb71-7ff69315cb73 764->773 777 7ff69315cc5e-7ff69315cc73 766->777 779 7ff69315cbf3 GetLastError 768->779 780 7ff69315cc12-7ff69315cc1c 768->780 769->762 774 7ff69315cd6c-7ff69315cd6e 770->774 775 7ff69315cbf9-7ff69315cbfb call 7ff693155dbc 770->775 771->718 773->736 783 7ff69315cb75-7ff69315cb85 773->783 774->771 775->762 777->771 785 7ff69315cc75-7ff69315cc80 777->785 779->775 780->777 783->736 790 7ff69315cca7-7ff69315ccaf 785->790 791 7ff69315cc82-7ff69315cc9b call 7ff69315c574 785->791 794 7ff69315cd2b-7ff69315cd38 call 7ff69315c3b4 790->794 795 7ff69315ccb1-7ff69315ccc3 790->795 797 7ff69315cca0-7ff69315cca2 791->797 794->797 798 7ff69315ccc5 795->798 799 7ff69315cd1e-7ff69315cd26 795->799 797->771 801 7ff69315ccca-7ff69315ccd1 798->801 799->771 802 7ff69315cd0d-7ff69315cd18 801->802 803 7ff69315ccd3-7ff69315ccd7 801->803 802->799 804 7ff69315ccd9-7ff69315cce0 803->804 805 7ff69315ccf3 803->805 804->805 806 7ff69315cce2-7ff69315cce6 804->806 807 7ff69315ccf9-7ff69315cd09 805->807 806->805 808 7ff69315cce8-7ff69315ccf1 806->808 807->801 809 7ff69315cd0b 807->809 808->807 809->799
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: _invalid_parameter_noinfo
                                                                  • String ID:
                                                                  • API String ID: 3215553584-0
                                                                  • Opcode ID: eb536eff56005b26acab214ddad3b7f617f69f6ae0f39e6e286dc3f6b59ee020
                                                                  • Instruction ID: f094827bf25e04ef7dafc68906379d3e7d6e51e62602943da3240c8af9a23977
                                                                  • Opcode Fuzzy Hash: eb536eff56005b26acab214ddad3b7f617f69f6ae0f39e6e286dc3f6b59ee020
                                                                  • Instruction Fuzzy Hash: A1C1EF36A0CA8281E7718F1594422BE7BA8FB81BC0F5951B1DA4EE37B1DF7CE8558740
                                                                  Function 00007FF6931457A0 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82COMMON
                                                                  Download Yara Rule

                                                                  Control-flow Graph

                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: CurrentProcess
                                                                  • String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
                                                                  • API String ID: 2050909247-2434346643
                                                                  • Opcode ID: 7a55adeaadc319c70d2ba838d1fcf91999e9c466860aec4aa2ab7dbe0270684a
                                                                  • Instruction ID: 6a790a74f9424fb5c7ace94a44911699cbf214181b679d4ad414b3e07e75e522
                                                                  • Opcode Fuzzy Hash: 7a55adeaadc319c70d2ba838d1fcf91999e9c466860aec4aa2ab7dbe0270684a
                                                                  • Instruction Fuzzy Hash: 7941B231A1CA8791EA31DB60E40A1E97319FF4478CF804172EA5DA32E6EF3CE615C340
                                                                  Function 00007FF6931565E4 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON
                                                                  Download Yara Rule

                                                                  Control-flow Graph

                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: CloseCreateFileHandle_invalid_parameter_noinfo
                                                                  • String ID:
                                                                  • API String ID: 1279662727-0
                                                                  • Opcode ID: a7851f35165aa053145fe01894016aececa3f2381e8a001c745c02259ff3d92e
                                                                  • Instruction ID: c6101418a6dff8af604212451d34d5cf88fd629f2995815294ab20c306008877
                                                                  • Opcode Fuzzy Hash: a7851f35165aa053145fe01894016aececa3f2381e8a001c745c02259ff3d92e
                                                                  • Instruction Fuzzy Hash: 5241A232E1878283E7648B61D5123697264FB95364F10A374E69C93AE5DF6CA1E08740
                                                                  Function 00007FF69314F694 Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE
                                                                  Download Yara Rule

                                                                  Control-flow Graph

                                                                  • Executed
                                                                  • Not Executed
                                                                  control_flow_graph 914 7ff69314f694-7ff69314f6c1 915 7ff69314f6dd 914->915 916 7ff69314f6c3-7ff69314f6c6 914->916 917 7ff69314f6df-7ff69314f6f3 915->917 916->915 918 7ff69314f6c8-7ff69314f6cb 916->918 919 7ff69314f6cd-7ff69314f6d2 call 7ff693155e48 918->919 920 7ff69314f6f4-7ff69314f6f7 918->920 928 7ff69314f6d8 call 7ff69315b824 919->928 921 7ff69314f707-7ff69314f70b 920->921 922 7ff69314f6f9-7ff69314f705 920->922 926 7ff69314f70d-7ff69314f717 call 7ff69316b740 921->926 927 7ff69314f71f-7ff69314f722 921->927 922->921 925 7ff69314f732-7ff69314f73b 922->925 931 7ff69314f73d-7ff69314f740 925->931 932 7ff69314f742 925->932 926->927 927->919 930 7ff69314f724-7ff69314f730 927->930 928->915 930->919 930->925 933 7ff69314f747-7ff69314f766 931->933 932->933 936 7ff69314f76c-7ff69314f77a 933->936 937 7ff69314f8ad-7ff69314f8b0 933->937 938 7ff69314f77c-7ff69314f783 936->938 939 7ff69314f7f2-7ff69314f7f7 936->939 937->917 938->939 940 7ff69314f785 938->940 941 7ff69314f7f9-7ff69314f805 939->941 942 7ff69314f864-7ff69314f867 call 7ff69315cdac 939->942 943 7ff69314f78b-7ff69314f795 940->943 944 7ff69314f8d8 940->944 945 7ff69314f807-7ff69314f80e 941->945 946 7ff69314f811-7ff69314f817 941->946 948 7ff69314f86c-7ff69314f86f 942->948 949 7ff69314f79b-7ff69314f7a1 943->949 950 7ff69314f8b5-7ff69314f8b9 943->950 952 7ff69314f8dd-7ff69314f8e8 944->952 945->946 946->950 951 7ff69314f81d-7ff69314f83a call 7ff69315b384 call 7ff69315c95c 946->951 948->952 953 7ff69314f871-7ff69314f874 948->953 954 7ff69314f7d9-7ff69314f7ed 949->954 955 7ff69314f7a3-7ff69314f7a6 949->955 956 7ff69314f8bb-7ff69314f8c3 call 7ff69316b740 950->956 957 7ff69314f8c8-7ff69314f8d3 call 7ff693155e48 950->957 973 7ff69314f83f-7ff69314f841 951->973 952->917 953->950 959 7ff69314f876-7ff69314f88d 953->959 960 7ff69314f894-7ff69314f89f 954->960 961 7ff69314f7a8-7ff69314f7ae 955->961 962 7ff69314f7c4-7ff69314f7cf call 7ff693155e48 call 7ff69315b824 955->962 956->957 957->928 959->960 960->936 966 7ff69314f8a5 960->966 967 7ff69314f7ba-7ff69314f7bf call 7ff69316b740 961->967 968 7ff69314f7b0-7ff69314f7b8 call 7ff69316b0a0 961->968 980 7ff69314f7d4 962->980 966->937 967->962 968->980 978 7ff69314f8ed-7ff69314f8f2 973->978 979 7ff69314f847 973->979 978->952 979->944 981 7ff69314f84d-7ff69314f862 979->981 980->954 981->960
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: _invalid_parameter_noinfo
                                                                  • String ID:
                                                                  • API String ID: 3215553584-0
                                                                  • Opcode ID: 141dc46c6224036006d776e19841065f05dd1418e65b387591b1a003cf84bd0f
                                                                  • Instruction ID: 27e1e26afbec4f90bb7059ce90127b5a36ea01c2cc150e1e24d148bea00ed68d
                                                                  • Opcode Fuzzy Hash: 141dc46c6224036006d776e19841065f05dd1418e65b387591b1a003cf84bd0f
                                                                  • Instruction Fuzzy Hash: EB513822B0928686FA349E26940A67A7289FF44BACF148770DE6DE77F5CF3CD4518700
                                                                  Function 00007FF69314C1FC Relevance: 3.1, APIs: 2, Instructions: 102COMMON
                                                                  Download Yara Rule

                                                                  Control-flow Graph

                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
                                                                  • String ID:
                                                                  • API String ID: 1236291503-0
                                                                  • Opcode ID: bbbb43f9e1356fc36a8983c03ebcc8b7addcb0e166801d8c410c30bb16f29642
                                                                  • Instruction ID: db10444e2a0d90b4f1faed767595163132697c13c7e0237d4db5e842fefb0620
                                                                  • Opcode Fuzzy Hash: bbbb43f9e1356fc36a8983c03ebcc8b7addcb0e166801d8c410c30bb16f29642
                                                                  • Instruction Fuzzy Hash: 6E318F25E0C14352FA34ABA5A15B3B93399EF48788F4450B5E94DF76F3DE6DB8048305
                                                                  Function 00007FF69315D318 Relevance: 3.1, APIs: 2, Instructions: 71COMMON
                                                                  Download Yara Rule

                                                                  Control-flow Graph

                                                                  • Executed
                                                                  • Not Executed
                                                                  control_flow_graph 1043 7ff69315d318-7ff69315d333 1044 7ff69315d336-7ff69315d35f 1043->1044 1045 7ff69315d36b-7ff69315d374 1044->1045 1046 7ff69315d361-7ff69315d366 1044->1046 1048 7ff69315d38c 1045->1048 1049 7ff69315d376-7ff69315d379 1045->1049 1047 7ff69315d3f6-7ff69315d3ff 1046->1047 1047->1044 1050 7ff69315d405-7ff69315d41f 1047->1050 1053 7ff69315d391-7ff69315d3a2 GetStdHandle 1048->1053 1051 7ff69315d37b-7ff69315d383 1049->1051 1052 7ff69315d385-7ff69315d38a 1049->1052 1051->1053 1052->1053 1054 7ff69315d3a4-7ff69315d3af GetFileType 1053->1054 1055 7ff69315d3d1-7ff69315d3e9 1053->1055 1054->1055 1057 7ff69315d3b1-7ff69315d3bc 1054->1057 1055->1047 1056 7ff69315d3eb-7ff69315d3ef 1055->1056 1056->1047 1058 7ff69315d3c5-7ff69315d3c8 1057->1058 1059 7ff69315d3be-7ff69315d3c3 1057->1059 1058->1047 1060 7ff69315d3ca-7ff69315d3cf 1058->1060 1059->1047 1060->1047
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: FileHandleType
                                                                  • String ID:
                                                                  • API String ID: 3000768030-0
                                                                  • Opcode ID: b01a8b1655aeb6f71db35254c5ecf6a703e147159c44eee076082fbba724bcfb
                                                                  • Instruction ID: c6409015d30c0201f883025e13f929d8102f8e6508d96fbd7f178d23ed9d056c
                                                                  • Opcode Fuzzy Hash: b01a8b1655aeb6f71db35254c5ecf6a703e147159c44eee076082fbba724bcfb
                                                                  • Instruction Fuzzy Hash: A8319561A28B4681D7B08B1585811797654FB55BB0F6413B9DBAEE73F0CF38E451D300
                                                                  Function 00007FF69315D034 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE
                                                                  Download Yara Rule

                                                                  Control-flow Graph

                                                                  APIs
                                                                  • SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF69315D020,?,?,?,?,?,00007FF69315D129), ref: 00007FF69315D080
                                                                  • GetLastError.KERNEL32(?,?,?,?,?,00007FF69315D020,?,?,?,?,?,00007FF69315D129), ref: 00007FF69315D08A
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: ErrorFileLastPointer
                                                                  • String ID:
                                                                  • API String ID: 2976181284-0
                                                                  • Opcode ID: fb6a81950565da05b050a92576ed7c02e19ce8787ed1f1a96796d90f6b6408b2
                                                                  • Instruction ID: b232c86fb1ca3826c25559ab381b46f79d37f639e3ea5398ce6098ddf3f8b5ef
                                                                  • Opcode Fuzzy Hash: fb6a81950565da05b050a92576ed7c02e19ce8787ed1f1a96796d90f6b6408b2
                                                                  • Instruction Fuzzy Hash: 06110162A18B8281DA208B25B441069B365EB40FF4F540371EE7EDB7F8CF3CD0558704
                                                                  Function 00007FF69315BA60 Relevance: 2.6, APIs: 2, Instructions: 59COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • CloseHandle.KERNELBASE(?,?,?,00007FF69315B8DD,?,?,00000000,00007FF69315B992), ref: 00007FF69315BACE
                                                                  • GetLastError.KERNEL32(?,?,?,00007FF69315B8DD,?,?,00000000,00007FF69315B992), ref: 00007FF69315BAD8
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: CloseErrorHandleLast
                                                                  • String ID:
                                                                  • API String ID: 918212764-0
                                                                  • Opcode ID: ee1f6f2c17bcac9912aebe9a75d3c59e1af1689cfc13c1c78b5a219ca8e97850
                                                                  • Instruction ID: 077627bf2730011bd105e6a5c4bafca39527719749e14a42c4d381f2a6520046
                                                                  • Opcode Fuzzy Hash: ee1f6f2c17bcac9912aebe9a75d3c59e1af1689cfc13c1c78b5a219ca8e97850
                                                                  • Instruction Fuzzy Hash: AB210A20F0D68241FE705761A4932BD36CAEF847A4F4492B5EA2EE77F1DE6CE4858301
                                                                  Function 00007FF69315CDAC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: _invalid_parameter_noinfo
                                                                  • String ID:
                                                                  • API String ID: 3215553584-0
                                                                  • Opcode ID: cf3d959f73a155a0d737dce44897d7a2acb78217b54b69b3c35a670fde34ce7f
                                                                  • Instruction ID: 4bf7a652f21fdf8d50ba15ead130dc235e550dfaca6933815a5622765ea64a0e
                                                                  • Opcode Fuzzy Hash: cf3d959f73a155a0d737dce44897d7a2acb78217b54b69b3c35a670fde34ce7f
                                                                  • Instruction Fuzzy Hash: 7E41F33694824287EA74CF19E54227D7BA8EB55B84F100171EA8EE3AE0CF7DE442C791
                                                                  Function 00007FF6931473D0 Relevance: 1.6, APIs: 1, Instructions: 85COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: _fread_nolock
                                                                  • String ID:
                                                                  • API String ID: 840049012-0
                                                                  • Opcode ID: fc3bf027eb3f861870c612c146644541cbcda1c53177062a94ffaef22df04a2d
                                                                  • Instruction ID: 1becd13beb4e47b4161862a513f79a9a06992ee8aab36e88fa66baf5000552cd
                                                                  • Opcode Fuzzy Hash: fc3bf027eb3f861870c612c146644541cbcda1c53177062a94ffaef22df04a2d
                                                                  • Instruction Fuzzy Hash: 5D219621B0869246FA309B12750A3BABA4AFF45BDCF8C44B0DD9D97796CE7CE442C300
                                                                  Function 00007FF69315C83C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: _invalid_parameter_noinfo
                                                                  • String ID:
                                                                  • API String ID: 3215553584-0
                                                                  • Opcode ID: 91dc31986c532176c65ca0e3ff35a3bba52d03db3277bf6d72548c5eb48738d3
                                                                  • Instruction ID: 7b16d6da00fc9a701195689b6d0345155008efb37374f20405ae156c16eb28a2
                                                                  • Opcode Fuzzy Hash: 91dc31986c532176c65ca0e3ff35a3bba52d03db3277bf6d72548c5eb48738d3
                                                                  • Instruction Fuzzy Hash: 1531AC36A1C60285E7216F15C8423BC7A98EF44BA0F4101B5EA2EE73F2DFBCE4518319
                                                                  Function 00007FF693156F54 Relevance: 1.6, APIs: 1, Instructions: 55COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: _invalid_parameter_noinfo
                                                                  • String ID:
                                                                  • API String ID: 3215553584-0
                                                                  • Opcode ID: 0e1df9a836e05c53306103cf914f9f5afd0b17d2d4247778ac0f8a736a470cc7
                                                                  • Instruction ID: 081ddff92e3eb7241768803b6212e99cd17c5fa59379368b1f48bc52122f8aef
                                                                  • Opcode Fuzzy Hash: 0e1df9a836e05c53306103cf914f9f5afd0b17d2d4247778ac0f8a736a470cc7
                                                                  • Instruction Fuzzy Hash: E2117222A1D64182EA719F51D41227EB2A8FF85B80F445071EB4DF7BB6CF7CD8618780
                                                                  Function 00007FF6931675C4 Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: _invalid_parameter_noinfo
                                                                  • String ID:
                                                                  • API String ID: 3215553584-0
                                                                  • Opcode ID: 705a0604598582430d769309be7d52bb613e0b4e097a3a0cc12fb03a34ef158b
                                                                  • Instruction ID: d669f7aeecfbfe01ec9724eb0aecdb52bf0f9d089fef8d01e7542fb23b496058
                                                                  • Opcode Fuzzy Hash: 705a0604598582430d769309be7d52bb613e0b4e097a3a0cc12fb03a34ef158b
                                                                  • Instruction Fuzzy Hash: 7621A732618A8287EB718F58E44237976A5EB84B98F144274E65DD76E5DF3CD4408B00
                                                                  Function 00007FF69314F914 Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: _invalid_parameter_noinfo
                                                                  • String ID:
                                                                  • API String ID: 3215553584-0
                                                                  • Opcode ID: 43297e0cb54a728217cf8f13d9f8c23c45e2da10c33361e46a2ef0799771412d
                                                                  • Instruction ID: ea1460523c32e2a85e7081d995a85ec2f735b540576ededbf674a752314a60ad
                                                                  • Opcode Fuzzy Hash: 43297e0cb54a728217cf8f13d9f8c23c45e2da10c33361e46a2ef0799771412d
                                                                  • Instruction Fuzzy Hash: 0201C821A0874140E924DB529806079B798FF55FE4F0C8671EE6CB3BE6DE3CD4018300
                                                                  Function 00007FF6931484C0 Relevance: 1.5, APIs: 1, Instructions: 19libraryCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                    • Part of subcall function 00007FF693148950: MultiByteToWideChar.KERNEL32(?,?,?,00007FF693143A04,00000000,00007FF693141965), ref: 00007FF693148989
                                                                  • LoadLibraryExW.KERNELBASE(?,00007FF6931458B6,00000000,00007FF69314272E), ref: 00007FF6931484E2
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: ByteCharLibraryLoadMultiWide
                                                                  • String ID:
                                                                  • API String ID: 2592636585-0
                                                                  • Opcode ID: f60a4b28f40848f04726842085d853143cffca2c4904261e2b888fe767e0f7e9
                                                                  • Instruction ID: 98bd5b123d4a6a221fb565ed7bc6d0a9a0133a786d6cdbfe90802d634771c5e1
                                                                  • Opcode Fuzzy Hash: f60a4b28f40848f04726842085d853143cffca2c4904261e2b888fe767e0f7e9
                                                                  • Instruction Fuzzy Hash: C3D0C222F2468241EE64A767BA47539B156EFC9BC0E488035EE0D83B66DC3CD4910B00
                                                                  Function 00007FF69314C3DC Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF69314C3F0
                                                                    • Part of subcall function 00007FF69314CE18: __vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00007FF69314CE20
                                                                    • Part of subcall function 00007FF69314CE18: __vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00007FF69314CE25
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: __scrt_dllmain_crt_thread_attach__vcrt_uninitialize_locks__vcrt_uninitialize_ptd
                                                                  • String ID:
                                                                  • API String ID: 1208906642-0
                                                                  • Opcode ID: ececd82fc3177ae58a022cdb863293519d79894eaec9217f5cc72d6a823b184f
                                                                  • Instruction ID: b29c3d14726f45aa23192b9513cec491887b987936d74ecc64dbdfe11aebec4c
                                                                  • Opcode Fuzzy Hash: ececd82fc3177ae58a022cdb863293519d79894eaec9217f5cc72d6a823b184f
                                                                  • Instruction Fuzzy Hash: 6CE0B658D0D243A1FEB42661259F2BA368CDF2534CF4054F4D98EF31B3AE0D34571665
                                                                  Function 00007FF69315FE04 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • HeapAlloc.KERNEL32(?,?,00000000,00007FF69315C22A,?,?,?,00007FF693155E51,?,?,?,?,00007FF69315B392), ref: 00007FF69315FE59
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: AllocHeap
                                                                  • String ID:
                                                                  • API String ID: 4292702814-0
                                                                  • Opcode ID: e5baedaef9e1aefb999d7e678a491e2cb8f7af630fb86e3f47b81283e20e243b
                                                                  • Instruction ID: 19fb10a8c8832a98f9e65874f3501ec16df7424dcb31f19e8dd51c8a2d5a4ca8
                                                                  • Opcode Fuzzy Hash: e5baedaef9e1aefb999d7e678a491e2cb8f7af630fb86e3f47b81283e20e243b
                                                                  • Instruction Fuzzy Hash: 05F06D54B99307C5FE755BA2A9173B5729CDF89B80F0954B0C90EEA3F2EE1CE5A18310
                                                                  Function 00007FF69315E6C4 Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • HeapAlloc.KERNEL32(?,?,?,00007FF693150268,?,?,?,00007FF6931518D2,?,?,?,?,?,00007FF693154595), ref: 00007FF69315E702
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: AllocHeap
                                                                  • String ID:
                                                                  • API String ID: 4292702814-0
                                                                  • Opcode ID: c4f21c11c5720e62b677d9e99b1ce174dfbed18f849e52640c9a6f6ea7657029
                                                                  • Instruction ID: 3e85b7747bdc830393ccc22b0b4035b5ba30eb353c5fe97d6b5dedcfad8384fa
                                                                  • Opcode Fuzzy Hash: c4f21c11c5720e62b677d9e99b1ce174dfbed18f849e52640c9a6f6ea7657029
                                                                  • Instruction Fuzzy Hash: D6F08215F1D20245FE782BA159032B53189DF447A0F0806B0DD3EE62E1DE1CE4409720

                                                                  Non-executed Functions

                                                                  Function 00007FF693148020 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257synchronizationwindowregistryCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: ErrorLastMessage$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
                                                                  • String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
                                                                  • API String ID: 4208240515-3165540532
                                                                  • Opcode ID: 40a2b2c96db5062fbaff54aa02804a1320958b809a954de9be60782f8870c354
                                                                  • Instruction ID: 842b30c751afc8334d58ad2ea02d70657057a8eca33b6c29641ebf5728a4d5f3
                                                                  • Opcode Fuzzy Hash: 40a2b2c96db5062fbaff54aa02804a1320958b809a954de9be60782f8870c354
                                                                  • Instruction Fuzzy Hash: ACD18631A08B8286EB209F74E8566AD3768FF84B9CF444276DA5DA3AB4DF3CD545C700
                                                                  Function 00007FF693147800 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89fileCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
                                                                  • String ID: %s\*
                                                                  • API String ID: 1057558799-766152087
                                                                  • Opcode ID: 33e10a2293b6f66987fc751628de3762a02ba3a339ba911e57677f2f560f8a7f
                                                                  • Instruction ID: c3d673917fbb2bc94331624bdfec6445a66aafd36ac0190e0a3fbbcefce7d039
                                                                  • Opcode Fuzzy Hash: 33e10a2293b6f66987fc751628de3762a02ba3a339ba911e57677f2f560f8a7f
                                                                  • Instruction Fuzzy Hash: 57415731A0C94382EA309B65E44A1BD7369FB94768F5006B6D5ADE36F4DF3CD546C700
                                                                  Function 00007FF69314C6FC Relevance: 10.6, APIs: 7, Instructions: 71COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                  • String ID:
                                                                  • API String ID: 3140674995-0
                                                                  • Opcode ID: 89357c2c4ffda8ae13225540be7c458f51fcd4783b393db7419e501aec0a0031
                                                                  • Instruction ID: dffb818ab332a768ac9351cf52ed8604998c3c4cfcbbe88b84ba3f202e6b9133
                                                                  • Opcode Fuzzy Hash: 89357c2c4ffda8ae13225540be7c458f51fcd4783b393db7419e501aec0a0031
                                                                  • Instruction Fuzzy Hash: 79318176609B8186EB709FA1E8813ED7368FB84748F44403ADA4E97BA4DF7CC248C700
                                                                  Function 00007FF693166E70 Relevance: 9.3, APIs: 6, Instructions: 334timeCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • _get_daylight.LIBCMT ref: 00007FF693166EB5
                                                                    • Part of subcall function 00007FF693166808: _invalid_parameter_noinfo.LIBCMT ref: 00007FF69316681C
                                                                    • Part of subcall function 00007FF69315B464: HeapFree.KERNEL32(?,?,?,00007FF693163F92,?,?,?,00007FF693163FCF,?,?,00000000,00007FF693164495,?,?,?,00007FF6931643C7), ref: 00007FF69315B47A
                                                                    • Part of subcall function 00007FF69315B464: GetLastError.KERNEL32(?,?,?,00007FF693163F92,?,?,?,00007FF693163FCF,?,?,00000000,00007FF693164495,?,?,?,00007FF6931643C7), ref: 00007FF69315B484
                                                                    • Part of subcall function 00007FF69315B844: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF69315B823,?,?,?,?,?,00007FF69315B70E), ref: 00007FF69315B84D
                                                                    • Part of subcall function 00007FF69315B844: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF69315B823,?,?,?,?,?,00007FF69315B70E), ref: 00007FF69315B872
                                                                  • _get_daylight.LIBCMT ref: 00007FF693166EA4
                                                                    • Part of subcall function 00007FF693166868: _invalid_parameter_noinfo.LIBCMT ref: 00007FF69316687C
                                                                  • _get_daylight.LIBCMT ref: 00007FF69316711A
                                                                  • _get_daylight.LIBCMT ref: 00007FF69316712B
                                                                  • _get_daylight.LIBCMT ref: 00007FF69316713C
                                                                  • GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF69316737C), ref: 00007FF693167163
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
                                                                  • String ID:
                                                                  • API String ID: 4070488512-0
                                                                  • Opcode ID: 0173cbac813c15378d40c9e56499cd14d87a7a7d5cd8bcf6202161c05a5fa724
                                                                  • Instruction ID: 8f3745a5f1254166948549ce50062fe5012344676bd1a68a749c5047ce236c94
                                                                  • Opcode Fuzzy Hash: 0173cbac813c15378d40c9e56499cd14d87a7a7d5cd8bcf6202161c05a5fa724
                                                                  • Instruction Fuzzy Hash: 38D1D136A0864286EB30DF66D8521B977A9FF84798F408176EA0DE77A6DF3CE441C340
                                                                  Function 00007FF69315B558 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                                                  • String ID:
                                                                  • API String ID: 1239891234-0
                                                                  • Opcode ID: 2c2a6f2487acec397f330098253e2a7329acffa396285c7b3dfee245a17751bc
                                                                  • Instruction ID: 9f5acbd250cad876fb52355c1c030a5a7e44de352e0ca220ced08d981df68596
                                                                  • Opcode Fuzzy Hash: 2c2a6f2487acec397f330098253e2a7329acffa396285c7b3dfee245a17751bc
                                                                  • Instruction Fuzzy Hash: ED318236608F8186DB70CF65E8412AE73A8FB88758F544176EA9D93BA8DF3CC145CB00
                                                                  Function 00007FF693162AE4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: FileFindFirst_invalid_parameter_noinfo
                                                                  • String ID:
                                                                  • API String ID: 2227656907-0
                                                                  • Opcode ID: b6a193d294c3b32593d30be4cab4f407475a0a4c133e91729be199528772a0a4
                                                                  • Instruction ID: 3eee9d7ccfa22d7eb6bccafa082fa3c9b63aff623378b58aaeec4a561bb58f41
                                                                  • Opcode Fuzzy Hash: b6a193d294c3b32593d30be4cab4f407475a0a4c133e91729be199528772a0a4
                                                                  • Instruction Fuzzy Hash: 0DB1B732B1869281EB709BA598062BD7399EB44BD8F445172DE5EA7BE5DF3CE442C300
                                                                  Function 00007FF6931670EC Relevance: 6.1, APIs: 4, Instructions: 143timeCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • _get_daylight.LIBCMT ref: 00007FF69316711A
                                                                    • Part of subcall function 00007FF693166868: _invalid_parameter_noinfo.LIBCMT ref: 00007FF69316687C
                                                                  • _get_daylight.LIBCMT ref: 00007FF69316712B
                                                                    • Part of subcall function 00007FF693166808: _invalid_parameter_noinfo.LIBCMT ref: 00007FF69316681C
                                                                  • _get_daylight.LIBCMT ref: 00007FF69316713C
                                                                    • Part of subcall function 00007FF693166838: _invalid_parameter_noinfo.LIBCMT ref: 00007FF69316684C
                                                                    • Part of subcall function 00007FF69315B464: HeapFree.KERNEL32(?,?,?,00007FF693163F92,?,?,?,00007FF693163FCF,?,?,00000000,00007FF693164495,?,?,?,00007FF6931643C7), ref: 00007FF69315B47A
                                                                    • Part of subcall function 00007FF69315B464: GetLastError.KERNEL32(?,?,?,00007FF693163F92,?,?,?,00007FF693163FCF,?,?,00000000,00007FF693164495,?,?,?,00007FF6931643C7), ref: 00007FF69315B484
                                                                  • GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF69316737C), ref: 00007FF693167163
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
                                                                  • String ID:
                                                                  • API String ID: 3458911817-0
                                                                  • Opcode ID: f3046009ef5eb4ee2f9f04adf13bbb5e89ae69c332d55b3385a3975d24ee77c8
                                                                  • Instruction ID: a05134316c2378ffb98389ff03b2e03ee0c8955c7829260cd17d8f5852ea9fb7
                                                                  • Opcode Fuzzy Hash: f3046009ef5eb4ee2f9f04adf13bbb5e89ae69c332d55b3385a3975d24ee77c8
                                                                  • Instruction Fuzzy Hash: B2518336A0864286E730DF61D8825B97769FF88788F4051B9EA4DE37B6DF3CE4418740
                                                                  Function 00007FF693144C40 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetProcAddress.KERNEL32(?,00007FF69314590F,00000000,00007FF69314272E), ref: 00007FF693144C50
                                                                  • GetLastError.KERNEL32(?,00007FF69314590F,00000000,00007FF69314272E), ref: 00007FF693144C62
                                                                  • GetProcAddress.KERNEL32(?,00007FF69314590F,00000000,00007FF69314272E), ref: 00007FF693144C99
                                                                  • GetLastError.KERNEL32(?,00007FF69314590F,00000000,00007FF69314272E), ref: 00007FF693144CAB
                                                                  • GetProcAddress.KERNEL32(?,00007FF69314590F,00000000,00007FF69314272E), ref: 00007FF693144CC4
                                                                  • GetLastError.KERNEL32(?,00007FF69314590F,00000000,00007FF69314272E), ref: 00007FF693144CD6
                                                                  • GetProcAddress.KERNEL32(?,00007FF69314590F,00000000,00007FF69314272E), ref: 00007FF693144CEF
                                                                  • GetLastError.KERNEL32(?,00007FF69314590F,00000000,00007FF69314272E), ref: 00007FF693144D01
                                                                  • GetProcAddress.KERNEL32(?,00007FF69314590F,00000000,00007FF69314272E), ref: 00007FF693144D1D
                                                                  • GetLastError.KERNEL32(?,00007FF69314590F,00000000,00007FF69314272E), ref: 00007FF693144D2F
                                                                  • GetProcAddress.KERNEL32(?,00007FF69314590F,00000000,00007FF69314272E), ref: 00007FF693144D4B
                                                                  • GetLastError.KERNEL32(?,00007FF69314590F,00000000,00007FF69314272E), ref: 00007FF693144D5D
                                                                  • GetProcAddress.KERNEL32(?,00007FF69314590F,00000000,00007FF69314272E), ref: 00007FF693144D79
                                                                  • GetLastError.KERNEL32(?,00007FF69314590F,00000000,00007FF69314272E), ref: 00007FF693144D8B
                                                                  • GetProcAddress.KERNEL32(?,00007FF69314590F,00000000,00007FF69314272E), ref: 00007FF693144DA7
                                                                  • GetLastError.KERNEL32(?,00007FF69314590F,00000000,00007FF69314272E), ref: 00007FF693144DB9
                                                                  • GetProcAddress.KERNEL32(?,00007FF69314590F,00000000,00007FF69314272E), ref: 00007FF693144DD5
                                                                  • GetLastError.KERNEL32(?,00007FF69314590F,00000000,00007FF69314272E), ref: 00007FF693144DE7
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: AddressErrorLastProc
                                                                  • String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
                                                                  • API String ID: 199729137-653951865
                                                                  • Opcode ID: 91fe38e706475bc85e8e17d1603b2dd44d209342b91b11e5c33006422c226cfa
                                                                  • Instruction ID: 398af80f64d9943f7b18e0e4a2cfb30148419947c174b29fc558fb1187659b3d
                                                                  • Opcode Fuzzy Hash: 91fe38e706475bc85e8e17d1603b2dd44d209342b91b11e5c33006422c226cfa
                                                                  • Instruction Fuzzy Hash: 6622BE7490DF0791FA349BA5A85A17433ACFF4878DF8856B5D80EA2274EF3CB489C215
                                                                  Function 00007FF693146B00 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: AddressErrorLastProc
                                                                  • String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
                                                                  • API String ID: 199729137-3427451314
                                                                  • Opcode ID: 3ce57ac688b021c07c17bb9d18c3d2db368ff9ca427b7eb3b8bd4dc412038eb8
                                                                  • Instruction ID: 89556d00871e44f2ca63324cf155adaadf1ae85c2405c4a301b19850322201ae
                                                                  • Opcode Fuzzy Hash: 3ce57ac688b021c07c17bb9d18c3d2db368ff9ca427b7eb3b8bd4dc412038eb8
                                                                  • Instruction Fuzzy Hash: 1802B178A0DF0791FA359BA5B81A57433ADFF0874CB8815B5D80EA6274EF3CB54AC201
                                                                  Function 00007FFDA4337BDC Relevance: 58.1, APIs: 4, Strings: 29, Instructions: 381COMMONLIBRARYCODE
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3538366584.00007FFDA4331000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA4330000, based on PE: true
                                                                  • Associated: 00000003.00000002.3538339366.00007FFDA4330000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538393900.00007FFDA4344000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538417282.00007FFDA4349000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538438392.00007FFDA434A000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ffda4330000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: Name::operator+
                                                                  • String ID: volatile$<unknown>$UNKNOWN$__int128$__int16$__int32$__int64$__int8$__w64 $auto$bool$char$char16_t$char32_t$char8_t$const$decltype(auto)$double$float$int$long$long $short$signed $this $unsigned $void$volatile$wchar_t
                                                                  • API String ID: 2943138195-1482988683
                                                                  • Opcode ID: a2c27aef857a1be5b859030660f08b7ca73635be6048625c1ed2e335bbf60e8e
                                                                  • Instruction ID: cfe8db6b614e696b1aacd9fb9f76b0b399b651dcb6515db426ea8af1c7063ad3
                                                                  • Opcode Fuzzy Hash: a2c27aef857a1be5b859030660f08b7ca73635be6048625c1ed2e335bbf60e8e
                                                                  • Instruction Fuzzy Hash: 35028076F9AE1698FB18AB64C8F42BC27B0BB06744F504135DA0D16BBADF6DB544C308
                                                                  Function 00007FFDA433B64C Relevance: 28.3, APIs: 15, Strings: 1, Instructions: 290COMMONLIBRARYCODE
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3538366584.00007FFDA4331000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA4330000, based on PE: true
                                                                  • Associated: 00000003.00000002.3538339366.00007FFDA4330000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538393900.00007FFDA4344000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538417282.00007FFDA4349000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538438392.00007FFDA434A000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ffda4330000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: Name::operator+
                                                                  • String ID: `anonymous namespace'
                                                                  • API String ID: 2943138195-3062148218
                                                                  • Opcode ID: aec32b62843f06ec98af653d191f262bc38b8bb7144c10d1108c11b28ce6cb84
                                                                  • Instruction ID: 4e41349675f226cde1ce8a2c79cc59f714f98d28bfae25a862451eff1732788d
                                                                  • Opcode Fuzzy Hash: aec32b62843f06ec98af653d191f262bc38b8bb7144c10d1108c11b28ce6cb84
                                                                  • Instruction Fuzzy Hash: 09E14872A4AF8299EB10AF24D4E01AD77A0FB46744F409135EA8D17BB6DF3CE554C704
                                                                  Function 00007FF693147610 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                    • Part of subcall function 00007FF693148950: MultiByteToWideChar.KERNEL32(?,?,?,00007FF693143A04,00000000,00007FF693141965), ref: 00007FF693148989
                                                                  • ExpandEnvironmentStringsW.KERNEL32(00000000,00007FF693147CF7,FFFFFFFF,00000000,?,00007FF693143101), ref: 00007FF69314766C
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: ByteCharEnvironmentExpandMultiStringsWide
                                                                  • String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
                                                                  • API String ID: 2001182103-930877121
                                                                  • Opcode ID: c12f537dd095d990c73456ab9bcad2fdb505f4a02d1bedcb9a56ce5ba8a3e8b7
                                                                  • Instruction ID: 048c21ab801ef22a24af54cf92b7976c23c7d5e94eefb8457b2da13a413e5f26
                                                                  • Opcode Fuzzy Hash: c12f537dd095d990c73456ab9bcad2fdb505f4a02d1bedcb9a56ce5ba8a3e8b7
                                                                  • Instruction Fuzzy Hash: F651AC21B2D64251FB709B65D95B2B9725AEF44788F8400B2DA0EE36B5EF3CE5058740
                                                                  Function 00007FFDA433C4B4 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 359COMMONLIBRARYCODE
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3538366584.00007FFDA4331000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA4330000, based on PE: true
                                                                  • Associated: 00000003.00000002.3538339366.00007FFDA4330000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538393900.00007FFDA4344000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538417282.00007FFDA4349000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538438392.00007FFDA434A000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ffda4330000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: NameName::$Name::operator+atolswprintf_s
                                                                  • String ID: NULL$`generic-class-parameter-$`generic-method-parameter-$`template-type-parameter-$lambda$nullptr
                                                                  • API String ID: 2331677841-2441609178
                                                                  • Opcode ID: 3c29747ae8710b15564f16d6c1c734fd538530989b0780686262821ebccf47fd
                                                                  • Instruction ID: afe9ad256cd7644294d56242d68e2f12ec540933ff27727724c75b1e8f901b24
                                                                  • Opcode Fuzzy Hash: 3c29747ae8710b15564f16d6c1c734fd538530989b0780686262821ebccf47fd
                                                                  • Instruction Fuzzy Hash: 6EF15D23F8AE12C4FA15BB6485F41BC27A1AF47744F544136CA0E2ABB7DE3CB545A348
                                                                  Function 00007FF6931415E0 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: CurrentProcess
                                                                  • String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
                                                                  • API String ID: 2050909247-1550345328
                                                                  • Opcode ID: 81c36249363a4b2030d3904b058222042c7d886137fc5fef80997146f96eff1f
                                                                  • Instruction ID: dac67ec34b7e0aca2b957ec860755f8ae29726a5f8aa5bf577083c2e02fe5f36
                                                                  • Opcode Fuzzy Hash: 81c36249363a4b2030d3904b058222042c7d886137fc5fef80997146f96eff1f
                                                                  • Instruction Fuzzy Hash: 50519C31B0C64392EA34AB6195161AA7398FF4479CF8441B2EE0DA77B6DF3CE5558700
                                                                  Function 00007FFDA4339B14 Relevance: 19.9, APIs: 13, Instructions: 361COMMONLIBRARYCODE
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3538366584.00007FFDA4331000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA4330000, based on PE: true
                                                                  • Associated: 00000003.00000002.3538339366.00007FFDA4330000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538393900.00007FFDA4344000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538417282.00007FFDA4349000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538438392.00007FFDA434A000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ffda4330000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: Name::operator+
                                                                  • String ID:
                                                                  • API String ID: 2943138195-0
                                                                  • Opcode ID: 41ef1431114346efaab8c60343cd86bdbcd24c7489ef4566e00d5aa078ef8b87
                                                                  • Instruction ID: 5ff5e89c7c38a21f618d0a81371130a2166dc850c5c77c4249de9cd293276c94
                                                                  • Opcode Fuzzy Hash: 41ef1431114346efaab8c60343cd86bdbcd24c7489ef4566e00d5aa078ef8b87
                                                                  • Instruction Fuzzy Hash: CBF13A76B4AA429DE710EF64E4B01EC37A0EB0674CB444036EA4E57BBADE3CE555C348
                                                                  Function 00007FFDA43319D4 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 311COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3538366584.00007FFDA4331000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA4330000, based on PE: true
                                                                  • Associated: 00000003.00000002.3538339366.00007FFDA4330000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538393900.00007FFDA4344000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538417282.00007FFDA4349000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538438392.00007FFDA434A000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ffda4330000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: BlockFrameHandler3::Unwindabortterminate$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                                                  • String ID: csm$csm$csm
                                                                  • API String ID: 4223619315-393685449
                                                                  • Opcode ID: 6da6cceb144a245c76afb91d09171081a696858682c4f12eaced2770b517540e
                                                                  • Instruction ID: 3d201229c1adbe942463ad675f2bbe04ea9ec48b4786dc85499aaada8b7707e7
                                                                  • Opcode Fuzzy Hash: 6da6cceb144a245c76afb91d09171081a696858682c4f12eaced2770b517540e
                                                                  • Instruction Fuzzy Hash: 52D16C32B49B4186EB60AB6594A03AD77A0FB46798F140135EB8D57BBADF3CF090C704
                                                                  Function 00007FF693147500 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: LongWindow$BlockCreateErrorLastReasonShutdown
                                                                  • String ID: Needs to remove its temporary files.
                                                                  • API String ID: 3975851968-2863640275
                                                                  • Opcode ID: 44e53fe94581f3919e9549e222624ce8134aca65504236f29db41f4538cf5799
                                                                  • Instruction ID: b5e0a69f3d960a846c696f3437504b536dfe039cd19f0decee95a2e6dc813b7d
                                                                  • Opcode Fuzzy Hash: 44e53fe94581f3919e9549e222624ce8134aca65504236f29db41f4538cf5799
                                                                  • Instruction Fuzzy Hash: F021AC71B08A4283E7715B7AB54A1797359FF88B98F484170DE2DDB3F4DE2CD5858200
                                                                  Function 00007FFDA4337888 Relevance: 16.7, APIs: 11, Instructions: 158COMMONLIBRARYCODE
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3538366584.00007FFDA4331000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA4330000, based on PE: true
                                                                  • Associated: 00000003.00000002.3538339366.00007FFDA4330000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538393900.00007FFDA4344000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538417282.00007FFDA4349000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538438392.00007FFDA434A000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ffda4330000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: Name::operator+
                                                                  • String ID:
                                                                  • API String ID: 2943138195-0
                                                                  • Opcode ID: 59ff93c280199e5836e6df8be1a97549f355a4d451030ffe8799044faf8f3d85
                                                                  • Instruction ID: 133b68a043e6b37f8fa414f8bf509e7158db29ce9080fa6e8c3d2493420e7713
                                                                  • Opcode Fuzzy Hash: 59ff93c280199e5836e6df8be1a97549f355a4d451030ffe8799044faf8f3d85
                                                                  • Instruction Fuzzy Hash: 0A713A72B49A4299EB10EF65D4B11FC33B1AB0678CB408531DA0D57BBADF38E619C394
                                                                  Function 00007FFDA433D650 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 194COMMONLIBRARYCODE
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3538366584.00007FFDA4331000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA4330000, based on PE: true
                                                                  • Associated: 00000003.00000002.3538339366.00007FFDA4330000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538393900.00007FFDA4344000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538417282.00007FFDA4349000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538438392.00007FFDA434A000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ffda4330000_lock.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID: `generic-type-$`template-parameter-$generic-type-$template-parameter-
                                                                  • API String ID: 0-3207858774
                                                                  • Opcode ID: 6ea09e53c78372fd51fc6217c56ea2e3ac166cdbb3b457d9f2a8c27783302216
                                                                  • Instruction ID: f440b3639de4d45e3debc210dafa5054698d30db58a3eacee4e4c013a33390b0
                                                                  • Opcode Fuzzy Hash: 6ea09e53c78372fd51fc6217c56ea2e3ac166cdbb3b457d9f2a8c27783302216
                                                                  • Instruction Fuzzy Hash: EF817962B8AE8699FB10AB21D4F02FC27A1AB56B45F444132DA4E077B6DF2CF545C348
                                                                  Function 00007FFDA4339358 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 126COMMONLIBRARYCODE
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3538366584.00007FFDA4331000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA4330000, based on PE: true
                                                                  • Associated: 00000003.00000002.3538339366.00007FFDA4330000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538393900.00007FFDA4344000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538417282.00007FFDA4349000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538438392.00007FFDA434A000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ffda4330000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: Name::operator+
                                                                  • String ID: `unknown ecsu'$class $coclass $cointerface $enum $struct $union
                                                                  • API String ID: 2943138195-1464470183
                                                                  • Opcode ID: af40fed7b60034fd5c5e0a5ae54bcf9e4d80c7769b22b13ab88bd66fa3393346
                                                                  • Instruction ID: a613a3faa5209fc9c268fdcda9771d993e197124f79c40ee1565feb9e2d689b8
                                                                  • Opcode Fuzzy Hash: af40fed7b60034fd5c5e0a5ae54bcf9e4d80c7769b22b13ab88bd66fa3393346
                                                                  • Instruction Fuzzy Hash: 6D512522F9AE16C9FB10EB65E8F05AC27B0BF06344F504035DA4E56BBADF2DA544C704
                                                                  Function 00007FF693157250 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 493COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: _invalid_parameter_noinfo
                                                                  • String ID: -$:$f$p$p
                                                                  • API String ID: 3215553584-2013873522
                                                                  • Opcode ID: 65d4a0ffdc8e7253b8e60b637b85ac8f97459ea152ba9c8238927d2e88e0f15e
                                                                  • Instruction ID: 4e68be168cf2da8587c7445dd3357f6702238f6e8c6f3a6e59e1c01d8949e083
                                                                  • Opcode Fuzzy Hash: 65d4a0ffdc8e7253b8e60b637b85ac8f97459ea152ba9c8238927d2e88e0f15e
                                                                  • Instruction Fuzzy Hash: B712A262E0D14387FB319B14E0476B9B6A9FB40750F844176E6DAE6AE4DF3CE490CB14
                                                                  Function 00007FF6931505A0 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: _invalid_parameter_noinfo
                                                                  • String ID: f$f$p$p$f
                                                                  • API String ID: 3215553584-1325933183
                                                                  • Opcode ID: fc8e2330ab6ced16bd3d959f6bc8057a9fc686b659d09149717256120edd57c1
                                                                  • Instruction ID: f99b9a407e770bfb227cb6a2aeae1b297b70757f5b275a67cfa5303838d642b1
                                                                  • Opcode Fuzzy Hash: fc8e2330ab6ced16bd3d959f6bc8057a9fc686b659d09149717256120edd57c1
                                                                  • Instruction Fuzzy Hash: 53129066A0C18386FB309F95D0567BA7299FB42754F884075E6CEE66F8DF7CE5808B00
                                                                  Function 00007FFDA4331E9C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 317COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3538366584.00007FFDA4331000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA4330000, based on PE: true
                                                                  • Associated: 00000003.00000002.3538339366.00007FFDA4330000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538393900.00007FFDA4344000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538417282.00007FFDA4349000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538438392.00007FFDA434A000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ffda4330000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: abortterminate$Is_bad_exception_allowedstd::bad_alloc::bad_alloc
                                                                  • String ID: csm$csm$csm
                                                                  • API String ID: 211107550-393685449
                                                                  • Opcode ID: 579c448420c1f2a36cb32246af93653fbc5f1fd4bf1dbfa0e8ef84cdd48a3a2d
                                                                  • Instruction ID: 1229ee104091c518a562b71db2af2eb4ac382571d5cc0d65d711b11aab3bc231
                                                                  • Opcode Fuzzy Hash: 579c448420c1f2a36cb32246af93653fbc5f1fd4bf1dbfa0e8ef84cdd48a3a2d
                                                                  • Instruction Fuzzy Hash: A9E1A073A09A818AE750AF24D4A03AC7BA0FB46758F144135EA9D57776CF3CF485CB04
                                                                  Function 00007FF693141030 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: CurrentProcess
                                                                  • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                  • API String ID: 2050909247-3659356012
                                                                  • Opcode ID: 9e175e46b8c6fe5231c370cd9cc5aece7fac1ed262f05bfac1b803ebcb928db4
                                                                  • Instruction ID: b7f6ef04f996eb87f3d5f2d7f504ca0428020646a7e0287ce86f51b97581a4b4
                                                                  • Opcode Fuzzy Hash: 9e175e46b8c6fe5231c370cd9cc5aece7fac1ed262f05bfac1b803ebcb928db4
                                                                  • Instruction Fuzzy Hash: 6C416332B0C69285EA24DB61980A6B97399FF44BC8F4444B2ED0DA77B6DF3CE5058740
                                                                  Function 00007FF693147CA0 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetTempPathW.KERNEL32(FFFFFFFF,00000000,?,00007FF693143101), ref: 00007FF693147D44
                                                                  • GetCurrentProcessId.KERNEL32(?,00007FF693143101), ref: 00007FF693147D4A
                                                                  • CreateDirectoryW.KERNEL32(?,00007FF693143101), ref: 00007FF693147D8C
                                                                    • Part of subcall function 00007FF693147E70: GetEnvironmentVariableW.KERNEL32(00007FF693142C4F), ref: 00007FF693147EA7
                                                                    • Part of subcall function 00007FF693147E70: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF693147EC9
                                                                    • Part of subcall function 00007FF693159174: _invalid_parameter_noinfo.LIBCMT ref: 00007FF69315918D
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: Environment$CreateCurrentDirectoryExpandPathProcessStringsTempVariable_invalid_parameter_noinfo
                                                                  • String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
                                                                  • API String ID: 365913792-1339014028
                                                                  • Opcode ID: ffb589f732eab392f51c917e2ec5332ba92e64a2874c8252f98761f4106046c7
                                                                  • Instruction ID: 71d44cf6788d6f8c8f5e0802d1ec7cc5cef2b3f9b324fc9bfdad21f350a3e5e4
                                                                  • Opcode Fuzzy Hash: ffb589f732eab392f51c917e2ec5332ba92e64a2874c8252f98761f4106046c7
                                                                  • Instruction Fuzzy Hash: F241C121B1968241FA30EB65985B2F9729AEF857C8F4011B1ED1EF77B6DE3CE9018300
                                                                  Function 00007FFDA433B088 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 111COMMONLIBRARYCODE
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3538366584.00007FFDA4331000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA4330000, based on PE: true
                                                                  • Associated: 00000003.00000002.3538339366.00007FFDA4330000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538393900.00007FFDA4344000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538417282.00007FFDA4349000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538438392.00007FFDA434A000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ffda4330000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: Name::operator+
                                                                  • String ID: cli::array<$cli::pin_ptr<$std::nullptr_t$std::nullptr_t $void$void
                                                                  • API String ID: 2943138195-2239912363
                                                                  • Opcode ID: b834bdc2b4e624d8bfe4a0aa6ffd56aa1f04fb76a255bf56b0e6c1b80a1fdf25
                                                                  • Instruction ID: fe616433716b1144800e8f3e63a70e6162a6369b4f986e67b2972afb91ae1931
                                                                  • Opcode Fuzzy Hash: b834bdc2b4e624d8bfe4a0aa6ffd56aa1f04fb76a255bf56b0e6c1b80a1fdf25
                                                                  • Instruction Fuzzy Hash: 27513862F5AF5198FB11AB60D8A12BC77B0BB0A746F444135DA4D12BBBDF3CA484C718
                                                                  Function 00007FF69314DF98 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                                                  • String ID: csm$csm$csm
                                                                  • API String ID: 849930591-393685449
                                                                  • Opcode ID: 7d7d5a635fcd63c536a58b816f4712f1a96a9e43b0d550c3d6dd02e630e8922c
                                                                  • Instruction ID: 2a3e07ac35afeb0c43c7c36ddf8e9f9dfa0eb15dbc14a59a0187b78e22f3e18b
                                                                  • Opcode Fuzzy Hash: 7d7d5a635fcd63c536a58b816f4712f1a96a9e43b0d550c3d6dd02e630e8922c
                                                                  • Instruction Fuzzy Hash: A7D18E32B087418AEB309B65D44A3AD77A8FB4579CF141175EE8DA7BA6DF38E081C710
                                                                  Function 00007FF69315FF7C Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • FreeLibrary.KERNEL32(?,?,?,00007FF693160316,?,?,0000019F24B77F98,00007FF69315BC5B,?,?,?,00007FF69315BB52,?,?,?,00007FF693156EFE), ref: 00007FF6931600F8
                                                                  • GetProcAddress.KERNEL32(?,?,?,00007FF693160316,?,?,0000019F24B77F98,00007FF69315BC5B,?,?,?,00007FF69315BB52,?,?,?,00007FF693156EFE), ref: 00007FF693160104
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: AddressFreeLibraryProc
                                                                  • String ID: api-ms-$ext-ms-
                                                                  • API String ID: 3013587201-537541572
                                                                  • Opcode ID: d956f0b8ec152b18ca11aa0aed68125bebf2684d60339ba7369f52f17a1fcfe1
                                                                  • Instruction ID: b93712ad88b3b70a3ebbe33dcbd8bc67601bd84f1f4e87386f8e806ac41374fd
                                                                  • Opcode Fuzzy Hash: d956f0b8ec152b18ca11aa0aed68125bebf2684d60339ba7369f52f17a1fcfe1
                                                                  • Instruction Fuzzy Hash: 4D41FF32B1DE0281EA35CB56A8022B53299FF08BE8F094175DD0DE77B8EE7DE4458304
                                                                  Function 00007FFDA43356A4 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • LoadLibraryExW.KERNEL32(?,?,?,00007FFDA4335863,?,?,00000000,00007FFDA4335694,?,?,?,?,00007FFDA43353D1), ref: 00007FFDA4335729
                                                                  • GetLastError.KERNEL32(?,?,?,00007FFDA4335863,?,?,00000000,00007FFDA4335694,?,?,?,?,00007FFDA43353D1), ref: 00007FFDA4335737
                                                                  • wcsncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FFDA4335863,?,?,00000000,00007FFDA4335694,?,?,?,?,00007FFDA43353D1), ref: 00007FFDA4335750
                                                                  • LoadLibraryExW.KERNEL32(?,?,?,00007FFDA4335863,?,?,00000000,00007FFDA4335694,?,?,?,?,00007FFDA43353D1), ref: 00007FFDA4335762
                                                                  • FreeLibrary.KERNEL32(?,?,?,00007FFDA4335863,?,?,00000000,00007FFDA4335694,?,?,?,?,00007FFDA43353D1), ref: 00007FFDA43357D0
                                                                  • GetProcAddress.KERNEL32(?,?,?,00007FFDA4335863,?,?,00000000,00007FFDA4335694,?,?,?,?,00007FFDA43353D1), ref: 00007FFDA43357DC
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3538366584.00007FFDA4331000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA4330000, based on PE: true
                                                                  • Associated: 00000003.00000002.3538339366.00007FFDA4330000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538393900.00007FFDA4344000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538417282.00007FFDA4349000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538438392.00007FFDA434A000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ffda4330000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: Library$Load$AddressErrorFreeLastProcwcsncmp
                                                                  • String ID: api-ms-
                                                                  • API String ID: 916704608-2084034818
                                                                  • Opcode ID: e684dc1ea15019c11da8b5489464cae19cb3925c8f7c5ac0dd2cd0c8e7a31cf1
                                                                  • Instruction ID: c206a09f666aaf79d275a3827e978602bd3ad76d36643b490191e7b2e85a4a14
                                                                  • Opcode Fuzzy Hash: e684dc1ea15019c11da8b5489464cae19cb3925c8f7c5ac0dd2cd0c8e7a31cf1
                                                                  • Instruction Fuzzy Hash: 9231A121B5BE02D1EE25BB12A8B45B562A4BF16BA1F590535DD2E073B2DF3CF5448308
                                                                  Function 00007FFDA43314BC Relevance: 12.1, APIs: 8, Instructions: 148COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3538366584.00007FFDA4331000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA4330000, based on PE: true
                                                                  • Associated: 00000003.00000002.3538339366.00007FFDA4330000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538393900.00007FFDA4344000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538417282.00007FFDA4349000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538438392.00007FFDA434A000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ffda4330000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: abort$AdjustPointer
                                                                  • String ID:
                                                                  • API String ID: 1501936508-0
                                                                  • Opcode ID: a77e56ffb7347bb9ddddd1c8b20b2eb7c3ebdd653f05e7e8cd9cc1452737c897
                                                                  • Instruction ID: b34133525cb120797274af9815028ae5ef33840125f2f7c4b2a5c6eb8f109d52
                                                                  • Opcode Fuzzy Hash: a77e56ffb7347bb9ddddd1c8b20b2eb7c3ebdd653f05e7e8cd9cc1452737c897
                                                                  • Instruction Fuzzy Hash: 9551CD22B8BE4281FE65EF4094F46786394AF16B81B198435DF5E067B7CF2CF8418B08
                                                                  Function 00007FFDA43312D8 Relevance: 12.1, APIs: 8, Instructions: 148COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3538366584.00007FFDA4331000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA4330000, based on PE: true
                                                                  • Associated: 00000003.00000002.3538339366.00007FFDA4330000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538393900.00007FFDA4344000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538417282.00007FFDA4349000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538438392.00007FFDA434A000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ffda4330000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: abort$AdjustPointer
                                                                  • String ID:
                                                                  • API String ID: 1501936508-0
                                                                  • Opcode ID: 4f4cdc7b1f5bc10ab634606701f5204aa77954bebd3c90e9ebba0e05a3be14f8
                                                                  • Instruction ID: cbd531d7fa066acbe2189ede6c785da7beeb309270c7a306f27647e7a0f4c48a
                                                                  • Opcode Fuzzy Hash: 4f4cdc7b1f5bc10ab634606701f5204aa77954bebd3c90e9ebba0e05a3be14f8
                                                                  • Instruction Fuzzy Hash: A151A221B8BE4281EE65BF1194F467C63A4AF56B95F258435CB8E06BB7DF2CF4418308
                                                                  Function 00007FFDA4334CEA Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 162COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3538366584.00007FFDA4331000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA4330000, based on PE: true
                                                                  • Associated: 00000003.00000002.3538339366.00007FFDA4330000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538393900.00007FFDA4344000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538417282.00007FFDA4349000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538438392.00007FFDA434A000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ffda4330000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: FileHeader$ExceptionRaise
                                                                  • String ID: Access violation - no RTTI data!$Attempted a typeid of nullptr pointer!$Bad dynamic_cast!$Bad read pointer - no RTTI data!
                                                                  • API String ID: 3685223789-928371585
                                                                  • Opcode ID: 4f73c46b7be505823b8c23bdf2e01a106e3a134808b8006f3c7a9710838bb3a8
                                                                  • Instruction ID: b760bb35c07a2e77bf1f4100b3fe70e86ae7e24f45836bb60d734f5637bd2ce9
                                                                  • Opcode Fuzzy Hash: 4f73c46b7be505823b8c23bdf2e01a106e3a134808b8006f3c7a9710838bb3a8
                                                                  • Instruction Fuzzy Hash: AD518C22B5AE46A2DE20EB10E4F05B96360FF65B85F604531DA8E07776EE3CF545C704
                                                                  Function 00007FFDA433D444 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 126COMMONLIBRARYCODE
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3538366584.00007FFDA4331000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA4330000, based on PE: true
                                                                  • Associated: 00000003.00000002.3538339366.00007FFDA4330000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538393900.00007FFDA4344000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538417282.00007FFDA4349000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538438392.00007FFDA434A000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ffda4330000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: Name::operator+
                                                                  • String ID: {for
                                                                  • API String ID: 2943138195-864106941
                                                                  • Opcode ID: c8c0eb25e8b680b21b04dbc78bc85cadbb1d2f305e65e2eabc9fe04fafa5b067
                                                                  • Instruction ID: 4aa9ef7002cd6e8a829320d899d04d16b222eb7fde6fa4ea9b8fb43ee06bf305
                                                                  • Opcode Fuzzy Hash: c8c0eb25e8b680b21b04dbc78bc85cadbb1d2f305e65e2eabc9fe04fafa5b067
                                                                  • Instruction Fuzzy Hash: 89512B72B4AE85A9F711AF25D4A13EC23A0EB46748F808031EA4D47BB6DF7CE554C718
                                                                  Function 00007FF693142310 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 99windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF693142AC6,?,00007FF693142BC5), ref: 00007FF693142360
                                                                  • FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF693142AC6,?,00007FF693142BC5), ref: 00007FF69314241A
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: CurrentFormatMessageProcess
                                                                  • String ID: %ls$%ls: $<FormatMessageW failed.>$[PYI-%d:ERROR]
                                                                  • API String ID: 27993502-4247535189
                                                                  • Opcode ID: 92e20a795bf73765402ca9ec7783ee5ad9f8f927f89bd5dd19570627e0bc01fb
                                                                  • Instruction ID: bc944fb27399eaef5100139790e3b148c2169f17303213db97ed25858bfcc3bb
                                                                  • Opcode Fuzzy Hash: 92e20a795bf73765402ca9ec7783ee5ad9f8f927f89bd5dd19570627e0bc01fb
                                                                  • Instruction Fuzzy Hash: 1431D372B0CA4141E6309B65B81A6EA72A9FF84BD8F400175EF4DE3A69DE3CD547C700
                                                                  Function 00007FFDA433CA04 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89COMMONLIBRARYCODE
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3538366584.00007FFDA4331000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA4330000, based on PE: true
                                                                  • Associated: 00000003.00000002.3538339366.00007FFDA4330000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538393900.00007FFDA4344000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538417282.00007FFDA4349000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538438392.00007FFDA434A000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ffda4330000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: NameName::atol
                                                                  • String ID: `template-parameter$void
                                                                  • API String ID: 2130343216-4057429177
                                                                  • Opcode ID: 39600c2fadeceed4c6c28385a1cdb72227216fd67de7d66948b2e2ddd060d726
                                                                  • Instruction ID: dfcea4f945ff85b1006a16141bb7746e90f936f226feb2b0bc4a477813570424
                                                                  • Opcode Fuzzy Hash: 39600c2fadeceed4c6c28385a1cdb72227216fd67de7d66948b2e2ddd060d726
                                                                  • Instruction Fuzzy Hash: B7414A22F4AF5188FB00ABA4D8A12EC2371BB4AB94F544135CE0D667B6DF7CA145C344
                                                                  Function 00007FF69314D258 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • LoadLibraryExW.KERNEL32(?,?,?,00007FF69314D50A,?,?,?,00007FF69314D1FC,?,?,?,00007FF69314CDF9), ref: 00007FF69314D2DD
                                                                  • GetLastError.KERNEL32(?,?,?,00007FF69314D50A,?,?,?,00007FF69314D1FC,?,?,?,00007FF69314CDF9), ref: 00007FF69314D2EB
                                                                  • LoadLibraryExW.KERNEL32(?,?,?,00007FF69314D50A,?,?,?,00007FF69314D1FC,?,?,?,00007FF69314CDF9), ref: 00007FF69314D315
                                                                  • FreeLibrary.KERNEL32(?,?,?,00007FF69314D50A,?,?,?,00007FF69314D1FC,?,?,?,00007FF69314CDF9), ref: 00007FF69314D383
                                                                  • GetProcAddress.KERNEL32(?,?,?,00007FF69314D50A,?,?,?,00007FF69314D1FC,?,?,?,00007FF69314CDF9), ref: 00007FF69314D38F
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: Library$Load$AddressErrorFreeLastProc
                                                                  • String ID: api-ms-
                                                                  • API String ID: 2559590344-2084034818
                                                                  • Opcode ID: ec1d8984956c5f4cef63aabdc1ab3d005d502d88db624b4fbd9ceb099b80f4f4
                                                                  • Instruction ID: 33222bbb910e59154bc52e170114d866cf6ad613b3ac127f156109796b58357e
                                                                  • Opcode Fuzzy Hash: ec1d8984956c5f4cef63aabdc1ab3d005d502d88db624b4fbd9ceb099b80f4f4
                                                                  • Instruction Fuzzy Hash: 6F31D461B1AA4291EE31DB02A80667973DCFF49BA8F4A0575DD1DE73A1EF3CE4458310
                                                                  Function 00007FFDA43375D0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 81COMMONLIBRARYCODE
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3538366584.00007FFDA4331000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA4330000, based on PE: true
                                                                  • Associated: 00000003.00000002.3538339366.00007FFDA4330000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538393900.00007FFDA4344000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538417282.00007FFDA4349000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538438392.00007FFDA434A000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ffda4330000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: Name::operator+
                                                                  • String ID: ,...$,<ellipsis>$...$<ellipsis>$void
                                                                  • API String ID: 2943138195-2211150622
                                                                  • Opcode ID: 8129fa0169d6cc1cc5ca1a8c8b43bbbd082598864b82464398da58a00a821778
                                                                  • Instruction ID: 2ba7907a3866a44e58040aa2983179c716ec5af82be007f4e89311699910ced7
                                                                  • Opcode Fuzzy Hash: 8129fa0169d6cc1cc5ca1a8c8b43bbbd082598864b82464398da58a00a821778
                                                                  • Instruction Fuzzy Hash: 23413872F4AF4698F711AB68D8B02BC37A0BB0A308F948535DA4D163B6DF7CA541C708
                                                                  Function 00007FFDA4339554 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 79COMMONLIBRARYCODE
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3538366584.00007FFDA4331000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA4330000, based on PE: true
                                                                  • Associated: 00000003.00000002.3538339366.00007FFDA4330000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538393900.00007FFDA4344000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538417282.00007FFDA4349000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538438392.00007FFDA434A000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ffda4330000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: Name::operator+
                                                                  • String ID: char $int $long $short $unsigned
                                                                  • API String ID: 2943138195-3894466517
                                                                  • Opcode ID: a795c7ce3634cae38f4d320bfb7043b724aba026ad47a4d3d8bcb9e9dd899c8c
                                                                  • Instruction ID: 792db136cf5f60b97ecc4621d5bca2d8fd79f52d1201db312b106139df540081
                                                                  • Opcode Fuzzy Hash: a795c7ce3634cae38f4d320bfb7043b724aba026ad47a4d3d8bcb9e9dd899c8c
                                                                  • Instruction Fuzzy Hash: 59312A72F9AE51C9F701AB78D8B41AC2BB0BB06744F448135DA0D56BBADE3CE544CB08
                                                                  Function 00007FF693147BB0 Relevance: 10.6, APIs: 7, Instructions: 63COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
                                                                  • String ID:
                                                                  • API String ID: 995526605-0
                                                                  • Opcode ID: 4b16fab3d36e05ad3a3445a5c074aa8767ee98c8fbd83efe929b6b0b20bb971a
                                                                  • Instruction ID: 4262bf3b9576920eac2cd94a14a95565b68ae951e09ddad66276077748dd1f8b
                                                                  • Opcode Fuzzy Hash: 4b16fab3d36e05ad3a3445a5c074aa8767ee98c8fbd83efe929b6b0b20bb971a
                                                                  • Instruction Fuzzy Hash: 10216231A0CA8342EB209B55A44523AB3AAFF857E8F104275DAADD3AF4DF7CD4458700
                                                                  Function 00007FF69315C050 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: Value$ErrorLast
                                                                  • String ID:
                                                                  • API String ID: 2506987500-0
                                                                  • Opcode ID: 8bbbb01cf39c7a29ff4fbb7fa7bd8270fac2d4ba2b8d336fe0b40c1fcc65fe02
                                                                  • Instruction ID: 441b0339a277cae4520c99d42b56e87886efe99dcbbea2df0ab75603568e151c
                                                                  • Opcode Fuzzy Hash: 8bbbb01cf39c7a29ff4fbb7fa7bd8270fac2d4ba2b8d336fe0b40c1fcc65fe02
                                                                  • Instruction Fuzzy Hash: DA21502AA0C64642FAB46B715643179728ADF487B4F1447B8D83EF76F6DE6CF8418300
                                                                  Function 00007FF693168FDC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                                                  • String ID: CONOUT$
                                                                  • API String ID: 3230265001-3130406586
                                                                  • Opcode ID: 09a7ef29c2f791f79e4b414a588c98caae924e0a86b8d7fe5631f15f3a619b4d
                                                                  • Instruction ID: f78a607fb3db7e0606d8699d263cf248465896314785be37496b4b3901b3a23d
                                                                  • Opcode Fuzzy Hash: 09a7ef29c2f791f79e4b414a588c98caae924e0a86b8d7fe5631f15f3a619b4d
                                                                  • Instruction Fuzzy Hash: 7C116031B18A4186E7608B92E85632972A8FB88BE8F144274EA5DD77B4CF7CE504C744
                                                                  Function 00007FFDA433967C Relevance: 9.2, APIs: 6, Instructions: 160COMMONLIBRARYCODE
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3538366584.00007FFDA4331000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA4330000, based on PE: true
                                                                  • Associated: 00000003.00000002.3538339366.00007FFDA4330000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538393900.00007FFDA4344000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538417282.00007FFDA4349000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538438392.00007FFDA434A000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ffda4330000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: Name::operator+$NameName::
                                                                  • String ID:
                                                                  • API String ID: 168861036-0
                                                                  • Opcode ID: fb95027d3fcee506583ce7d96f70b522a78626fdc6e378da2ca402aa0a92e4da
                                                                  • Instruction ID: 9f1543508ee807acdc390fb9c3bc6c333186d172413935da8d79ecb0902e0d6c
                                                                  • Opcode Fuzzy Hash: fb95027d3fcee506583ce7d96f70b522a78626fdc6e378da2ca402aa0a92e4da
                                                                  • Instruction Fuzzy Hash: D2717872B5AE52C9EB10AF65D8A02AC37A1BF46784F548035DA0E0B7B6CF7DE445CB04
                                                                  Function 00007FF6931479B0 Relevance: 9.1, APIs: 6, Instructions: 127COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetCurrentProcess.KERNEL32(FFFFFFFF,?,?,00000000,00007FF693148706), ref: 00007FF6931479E2
                                                                  • K32EnumProcessModules.KERNEL32(?,?,00000000,00007FF693148706), ref: 00007FF693147A39
                                                                    • Part of subcall function 00007FF693148950: MultiByteToWideChar.KERNEL32(?,?,?,00007FF693143A04,00000000,00007FF693141965), ref: 00007FF693148989
                                                                  • K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF693148706), ref: 00007FF693147AC8
                                                                  • K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF693148706), ref: 00007FF693147B34
                                                                  • FreeLibrary.KERNEL32(?,?,00000000,00007FF693148706), ref: 00007FF693147B45
                                                                  • FreeLibrary.KERNEL32(?,?,00000000,00007FF693148706), ref: 00007FF693147B5A
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
                                                                  • String ID:
                                                                  • API String ID: 3462794448-0
                                                                  • Opcode ID: b9b63f54144ba03940088346b196338d5c2960aef7cb953cd42f14819606a153
                                                                  • Instruction ID: 866e4826669661dc0f7a138aee3706c9dc032c9c89bc8a3bc996e7513bc177f5
                                                                  • Opcode Fuzzy Hash: b9b63f54144ba03940088346b196338d5c2960aef7cb953cd42f14819606a153
                                                                  • Instruction Fuzzy Hash: 1E41F262B1968242EA309F21A44A2AA739DFF84BC8F054071DF9DF37A9DE3CD541C700
                                                                  Function 00007FFDA43350B0 Relevance: 9.1, APIs: 6, Instructions: 83stringCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3538366584.00007FFDA4331000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA4330000, based on PE: true
                                                                  • Associated: 00000003.00000002.3538339366.00007FFDA4330000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538393900.00007FFDA4344000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538417282.00007FFDA4349000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538438392.00007FFDA434A000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ffda4330000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: free$EntryInterlockedListNamePush__unmallocstrcpy_s
                                                                  • String ID:
                                                                  • API String ID: 3741236498-0
                                                                  • Opcode ID: d800493cf60e4af3f4a7c920cc646ece182b7dab7bd32bb736cb4877c8bf044e
                                                                  • Instruction ID: b1dc9d71c106405331b6dea60ebfb497bdf734925750af9b6b0a2e39e4077756
                                                                  • Opcode Fuzzy Hash: d800493cf60e4af3f4a7c920cc646ece182b7dab7bd32bb736cb4877c8bf044e
                                                                  • Instruction Fuzzy Hash: AD31C622B57F5151EE11EF15A8685A92390BF1ABD4B554631DD2E033A1EE3DE842C344
                                                                  Function 00007FF6931485C0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                    • Part of subcall function 00007FF693147BB0: GetCurrentProcess.KERNEL32 ref: 00007FF693147BD0
                                                                    • Part of subcall function 00007FF693147BB0: OpenProcessToken.ADVAPI32 ref: 00007FF693147BE3
                                                                    • Part of subcall function 00007FF693147BB0: GetTokenInformation.ADVAPI32 ref: 00007FF693147C08
                                                                    • Part of subcall function 00007FF693147BB0: GetLastError.KERNEL32 ref: 00007FF693147C12
                                                                    • Part of subcall function 00007FF693147BB0: GetTokenInformation.ADVAPI32 ref: 00007FF693147C52
                                                                    • Part of subcall function 00007FF693147BB0: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF693147C6E
                                                                    • Part of subcall function 00007FF693147BB0: CloseHandle.KERNEL32 ref: 00007FF693147C86
                                                                  • LocalFree.KERNEL32(00000000,00007FF693143099), ref: 00007FF69314864C
                                                                  • LocalFree.KERNEL32 ref: 00007FF693148655
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
                                                                  • String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
                                                                  • API String ID: 6828938-1529539262
                                                                  • Opcode ID: d798866db3bd5df2efb7bc743f04e88858d4d647152387f2e8ebfd41b25b19db
                                                                  • Instruction ID: 944380ab9e78e2e5a537b912c00e52999fe1acf9bb92eaeffb348946e53a9f3b
                                                                  • Opcode Fuzzy Hash: d798866db3bd5df2efb7bc743f04e88858d4d647152387f2e8ebfd41b25b19db
                                                                  • Instruction Fuzzy Hash: 4E216231A0874681F6649B50E81A3FA7299FF88788F9440B6EA4DE37A6DF3DD944C740
                                                                  Function 00007FF69315C1C8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetLastError.KERNEL32(?,?,?,00007FF693155E51,?,?,?,?,00007FF69315B392,?,?,?,?,00007FF6931580CB), ref: 00007FF69315C1D7
                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF693155E51,?,?,?,?,00007FF69315B392,?,?,?,?,00007FF6931580CB), ref: 00007FF69315C20D
                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF693155E51,?,?,?,?,00007FF69315B392,?,?,?,?,00007FF6931580CB), ref: 00007FF69315C23A
                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF693155E51,?,?,?,?,00007FF69315B392,?,?,?,?,00007FF6931580CB), ref: 00007FF69315C24B
                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF693155E51,?,?,?,?,00007FF69315B392,?,?,?,?,00007FF6931580CB), ref: 00007FF69315C25C
                                                                  • SetLastError.KERNEL32(?,?,?,00007FF693155E51,?,?,?,?,00007FF69315B392,?,?,?,?,00007FF6931580CB), ref: 00007FF69315C277
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: Value$ErrorLast
                                                                  • String ID:
                                                                  • API String ID: 2506987500-0
                                                                  • Opcode ID: cd140ed500cd0c82a50e9bec5cbca94b7f65b5ea9b6864ee2a07c94a3d21de84
                                                                  • Instruction ID: 13dcb7ce75fc3b2824e152202f7cac0501fbba4af7831abc0d406345f9de2566
                                                                  • Opcode Fuzzy Hash: cd140ed500cd0c82a50e9bec5cbca94b7f65b5ea9b6864ee2a07c94a3d21de84
                                                                  • Instruction Fuzzy Hash: 05115E25A0C64282FAB4ABA15683139719ADF4C7B4F1447B8DC3FF66F6DE6CE8418300
                                                                  Function 00007FFDA4332604 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 193COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3538366584.00007FFDA4331000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA4330000, based on PE: true
                                                                  • Associated: 00000003.00000002.3538339366.00007FFDA4330000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538393900.00007FFDA4344000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538417282.00007FFDA4349000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538438392.00007FFDA434A000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ffda4330000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: abort$CallEncodePointerTranslator
                                                                  • String ID: MOC$RCC
                                                                  • API String ID: 2889003569-2084237596
                                                                  • Opcode ID: d60a8ffad84e6f064a5763a2c166d11077ba1814d2ca81799213d95430020a2c
                                                                  • Instruction ID: b998d45bd86ff63295c5db0256412beab65d895c3fe677f744b683a4e1759633
                                                                  • Opcode Fuzzy Hash: d60a8ffad84e6f064a5763a2c166d11077ba1814d2ca81799213d95430020a2c
                                                                  • Instruction Fuzzy Hash: ED919273B09B918AE710EB64E4A02AD77A0FB45788F108125EB8D57B76DF3CE195CB04
                                                                  Function 00007FFDA433ADD0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 167COMMONLIBRARYCODE
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3538366584.00007FFDA4331000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA4330000, based on PE: true
                                                                  • Associated: 00000003.00000002.3538339366.00007FFDA4330000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538393900.00007FFDA4344000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538417282.00007FFDA4349000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538438392.00007FFDA434A000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ffda4330000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: Name::operator+
                                                                  • String ID: std::nullptr_t$std::nullptr_t $volatile$volatile
                                                                  • API String ID: 2943138195-757766384
                                                                  • Opcode ID: 130e2d842e8b7dca47c2836e89f717505be4afbf408c40d13b3259f38f6b460e
                                                                  • Instruction ID: ed93a4adc172fcad64f9738a6b55b651fdac2b8babc3f6c2963fbf099b10cca5
                                                                  • Opcode Fuzzy Hash: 130e2d842e8b7dca47c2836e89f717505be4afbf408c40d13b3259f38f6b460e
                                                                  • Instruction Fuzzy Hash: 7B713962B8AE4294EB14AF6498B00BC77A4FB06785F445535DA4E06BBADF7CF150C308
                                                                  Function 00007FFDA4332DB0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 163COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • __except_validate_context_record.LIBVCRUNTIME ref: 00007FFDA4332DDA
                                                                    • Part of subcall function 00007FFDA4335508: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFDA433108E), ref: 00007FFDA4335516
                                                                  • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA4332F2F
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3538366584.00007FFDA4331000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA4330000, based on PE: true
                                                                  • Associated: 00000003.00000002.3538339366.00007FFDA4330000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538393900.00007FFDA4344000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538417282.00007FFDA4349000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538438392.00007FFDA434A000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ffda4330000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: abort$__except_validate_context_record
                                                                  • String ID: $csm$csm
                                                                  • API String ID: 3000080923-1512788406
                                                                  • Opcode ID: 53f907965be1a88a6fd5fb15d1f71a23af454141565bf2445c328556a8274992
                                                                  • Instruction ID: b838830f1c17bbb1773c0538364ba1cd3ca742381d412c014351bb0ab17fa2d3
                                                                  • Opcode Fuzzy Hash: 53f907965be1a88a6fd5fb15d1f71a23af454141565bf2445c328556a8274992
                                                                  • Instruction Fuzzy Hash: E371B232A0AA8186D761AF21D0B077C7BA0FB02F85F149131EA5D07BBACB3CE491C704
                                                                  Function 00007FFDA4332B88 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 145COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • __except_validate_context_record.LIBVCRUNTIME ref: 00007FFDA4332BB0
                                                                    • Part of subcall function 00007FFDA4335508: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFDA433108E), ref: 00007FFDA4335516
                                                                  • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA4332C7F
                                                                  • __FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FFDA4332C8F
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3538366584.00007FFDA4331000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA4330000, based on PE: true
                                                                  • Associated: 00000003.00000002.3538339366.00007FFDA4330000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538393900.00007FFDA4344000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538417282.00007FFDA4349000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538438392.00007FFDA434A000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ffda4330000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: Frameabort$EmptyHandler3::StateUnwind__except_validate_context_record
                                                                  • String ID: csm$csm
                                                                  • API String ID: 1245442199-3733052814
                                                                  • Opcode ID: 20a4f0483044e05ead07b9216d24a097e489e06d9183abde2aaa2290edabb471
                                                                  • Instruction ID: 5e6a60b09d1963bfcde4a33f6215c874bb4244d0cc6241a27ff8318174bb8430
                                                                  • Opcode Fuzzy Hash: 20a4f0483044e05ead07b9216d24a097e489e06d9183abde2aaa2290edabb471
                                                                  • Instruction Fuzzy Hash: 4D61B136749A828AEB60AF1290B43687790FB56B84F148135DA6D43BF6CF3CF450C708
                                                                  Function 00007FFDA4332394 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 145COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3538366584.00007FFDA4331000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA4330000, based on PE: true
                                                                  • Associated: 00000003.00000002.3538339366.00007FFDA4330000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538393900.00007FFDA4344000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538417282.00007FFDA4349000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538438392.00007FFDA434A000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ffda4330000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: abort$CallEncodePointerTranslator
                                                                  • String ID: MOC$RCC
                                                                  • API String ID: 2889003569-2084237596
                                                                  • Opcode ID: 9aa894c3c893ab74ee705d7221e0eb3435fed3f33ad5ca95d206f26215c5ec13
                                                                  • Instruction ID: 026b6019d4b3a8cae852f4a7e300bdc15eef6925bfc3a98b0b0b5d14fa29d964
                                                                  • Opcode Fuzzy Hash: 9aa894c3c893ab74ee705d7221e0eb3435fed3f33ad5ca95d206f26215c5ec13
                                                                  • Instruction Fuzzy Hash: 2F618432A09FC585E7609B15E4A03AAB7A0FB85B94F148225EB9D43776DF3CE190CB04
                                                                  Function 00007FFDA43342F0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 135COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3538366584.00007FFDA4331000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA4330000, based on PE: true
                                                                  • Associated: 00000003.00000002.3538339366.00007FFDA4330000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538393900.00007FFDA4344000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538417282.00007FFDA4349000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538438392.00007FFDA434A000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ffda4330000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: FileHeader
                                                                  • String ID: MOC$RCC$csm$csm
                                                                  • API String ID: 104395404-1441736206
                                                                  • Opcode ID: cc2941d08898c29ec0b938c5700553895786508ed6a70616e0c5efaebfc34f81
                                                                  • Instruction ID: 470f965e6ca7790f9c79430b497c02e151edff90c0294198bf40d4e9f3a35bf7
                                                                  • Opcode Fuzzy Hash: cc2941d08898c29ec0b938c5700553895786508ed6a70616e0c5efaebfc34f81
                                                                  • Instruction Fuzzy Hash: EC519C22B4AA4296EA60AB1191B017D2AA0FF56798F244135EE8D43773DF3CF4618709
                                                                  Function 00007FF69315A9C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: AddressFreeHandleLibraryModuleProc
                                                                  • String ID: CorExitProcess$mscoree.dll
                                                                  • API String ID: 4061214504-1276376045
                                                                  • Opcode ID: f90418b582b416691a14bbb2ae6c6b71f2096e7654ee2338269033ad2dc175a6
                                                                  • Instruction ID: e3d21088020094952072150452331c481c4bb9c7915c40c81941450928670669
                                                                  • Opcode Fuzzy Hash: f90418b582b416691a14bbb2ae6c6b71f2096e7654ee2338269033ad2dc175a6
                                                                  • Instruction Fuzzy Hash: 30F0F671B18A4281EB308B64E4463397324FF487A5F880279CA6EE62F4CF2CE044C300
                                                                  Function 00007FF69316A5D8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: _set_statfp
                                                                  • String ID:
                                                                  • API String ID: 1156100317-0
                                                                  • Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
                                                                  • Instruction ID: 1e3f71df128562c078159229641b178e4d554692b6e00c798a144de5a5e94819
                                                                  • Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
                                                                  • Instruction Fuzzy Hash: 0B1191B2E5CA1301FA7411A4D5533753058EF5837CF0456B4E96EE62F6CE2CA8514113
                                                                  Function 00007FF69315C290 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • FlsGetValue.KERNEL32(?,?,?,00007FF69315B4E7,?,?,00000000,00007FF69315B782,?,?,?,?,?,00007FF69315B70E), ref: 00007FF69315C2AF
                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF69315B4E7,?,?,00000000,00007FF69315B782,?,?,?,?,?,00007FF69315B70E), ref: 00007FF69315C2CE
                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF69315B4E7,?,?,00000000,00007FF69315B782,?,?,?,?,?,00007FF69315B70E), ref: 00007FF69315C2F6
                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF69315B4E7,?,?,00000000,00007FF69315B782,?,?,?,?,?,00007FF69315B70E), ref: 00007FF69315C307
                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF69315B4E7,?,?,00000000,00007FF69315B782,?,?,?,?,?,00007FF69315B70E), ref: 00007FF69315C318
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: Value
                                                                  • String ID:
                                                                  • API String ID: 3702945584-0
                                                                  • Opcode ID: f43b7e8ffdaa9f4f156d0b1eb130a323da5c860b472f5ddb223cc1376774324f
                                                                  • Instruction ID: b7a02c5cbc0d598605c925edacd7ab93793b542af2b7d3f40ffd9c01df8107e5
                                                                  • Opcode Fuzzy Hash: f43b7e8ffdaa9f4f156d0b1eb130a323da5c860b472f5ddb223cc1376774324f
                                                                  • Instruction Fuzzy Hash: CD117F21E0C64642FAB86B6595831793189DF587B4F4443B8E83EF67F6DE2CF8418300
                                                                  Function 00007FF69315C124 Relevance: 7.6, APIs: 5, Instructions: 50COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: Value
                                                                  • String ID:
                                                                  • API String ID: 3702945584-0
                                                                  • Opcode ID: 5830a724a110e18c9dc77d9d0afd73a4b7733b8d85f13529bf141d4281ca4b95
                                                                  • Instruction ID: ccf9116312d58fc39e7eba9bf3c3d8d6894f326fa471e41e6d21c330c6b3496c
                                                                  • Opcode Fuzzy Hash: 5830a724a110e18c9dc77d9d0afd73a4b7733b8d85f13529bf141d4281ca4b95
                                                                  • Instruction Fuzzy Hash: 8511F725E0C20782F9B8AB755893179318ACF44374F1857B8E93EFA2F6DD6CB8418740
                                                                  Function 00007FF6931485B0 Relevance: 7.5, APIs: 5, Instructions: 36sleepthreadCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: Window$Process$ConsoleCurrentShowSleepThread
                                                                  • String ID:
                                                                  • API String ID: 3908687701-0
                                                                  • Opcode ID: c4ce1bea477394a5bd7c29aaffed6a601c2f4b1d57d0592e327ceaa9095476a5
                                                                  • Instruction ID: 414ba723c6e54e64faa627485207b499afd26116dce8d5e87ba37ea79eda9f2a
                                                                  • Opcode Fuzzy Hash: c4ce1bea477394a5bd7c29aaffed6a601c2f4b1d57d0592e327ceaa9095476a5
                                                                  • Instruction Fuzzy Hash: 1C016230E1874282EA745B61B4890397268FF44BC8F045075D94FDB678DE3DD8418700
                                                                  Function 00007FF693156F60 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: _invalid_parameter_noinfo
                                                                  • String ID: verbose
                                                                  • API String ID: 3215553584-579935070
                                                                  • Opcode ID: 5742ae6ca51b03e9d6fd204cb41504e479b7e72b202bc53543779a715851f7d3
                                                                  • Instruction ID: df184a39e7d7d081678211c6274005a23bc121ca7d3cf2448a95de6369b5e9c5
                                                                  • Opcode Fuzzy Hash: 5742ae6ca51b03e9d6fd204cb41504e479b7e72b202bc53543779a715851f7d3
                                                                  • Instruction Fuzzy Hash: 0891CC32A08A4682E7318F25D85377D76E9EB05B94F848176DA5EE73E5DF3CE8428301
                                                                  Function 00007FF693160E38 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: _invalid_parameter_noinfo
                                                                  • String ID: UTF-16LEUNICODE$UTF-8$ccs
                                                                  • API String ID: 3215553584-1196891531
                                                                  • Opcode ID: 59f559b3b4a43374a67f10f227721a3fbc4a07d852e694dccd2ae9d3b54f0314
                                                                  • Instruction ID: d5d00c5dd8ae3161aa4651ed08f7bb8e1b137a815a4c35a886c5b20157abd5ff
                                                                  • Opcode Fuzzy Hash: 59f559b3b4a43374a67f10f227721a3fbc4a07d852e694dccd2ae9d3b54f0314
                                                                  • Instruction Fuzzy Hash: E181B132E0C65286FB784FAA811227D36ACEB11B4CF5580B5CA09F72B9CF3DE9418741
                                                                  Function 00007FF69314CBD8 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                                                                  • String ID: csm
                                                                  • API String ID: 2395640692-1018135373
                                                                  • Opcode ID: ab412f78eb90613ff4c98a1fac2d50a5770803065215d444c3ce453a3de23157
                                                                  • Instruction ID: 37b1991eed3c6e5f103a9c302b11a14eb47ff9a9040fb3c476459b5f7fcc2749
                                                                  • Opcode Fuzzy Hash: ab412f78eb90613ff4c98a1fac2d50a5770803065215d444c3ce453a3de23157
                                                                  • Instruction Fuzzy Hash: 8151C33AB196029ADB24CF15E449A793799FB44B9CF108171DA4E977A8EF3CE841C740
                                                                  Function 00007FFDA433E720 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3538366584.00007FFDA4331000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA4330000, based on PE: true
                                                                  • Associated: 00000003.00000002.3538339366.00007FFDA4330000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538393900.00007FFDA4344000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538417282.00007FFDA4349000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538438392.00007FFDA434A000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ffda4330000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                                                                  • String ID: csm
                                                                  • API String ID: 2395640692-1018135373
                                                                  • Opcode ID: b6877663b72478c921046e8b62552550de42e283109204e7406cf9fbc6b57853
                                                                  • Instruction ID: 70a703c98045153194a452f245dadcb49ef62ad530e9d40c383879664eae6c98
                                                                  • Opcode Fuzzy Hash: b6877663b72478c921046e8b62552550de42e283109204e7406cf9fbc6b57853
                                                                  • Instruction Fuzzy Hash: 9B51B032B5AA028ADB94AB15E0B5A787791FF46B88F504131DA4E477BADF3CF841C704
                                                                  Function 00007FF69314E468 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: CallEncodePointerTranslator
                                                                  • String ID: MOC$RCC
                                                                  • API String ID: 3544855599-2084237596
                                                                  • Opcode ID: 2d0d38728c8b81eb1afee087d1255ca92539906646f1d2432080e5defd871a42
                                                                  • Instruction ID: b2dd0d4619be4aaddf6f1fa245e705426258c333a8881a49908ee8aaa3b16f28
                                                                  • Opcode Fuzzy Hash: 2d0d38728c8b81eb1afee087d1255ca92539906646f1d2432080e5defd871a42
                                                                  • Instruction Fuzzy Hash: ED61C332A08BC585DB709F25E4453AAB7A4FB84788F044675EB9C67BA5DF7CE090CB00
                                                                  Function 00007FF69314E818 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                                                                  • String ID: csm$csm
                                                                  • API String ID: 3896166516-3733052814
                                                                  • Opcode ID: 881cb4ef47e13874d43f93ad661edca9df8e178c9ea1252ba64912ddd8f944cb
                                                                  • Instruction ID: c8d9c5bd7076ef1c6dc84421b4f5449362504a905a4cea744d455446a0efa8e6
                                                                  • Opcode Fuzzy Hash: 881cb4ef47e13874d43f93ad661edca9df8e178c9ea1252ba64912ddd8f944cb
                                                                  • Instruction Fuzzy Hash: F5519F32A083828AEB748F65D04A36877A8FB54B88F1451B5DA8CA7BE5CF3CE451C711
                                                                  Function 00007FFDA43334E0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3538366584.00007FFDA4331000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA4330000, based on PE: true
                                                                  • Associated: 00000003.00000002.3538339366.00007FFDA4330000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538393900.00007FFDA4344000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538417282.00007FFDA4349000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538438392.00007FFDA434A000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ffda4330000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: abort$CreateFrameInfo__except_validate_context_record
                                                                  • String ID: csm
                                                                  • API String ID: 444109036-1018135373
                                                                  • Opcode ID: 7c62ae0bd6f598e5530dee3ab7a169ccc6f3387c11d68efdd1ef4d3d9c7f7e50
                                                                  • Instruction ID: 5ef12e57c831153aad064d940bf1a54cbc561989d62b6456e7877c3cb2b90795
                                                                  • Opcode Fuzzy Hash: 7c62ae0bd6f598e5530dee3ab7a169ccc6f3387c11d68efdd1ef4d3d9c7f7e50
                                                                  • Instruction Fuzzy Hash: FD514F3375AB4186E620AB15E5A426D7BA4FB8AB90F141535EB8D07B76CF3CF450CB04
                                                                  Function 00007FFDA43399AC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 94COMMONLIBRARYCODE
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3538366584.00007FFDA4331000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA4330000, based on PE: true
                                                                  • Associated: 00000003.00000002.3538339366.00007FFDA4330000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538393900.00007FFDA4344000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538417282.00007FFDA4349000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538438392.00007FFDA434A000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ffda4330000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: NameName::
                                                                  • String ID: %lf
                                                                  • API String ID: 1333004437-2891890143
                                                                  • Opcode ID: 96db185dee724ff1af179d5801cdaf6ae824addfb7b5e3897bc050de27ca576d
                                                                  • Instruction ID: 3edda1bcecfb42261f9472a159faebee6305b7e1e632ee3dfd678a4aa202a88c
                                                                  • Opcode Fuzzy Hash: 96db185dee724ff1af179d5801cdaf6ae824addfb7b5e3897bc050de27ca576d
                                                                  • Instruction Fuzzy Hash: 97319261F4AE8685E610AB61A8F00FA6361BF57B81F448231EA4F537B2DE2CE501C748
                                                                  Function 00007FF693147260 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • CreateDirectoryW.KERNEL32(00000000,?,00007FF6931428EC,FFFFFFFF,00000000,00007FF69314336A), ref: 00007FF693147372
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: CreateDirectory
                                                                  • String ID: %.*s$%s%c$\
                                                                  • API String ID: 4241100979-1685191245
                                                                  • Opcode ID: edef38ff62529b20aa9e4dd174cb85ee92fdf6a12d4b4b11e6a9369b37dc6bc2
                                                                  • Instruction ID: dd454a1703bb300f0e7f73123c664cdbc13fb04fe3c360b6825296e4bd650977
                                                                  • Opcode Fuzzy Hash: edef38ff62529b20aa9e4dd174cb85ee92fdf6a12d4b4b11e6a9369b37dc6bc2
                                                                  • Instruction Fuzzy Hash: C2310A2171DAC556EA319B20E4157EA735DEF84BE8F404670EEADA37E5DF2CD2058700
                                                                  Function 00007FF693142220 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 61COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetCurrentProcessId.KERNEL32(FFFFFFFF,00000000,00000000,?,00000000,00007FF69314866F), ref: 00007FF69314226E
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: CurrentProcess
                                                                  • String ID: %ls$WARNING$[PYI-%d:%ls]
                                                                  • API String ID: 2050909247-3372507544
                                                                  • Opcode ID: 92da2cbc5b979b0862b6cfd95371d042a7d5931ee882c49d5c626b31f152fc77
                                                                  • Instruction ID: 7c2379a245bbd7a1fa4c0859b064fd4ebdb2c65050b44d355387f47671b843d0
                                                                  • Opcode Fuzzy Hash: 92da2cbc5b979b0862b6cfd95371d042a7d5931ee882c49d5c626b31f152fc77
                                                                  • Instruction Fuzzy Hash: CE21D43271CB8251E6309BA1F8466EA7368FF847C8F405176EA8DA3A6ADF3CD115C740
                                                                  Function 00007FFDA43310F0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 28COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                    • Part of subcall function 00007FFDA4335508: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFDA433108E), ref: 00007FFDA4335516
                                                                  • terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA433112E
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3538366584.00007FFDA4331000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA4330000, based on PE: true
                                                                  • Associated: 00000003.00000002.3538339366.00007FFDA4330000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538393900.00007FFDA4344000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538417282.00007FFDA4349000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538438392.00007FFDA434A000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ffda4330000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: abortterminate
                                                                  • String ID: MOC$RCC$csm
                                                                  • API String ID: 661698970-2671469338
                                                                  • Opcode ID: 1e1d061888eb5ed8958d1a3f543fee4a516cb38e8faaed4a66704169c3245728
                                                                  • Instruction ID: 64e060a492f7e1899d4acb4af5711e128e99caaaaa8f33ac66535c83fa7bc0f7
                                                                  • Opcode Fuzzy Hash: 1e1d061888eb5ed8958d1a3f543fee4a516cb38e8faaed4a66704169c3245728
                                                                  • Instruction Fuzzy Hash: C7F03C36A5AA0681EB507B51A1E50AC3774EB49B41F095031D75907377CF3CF890CB05
                                                                  Function 00007FF69315D4A0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: FileWrite$ConsoleErrorLastOutput
                                                                  • String ID:
                                                                  • API String ID: 2718003287-0
                                                                  • Opcode ID: fabcd4fad7fa856dcf2e9951dc7cbf89ababb6e1d40fd4369e0489b0ae7d9f25
                                                                  • Instruction ID: b5b66af47de4ebcfdbe70332fec1963543d3867819a633eda10d9ed0dca34962
                                                                  • Opcode Fuzzy Hash: fabcd4fad7fa856dcf2e9951dc7cbf89ababb6e1d40fd4369e0489b0ae7d9f25
                                                                  • Instruction Fuzzy Hash: C6D10472B28A8189E720CF75D4412AC37B9FB447D8B544276CE5EE7BA9DE38E416C700
                                                                  Function 00007FF69315DE60 Relevance: 6.2, APIs: 4, Instructions: 218COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF69315DE4B), ref: 00007FF69315DF7C
                                                                  • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF69315DE4B), ref: 00007FF69315E007
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: ConsoleErrorLastMode
                                                                  • String ID:
                                                                  • API String ID: 953036326-0
                                                                  • Opcode ID: 25026d299ec132fa7e986de3a50f80dd4a1c565eb46710a002b358a032e27337
                                                                  • Instruction ID: ade818914669fac5ad5cafabd7d06038a9591939ea671d275edacac03127b8cc
                                                                  • Opcode Fuzzy Hash: 25026d299ec132fa7e986de3a50f80dd4a1c565eb46710a002b358a032e27337
                                                                  • Instruction Fuzzy Hash: 3291C132F1865285F7709F6594822BD3BA8EB44B88F5441B9DE0EF7AA4CF38E442D710
                                                                  Function 00007FFDA4338EC8 Relevance: 6.2, APIs: 4, Instructions: 193COMMONLIBRARYCODE
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3538366584.00007FFDA4331000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA4330000, based on PE: true
                                                                  • Associated: 00000003.00000002.3538339366.00007FFDA4330000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538393900.00007FFDA4344000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538417282.00007FFDA4349000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538438392.00007FFDA434A000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ffda4330000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: Name::operator+
                                                                  • String ID:
                                                                  • API String ID: 2943138195-0
                                                                  • Opcode ID: 21ceaebb6340b33c2880b1d94455a3a587ac808d2dbe1c8140b81e3c0e4e29dc
                                                                  • Instruction ID: cb8551acb0303fa471ddcc15f58d182108e6cfcf59fc1933f7741355d6ec64d7
                                                                  • Opcode Fuzzy Hash: 21ceaebb6340b33c2880b1d94455a3a587ac808d2dbe1c8140b81e3c0e4e29dc
                                                                  • Instruction Fuzzy Hash: 60916B26F4AE5289FB10AB64D8B43AC37A1BB06748F548035DA4E277B6DF7CA845C344
                                                                  Function 00007FF693160BFC Relevance: 6.2, APIs: 4, Instructions: 161COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: _get_daylight$_isindst
                                                                  • String ID:
                                                                  • API String ID: 4170891091-0
                                                                  • Opcode ID: 89e82a0bcb92f9a57c8ce538440e566bc748d838767a3902d6c6661200ebf515
                                                                  • Instruction ID: 10917e8bdc0af5ea803ea9f847196fa23d636b24a089f1c71f90cb882a4cb299
                                                                  • Opcode Fuzzy Hash: 89e82a0bcb92f9a57c8ce538440e566bc748d838767a3902d6c6661200ebf515
                                                                  • Instruction Fuzzy Hash: 6351B672F0821586EB34DFA49D566BC3769EB0035DF504275DD1EE2AF9DF38A8418700
                                                                  Function 00007FF693156738 Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: File$ErrorHandleInformationLastNamedPeekPipeType
                                                                  • String ID:
                                                                  • API String ID: 2780335769-0
                                                                  • Opcode ID: 77215611d5833cc4261aa3ce6efef3cbe316a0555a56b2abfd6bea145bf69a9d
                                                                  • Instruction ID: 6461cc39643d35f7de6c9c32deae70891b422ab6447ba6c0e209d84bfe4dde12
                                                                  • Opcode Fuzzy Hash: 77215611d5833cc4261aa3ce6efef3cbe316a0555a56b2abfd6bea145bf69a9d
                                                                  • Instruction Fuzzy Hash: 45517E22E087018AF720DFB1D4523BD37A9EB48B88F149579DE0DE76A9DF38D4918780
                                                                  Function 00007FFDA433BB04 Relevance: 6.1, APIs: 4, Instructions: 87COMMONLIBRARYCODE
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3538366584.00007FFDA4331000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA4330000, based on PE: true
                                                                  • Associated: 00000003.00000002.3538339366.00007FFDA4330000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538393900.00007FFDA4344000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538417282.00007FFDA4349000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538438392.00007FFDA434A000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ffda4330000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: Name::operator+
                                                                  • String ID:
                                                                  • API String ID: 2943138195-0
                                                                  • Opcode ID: 0bd3be82ad391ae9cd5c01d857b5e8d25ae8efb4ad2905c542e999dede7c0f10
                                                                  • Instruction ID: f5212f7ec3b1cdcdb23129d73237e7ba14bb368f5e83817e9dc492c74b63e837
                                                                  • Opcode Fuzzy Hash: 0bd3be82ad391ae9cd5c01d857b5e8d25ae8efb4ad2905c542e999dede7c0f10
                                                                  • Instruction Fuzzy Hash: F7417672B09B8089EB11DFA4C8A03AC37A0FB4AB49F548025CA4D5B76ADF7CA480C314
                                                                  Function 00007FF69314C5E0 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                  • String ID:
                                                                  • API String ID: 2933794660-0
                                                                  • Opcode ID: d5122b7aff0e10d146bffe79506b726acaac58846df22bdc99709fd59aa8d240
                                                                  • Instruction ID: b364dd2a2d2a1ca82e1001c6a874bf099400c86898f249dae1b5caadf159b987
                                                                  • Opcode Fuzzy Hash: d5122b7aff0e10d146bffe79506b726acaac58846df22bdc99709fd59aa8d240
                                                                  • Instruction Fuzzy Hash: 26117C36B14F058AEB10CFA0E8462B833A8FB19758F040E35DA6D927B4DF7CD1548340
                                                                  Function 00007FFD93C35BD4 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3537087386.00007FFD93A71000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFD93A70000, based on PE: true
                                                                  • Associated: 00000003.00000002.3537066736.00007FFD93A70000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537378063.00007FFD93D26000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537378063.00007FFD93D47000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537378063.00007FFD93D56000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537378063.00007FFD93D60000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537378063.00007FFD93DA2000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537378063.00007FFD93E71000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537378063.00007FFD93E79000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537817174.00007FFD93F81000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537852444.00007FFD93F98000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537878079.00007FFD93F9D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537903423.00007FFD93F9E000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537930775.00007FFD93F9F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537960165.00007FFD93FA0000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538002694.00007FFD93FC6000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538021346.00007FFD93FC8000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538047580.00007FFD93FD0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538078514.00007FFD94011000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538103778.00007FFD94045000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538142976.00007FFD9406D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538164630.00007FFD9406F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538183115.00007FFD94071000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538201698.00007FFD94072000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538219382.00007FFD94073000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538246741.00007FFD94075000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538269490.00007FFD94084000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538290744.00007FFD94096000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538317396.00007FFD940B2000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ffd93a70000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                  • String ID:
                                                                  • API String ID: 2933794660-0
                                                                  • Opcode ID: 4c843af704d4999d6b1dd3508e9d37868a4ccb8a5710554f336d0007bef571e5
                                                                  • Instruction ID: 42e56143a6b0140ddc89b915f5772a644557bba4a3fc2e1cd0038264ea497b9c
                                                                  • Opcode Fuzzy Hash: 4c843af704d4999d6b1dd3508e9d37868a4ccb8a5710554f336d0007bef571e5
                                                                  • Instruction Fuzzy Hash: 3A113C22B14F418AEB10CFA1EC642B833A8FB19758F441E35EA6D977A8DF7CD1648340
                                                                  Function 00007FFDA4340D5C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3538366584.00007FFDA4331000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA4330000, based on PE: true
                                                                  • Associated: 00000003.00000002.3538339366.00007FFDA4330000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538393900.00007FFDA4344000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538417282.00007FFDA4349000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538438392.00007FFDA434A000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ffda4330000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                  • String ID:
                                                                  • API String ID: 2933794660-0
                                                                  • Opcode ID: 15bdf73cda2f41086707368dd9349a273cb6e4dedd62d10c03f2e51642f891d7
                                                                  • Instruction ID: 69c06688c0dc0027a8476f5a909676d27f81c1702ff3789e80949043e8f1106d
                                                                  • Opcode Fuzzy Hash: 15bdf73cda2f41086707368dd9349a273cb6e4dedd62d10c03f2e51642f891d7
                                                                  • Instruction Fuzzy Hash: 85112E26B55F018AEB00DF60E8A42F833B4FB5A759F440E31DA6E467A6DF7CD1688340
                                                                  Function 00007FF693166D8C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: _get_daylight$_invalid_parameter_noinfo
                                                                  • String ID: ?
                                                                  • API String ID: 1286766494-1684325040
                                                                  • Opcode ID: d0b5b4893435fc06bb44c0bfd3c4afae0be10aa3ee1d4f6c058f23408d263c6b
                                                                  • Instruction ID: 33e5ec1b2f9e5451b5b502af857315931ce9dda28960b3f95c25fa257de91c1b
                                                                  • Opcode Fuzzy Hash: d0b5b4893435fc06bb44c0bfd3c4afae0be10aa3ee1d4f6c058f23408d263c6b
                                                                  • Instruction Fuzzy Hash: 07410532A0878246FB34DBA5D40237E76A8EB90BA8F144275EE5C96AF5DF3CD491C700
                                                                  Function 00007FF693159F50 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • _invalid_parameter_noinfo.LIBCMT ref: 00007FF693159F82
                                                                    • Part of subcall function 00007FF69315B464: HeapFree.KERNEL32(?,?,?,00007FF693163F92,?,?,?,00007FF693163FCF,?,?,00000000,00007FF693164495,?,?,?,00007FF6931643C7), ref: 00007FF69315B47A
                                                                    • Part of subcall function 00007FF69315B464: GetLastError.KERNEL32(?,?,?,00007FF693163F92,?,?,?,00007FF693163FCF,?,?,00000000,00007FF693164495,?,?,?,00007FF6931643C7), ref: 00007FF69315B484
                                                                  • GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF69314C165), ref: 00007FF693159FA0
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
                                                                  • String ID: C:\Users\user\Desktop\lock.exe
                                                                  • API String ID: 3580290477-1614551167
                                                                  • Opcode ID: 6a4dbdaa8dd2b454c87b42bcae1ae77807c0d922a2c4c320371c355071f6a322
                                                                  • Instruction ID: e6a7dcdfcd44276b89d00964c247ded2568647f8fa568066e6f146fbc804462f
                                                                  • Opcode Fuzzy Hash: 6a4dbdaa8dd2b454c87b42bcae1ae77807c0d922a2c4c320371c355071f6a322
                                                                  • Instruction Fuzzy Hash: 37418032A08B1286EB35DF21A4420BD7799FB447C4F444076EA4ED7BA6DF3DE4818305
                                                                  Function 00007FF69315DB38 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: ErrorFileLastWrite
                                                                  • String ID: U
                                                                  • API String ID: 442123175-4171548499
                                                                  • Opcode ID: 57f6403a17afa6857eb93518903eebf05678db2d18f563f749b6ba14b42682ba
                                                                  • Instruction ID: 74ed69398f7f25342da09cfa86783f98a1a817f31e3faee638e71c3efc2ca626
                                                                  • Opcode Fuzzy Hash: 57f6403a17afa6857eb93518903eebf05678db2d18f563f749b6ba14b42682ba
                                                                  • Instruction Fuzzy Hash: D541B272B29A8181EB308F25E4453AA77A9FB88794F514035EE8ED77A8DF7CD441C700
                                                                  Function 00007FF693142020 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 78COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF693141B4A), ref: 00007FF693142070
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: CurrentProcess
                                                                  • String ID: %s: %s$[PYI-%d:ERROR]
                                                                  • API String ID: 2050909247-3704582800
                                                                  • Opcode ID: a5f084cc36529dd82358bb6d3c03fbfc020d3d736b3f3fde6876dd26524326fa
                                                                  • Instruction ID: a7c88b44b2597beb154a543b077c69609393e782d5e8b8f43034a8d9162104c7
                                                                  • Opcode Fuzzy Hash: a5f084cc36529dd82358bb6d3c03fbfc020d3d736b3f3fde6876dd26524326fa
                                                                  • Instruction Fuzzy Hash: AF21E572B1868156E7309761BC466E67298FF88BD8F404171FE8DE7B6ADE3CD156C200
                                                                  Function 00007FFDA4338DB4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68COMMONLIBRARYCODE
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3538366584.00007FFDA4331000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA4330000, based on PE: true
                                                                  • Associated: 00000003.00000002.3538339366.00007FFDA4330000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538393900.00007FFDA4344000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538417282.00007FFDA4349000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538438392.00007FFDA434A000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ffda4330000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: Name::operator+
                                                                  • String ID: void$void
                                                                  • API String ID: 2943138195-3746155364
                                                                  • Opcode ID: 9a107da830986a561f624b9ef5478456632fe2e7b7c502874fad34e42bf4480a
                                                                  • Instruction ID: f7413a9dca049488be46e35d193d8025b869eb07d2ea84471ec6b27ae78b9118
                                                                  • Opcode Fuzzy Hash: 9a107da830986a561f624b9ef5478456632fe2e7b7c502874fad34e42bf4480a
                                                                  • Instruction Fuzzy Hash: 92316966F5AF5588FB00ABA0E8A00EC37B0BB49748B440136DA4E12B7ADF7CA144C748
                                                                  Function 00007FF693160828 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: CurrentDirectory
                                                                  • String ID: :
                                                                  • API String ID: 1611563598-336475711
                                                                  • Opcode ID: 4eb2485002f7e18dd5ad5ab22e07d9568f7ad018dfd4fb00fa812247a7c0dd43
                                                                  • Instruction ID: f0c116dc14797d4415f2ca1b463c4bc6994aef7cb20f59443fb88d63df3477b8
                                                                  • Opcode Fuzzy Hash: 4eb2485002f7e18dd5ad5ab22e07d9568f7ad018dfd4fb00fa812247a7c0dd43
                                                                  • Instruction Fuzzy Hash: 87219172E0C68181FB30DB15D44626D73A9FB88B88F858075D68DA36A9DF7CE985C780
                                                                  Function 00007FF693142140 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetCurrentProcessId.KERNEL32(00000000,?,?,?,00000000,00007FF6931428DA,FFFFFFFF,00000000,00007FF69314336A), ref: 00007FF69314218E
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: CurrentProcess
                                                                  • String ID: WARNING$[PYI-%d:%s]
                                                                  • API String ID: 2050909247-3752221249
                                                                  • Opcode ID: 28628bd70d5a97629098dcd42eabd330bee057474c06a66384895197b474a4b9
                                                                  • Instruction ID: 619c7c1ec060980ed7ec34b76f219ddf9aa124df46ec751f5303c031aa994ac4
                                                                  • Opcode Fuzzy Hash: 28628bd70d5a97629098dcd42eabd330bee057474c06a66384895197b474a4b9
                                                                  • Instruction Fuzzy Hash: 52119032618B8541E6309B61F8866EA7398FF887C8F405175FA8DA3B69DF7CD1558700
                                                                  Function 00007FF693141E50 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF693141B79), ref: 00007FF693141E9E
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: CurrentProcess
                                                                  • String ID: ERROR$[PYI-%d:%s]
                                                                  • API String ID: 2050909247-3005936843
                                                                  • Opcode ID: c1c0bec23ccac853a0e083361079492e25c9a947d7081d13b76ea5259852d608
                                                                  • Instruction ID: fd9247974a77ac9731430b06812d649da34d248a0faaaee44d5084273c7975c7
                                                                  • Opcode Fuzzy Hash: c1c0bec23ccac853a0e083361079492e25c9a947d7081d13b76ea5259852d608
                                                                  • Instruction Fuzzy Hash: B011903261CB8541E6309B61F8866EA73A8FF887C8F405175FA8DA3B69DE7CD1558700
                                                                  Function 00007FFDA4334E2F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3538366584.00007FFDA4331000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA4330000, based on PE: true
                                                                  • Associated: 00000003.00000002.3538339366.00007FFDA4330000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538393900.00007FFDA4344000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538417282.00007FFDA4349000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538438392.00007FFDA434A000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ffda4330000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: FileHeader$ExceptionRaise
                                                                  • String ID: Access violation - no RTTI data!$Bad dynamic_cast!
                                                                  • API String ID: 3685223789-3176238549
                                                                  • Opcode ID: 31c157b8eb2ec39060d8679ded3c8c7a40717f4d930d4d3a676af0386f3d6913
                                                                  • Instruction ID: 255b35563b19808e05f2a934ae7c0555748faf4aab444c476238b66530f03553
                                                                  • Opcode Fuzzy Hash: 31c157b8eb2ec39060d8679ded3c8c7a40717f4d930d4d3a676af0386f3d6913
                                                                  • Instruction Fuzzy Hash: 0F015E61BABE46A1EE40EB10E4F01B86360FFA1B45F605431E64E07776EF6CE505C708
                                                                  Function 00007FF69314F2D8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: ExceptionFileHeaderRaise
                                                                  • String ID: csm
                                                                  • API String ID: 2573137834-1018135373
                                                                  • Opcode ID: 778d4a5eeee770603d02c5501bef52114850414878b0bee781498c4a1570bacf
                                                                  • Instruction ID: b4dd1083252419c39d0199c0f014917a6e017304c82a45883c02f90b4fff95a1
                                                                  • Opcode Fuzzy Hash: 778d4a5eeee770603d02c5501bef52114850414878b0bee781498c4a1570bacf
                                                                  • Instruction Fuzzy Hash: 4B113032618B8182EB618F15F544269B7E4FB88B88F584274DE8D57764EF3CD551C700
                                                                  Function 00007FFDA43351D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3538366584.00007FFDA4331000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA4330000, based on PE: true
                                                                  • Associated: 00000003.00000002.3538339366.00007FFDA4330000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538393900.00007FFDA4344000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538417282.00007FFDA4349000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538438392.00007FFDA434A000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ffda4330000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: ExceptionFileHeaderRaise
                                                                  • String ID: csm
                                                                  • API String ID: 2573137834-1018135373
                                                                  • Opcode ID: 24fc685d9c18a97879a9043e169dd32e9d23318a9617333a79ec660fdc06252e
                                                                  • Instruction ID: bfad133c048e1261e8d8fdc0867e5749a219caa7b949d2e3145e6d1eb81cacc3
                                                                  • Opcode Fuzzy Hash: 24fc685d9c18a97879a9043e169dd32e9d23318a9617333a79ec660fdc06252e
                                                                  • Instruction Fuzzy Hash: 23118B3260AF8082EB218B14F4A0269B7E0FB98B84F184230DE8D4776ADF3CD5518B04
                                                                  Function 00007FF6931619AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3536895325.00007FF693141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF693140000, based on PE: true
                                                                  • Associated: 00000003.00000002.3536861785.00007FF693140000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536940320.00007FF69316D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693180000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3536981594.00007FF693183000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3537030267.00007FF693186000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ff693140000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: DriveType_invalid_parameter_noinfo
                                                                  • String ID: :
                                                                  • API String ID: 2595371189-336475711
                                                                  • Opcode ID: a21020f9989eba13c36801fee87724dcdfb53302495b3b0e02d80308072ceaa1
                                                                  • Instruction ID: f9720a2541d10c28f0dcb6447abbf68676e91fe035f3fa5cd513dae2abf3b642
                                                                  • Opcode Fuzzy Hash: a21020f9989eba13c36801fee87724dcdfb53302495b3b0e02d80308072ceaa1
                                                                  • Instruction Fuzzy Hash: 2F017C32A1C64286E734ABA0946327E72A8EF4874CF801075D64EE26A5DF2CE544CB14
                                                                  Function 00007FFDA433E4D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                    • Part of subcall function 00007FFDA433E720: __except_validate_context_record.LIBVCRUNTIME ref: 00007FFDA433E74B
                                                                    • Part of subcall function 00007FFDA4335508: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFDA433108E), ref: 00007FFDA4335516
                                                                  • terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA433E50A
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3538366584.00007FFDA4331000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA4330000, based on PE: true
                                                                  • Associated: 00000003.00000002.3538339366.00007FFDA4330000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538393900.00007FFDA4344000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538417282.00007FFDA4349000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538438392.00007FFDA434A000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ffda4330000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: __except_validate_context_recordabortterminate
                                                                  • String ID: csm$f
                                                                  • API String ID: 339134311-629598281
                                                                  • Opcode ID: 049055b88727f29c58bed955df15e2ffd86eccd5c54e7ffa759ec555c1e45828
                                                                  • Instruction ID: fed597aa0d628616d8ccfec4fb0c4cc5d246fb49f0c9d45b6d7b8c27b62ce65d
                                                                  • Opcode Fuzzy Hash: 049055b88727f29c58bed955df15e2ffd86eccd5c54e7ffa759ec555c1e45828
                                                                  • Instruction Fuzzy Hash: 19E0E576E4AE4280FBA07B20B2F127C2AA0AF17750F148030DA4807377CE3CF4908B09
                                                                  Function 00007FFDA4335524 Relevance: 5.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetLastError.KERNEL32(?,?,?,00007FFDA43353A9,?,?,?,?,00007FFDA433F63F,?,?,?,?,?), ref: 00007FFDA4335543
                                                                  • SetLastError.KERNEL32(?,?,?,00007FFDA43353A9,?,?,?,?,00007FFDA433F63F,?,?,?,?,?), ref: 00007FFDA43355CC
                                                                  Memory Dump Source
                                                                  • Source File: 00000003.00000002.3538366584.00007FFDA4331000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA4330000, based on PE: true
                                                                  • Associated: 00000003.00000002.3538339366.00007FFDA4330000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538393900.00007FFDA4344000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538417282.00007FFDA4349000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                  • Associated: 00000003.00000002.3538438392.00007FFDA434A000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_3_2_7ffda4330000_lock.jbxd
                                                                  Similarity
                                                                  • API ID: ErrorLast
                                                                  • String ID:
                                                                  • API String ID: 1452528299-0
                                                                  • Opcode ID: 550cea5c84bc0485e2971ce80c0edd506865995108a692b5126701225aaf57c4
                                                                  • Instruction ID: 6fe64b3db397f032e1d4b067d7d37144033345bcf27ddfa1ff246d2dc3b4cf9b
                                                                  • Opcode Fuzzy Hash: 550cea5c84bc0485e2971ce80c0edd506865995108a692b5126701225aaf57c4
                                                                  • Instruction Fuzzy Hash: FD112420B4BF4241FA14A731A8B81786292AF56BA1F158634D92F063F7DE2CF445C608